Forum Discussion

Abed_AL-R's avatar
Abed_AL-R
Icon for Cirrostratus rankCirrostratus
Jul 02, 2020

Weird iRules issue

Hi We have one virtual server that has two different irules that somehow conflict each other and denying traffic that should not be denied. The first iRule is permitting traffic to one URI to o...
application delivery
iRules
LTM
  • BLacaze's avatar
    BLacaze
    Jul 02, 2020

    Hello,

    can you please share the content of your datagroups ?

     

    Also one thing I would try is change the $allowed variable to $allowed_for_uri1 in irule 1 and $allowed_for_uri2 for irule 2 for example (it seems they shouldn't be shared, but considering the strange behaviour you have).

     

BLacaze's avatar
BLacaze
Icon for Altostratus rankAltostratus
Jul 02, 2020

Hello,

can you please share the content of your datagroups ?

 

Also one thing I would try is change the $allowed variable to $allowed_for_uri1 in irule 1 and $allowed_for_uri2 for irule 2 for example (it seems they shouldn't be shared, but considering the strange behaviour you have).

 

  • Abed_AL-R's avatar
    Abed_AL-R
    Icon for Cirrostratus rankCirrostratus
    Jul 02, 2020

    Hi

     

    Thanks! Changing the $allowed variable to $allowed_for_uri1 resolved the problem.

    But I'm not sure why they conflict .. This is strange.

     

    • BLacaze's avatar
      BLacaze
      Icon for Altostratus rankAltostratus
      Jul 02, 2020

      Glad it helped.

      In fact, local irules variables remain present for the length of the TCP connection, as explained here: https://devcentral.f5.com/s/articles/irules-101-03-variables .

       

      So you might have cases where:

      • CLIENT_ACCEPTED for irule 1 is executed
      • then CLIENT_ACCEPTED for irule 2 is executed (which might modify $allowed)
      • then HTTP_REQUEST for irule 1 is executed, and here you have your mismatch :)