use gateway based on source address

Question

Hey Gang,&nbsp;&nbsp;I've been working with f5 support trying to get this working while now but can't seem to get it going for some reason.  Essentially, I need traffic sourced from a node to be sent out a particular gateway, in this case, 10.64.20.2 (firewall interface).&nbsp;&nbsp;&nbsp;I set up a 0.0.0.0/0.0.0.0 IP forwarding VS coupled with this irule&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when CLIENT_ACCEPTED {&nbsp;if {[[IP::client_addr] equals "10.64.40.0/24"] } {&nbsp;                          node 10.64.40.2&nbsp;              }&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;The LTM floating IP (10.64.40.1) is set as the default gateway of the node, and node IP is 10.64.40.80.&nbsp;&nbsp;&nbsp;Doesn't want to work for some reason.  &nbsp;&nbsp;&nbsp;I tried copying the config from this thread:  http://devcentral.f5.com/Community/...fault.aspx&nbsp;&nbsp;&nbsp;Looks pretty straightforward, but I must be doing something wrong.  Would appreciate if others had any thoughts/ideas.&nbsp;&nbsp;&nbsp;Thanks,&nbsp;&nbsp;&nbsp;-Ken&nbsp;

hooleylist · Answer

Hi Ken, 
  
 It's missing "IP::addr" to actually do the comparison:

when CLIENT_ACCEPTED {
   if {[IP::addr [IP::client_addr] equals "10.64.40.0/24"] } {
      node 10.64.40.2
   }
}

Aaron

yammy1688_99834 · Answer

hoolio, you should be coolio cause you're that awesome har har.&nbsp;&nbsp;Worked right off the bat!&nbsp;&nbsp;&nbsp;Thanks!&nbsp;&nbsp;

yammy1688_99834 · Answer

Posted By hoolio on 03/28/2011 08:11 PM

Hi Ken, 
 It's missing "IP::addr" to actually do the comparison: 
 when CLIENT_ACCEPTED {
   if {[IP::addr [IP::client_addr] equals "10.64.40.0/24"] } {
      node 10.64.40.2
   }
}
 
 Aaron

Would it be possible to use a class containing a subnet/gateway pair for this rule?  I can't quite figure out how to get a pair of variables to go together.

hamish · Answer

Yep. Use an address class. 
&nbsp;  
&nbsp; I have some code around here somewhere. I'll grab it and post... 
&nbsp;  
&nbsp; H

michael_yates · Answer

Sure.  Try this:

when CLIENT_ACCEPTED {
   if { [class match [IP::client_addr] equals mynetworks] } {
       pool matching.pool.name or node 10.10.10.10
   }
   else {
       pool nonmatching.pool.name or node 20.20.20.20
   }
}

Forum Discussion

use gateway based on source address

Recent Discussions

F5 looses the token for the first call

iRule - Url rewrite and header replace and pool selection not working

Switch ssl profile based on weak cipher detection via IRULE

full-proxy HTTP2

Decode ObjectSID from Base64-encode string

Related Content

Integrating SSL Orchestrator with McAfee Web Gateway-Transparent Proxy

Verified Design: SSL Orchestrator with McAfee Web Gateway-Part 1

CSV to Address External Datagroup File

ICMP Custom Source Address Monitor

Is it possible to choose the access profile used based on source IP address?

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS