For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bob_Z_148422's avatar
Bob_Z_148422
Icon for Nimbostratus rankNimbostratus
Feb 01, 2017

What can I do in an iRule on a rule in an AFM policy

I have a IP forwarding VS that acts as a default gateway for my network. I also want to log the HTTP traffic that passes through that VS. I created an iRule on the http rule on the AFM policy linked to the VS. I found that without a HTTP profile on the VS I can't use HTTP_REQUEST. I added a FLOW_INIT and tried to direct the traffic to another VS using 'virtual HTTPLog' but even though the event fires the redirect doesn't happen. I tried using CLIENT_ACCEPTED but that does not seem to fire.

 

I couldn't find anything that specifically states what you can do in an iRule linked to a Rule on an AFM policy.

 

Can anyone help with how to log the traffic?

 

AFM
application delivery
iRules

1 Reply

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Feb 02, 2017

    Hi,

    AFM irule can be used like that:

    create a Standard VS with HTTP profile enabled, then enable this irule to disable HTTP profile for non HTTP services

    when CLIENT_ACCEPTED {
    if {[TCP::local_port] equals 80} {
        HTTP::enable
    } else {
        HTTP::disable
    }
}

    then, in AFM rule, you can display a HTTP blocking page with irule :

    when HTTP_REQUEST {
    HTTP::respond 200 content {
        
        Dropped
        Your request is dropped
        
    } noserver
}