For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AlexDeMarco's avatar
AlexDeMarco
Icon for Nimbostratus rankNimbostratus
Jan 24, 2017

Trying to force down a VIP via a health monitor, is there a better way?

I have a vip that does not have default pool assigned (for a variety of reasons). We use an irule to direct traffic to 1 of 2 pools based on certain criteria. However, I need to be able to disable the vip if there are zero nodes available in either pool. I have an external monitor created that checks the number of available pool members and can disable the vip. My problem is that if I assign this monitor to either pool the script runs for the number of nodes in each pool. So if have have 2 nodes in 2 pools it runs 4 times. I only want it to run once. Would I be better off moving this check to the irule associate with the vip instead? Or is there a better way to accomplish this? Thank you in advance.

 

3 Replies

  • I think I may be over complicating things..

     

    If I add this to the Irule attached to the vip: when CLIENT_ACCEPTED { if { [active_members DEV_7099] < 1 and [active_members DEV_7002] < 1 }{ reject log local0. "[IP::client_addr] - Client rejected. Active members of MyPoolName dropped below 3." } else { return } }

     

    Is this the same as the same behavior as if the vip was disabled??

     

  • The only difference is that when a vip is down or disabled it won't accept any traffic.

     

    Your iRule will have to finish the 3way handshake to execute the reject.

     

    Cheers,

     

    Kees

     

  • It will behave the same, however it won't show as 'disabled'.

     

    BTW the 'reject' is CLIENT_ACCEPTED is fine - you don't need to complete 3-way handshake.

     

    HOWEVER active_members won't work unless you have monitors assigned - there's something wrong with the logic here.......