Hey DeepSeek, can you write iRules?

[Daniel_Wolf]

Back in time…

Two years ago I asked ChatGPT whether it could write iRules.

My conclusion after giving several tasks to ChatGPT was, that it can help with simple tasks but it cannot write intermediate or complex iRules.

A new AI enters the competition

Two weeks ago DeepSeek entered the scene and thought it’s a good idea to ask it about its capabilities to write iRules.

Spoiler alert: It cannot.

New AI, same challenges

I asked DeepSeek the same questions I asked ChatGPT 2 years ago.

1. Write me an iRule that redirects HTTP to HTTPS
2. Can you write an iRule that rewrites the host header in HTTP Request and Response?
3. Can you write an iRule that will make a loadbalancing decision based on the HTTP Host header?
4. Can you write an iRule that will make a loadbalancing decision based on the HTTP URI header?
5. Write me an iRule that shows different ASM blocking pages based on the host header. The response should include the support ID.

I stopped DeepSeek asking after the 5th question, DeepSeek is clueless about iRules.

The answer I got from DeepSeek to 1, 2, 4 and 5 was always the same:

when HTTP_REQUEST {
    # Check if the request is coming to port 80 (HTTP)
    if { [TCP::local_port] equals 80 } {
        # Construct the HTTPS URL
        set host [HTTP::host]
        set uri [HTTP::uri]
        set redirect_url "https://${host}${uri}"

        # Perform the redirect
        HTTP::redirect $redirect_url
    }
}

While this is a solution to task 1, it is plain wrong for 2, 3, 4 and 5.
And even for the first challenge this is not a good. Actually it hurts me reading this iRule…

Here for example task 2, just wrong…

For task 3 DeepSeeks answer was:

ChatGPT in 2025

For completeness, I gave the same tasks from 2023 to ChatGPT again.
Briefly said - ChatGPT was OK in solving tasks 1-4 in 2023 and still is. It improved it’s solution for task 5, the ASM iRule challenge.
In 2023 I had two more tasks related to rewriting and redirecting. ChatGPT still failed to provide a solid solution for those two tasks.

Conclusion

DeepSeek cannot write iRules and ChatGPT still isn’t good at it. Write your own iRules or ask the friendly people here on devcentral to help you.

[Rebecca_Moloney]

Love that you’ve made a series out of putting AI to the iRules test! Very cool stuff.

[LiefZimmerman]

Sending a query to DeepSeek. Cost = 3 tokens.
Sending the same query to ChatGPT. Cost = 300+ tokens.
Checking the validity of the results, with an expert plainly explaining the results: #Priceless

[Daniel_Wolf]

I felt like this was overdue after 2 weeks of DeepSeek hype cycle.

[Daniel_Wolf]

Plainly is good … this is the version without my arsenal of curses

[Danielzi]

Can you share irule for task 5 :) 
very useful to send system to check the servers and not ask security engineer why there block page of asm

thanks

[LiefZimmerman]

If so…I vote for it to be written/shared in our CodeShare | DevCentral section.

[Daniel_Wolf]

Hi Danielzi,

what should the iRule do? Show different ASM blocking pages based on different host name header?
Or show the violation data / blocking reason too?

KR
Daniel

[Danielzi]

Different blocking page for status response code 500+

[Daniel_Wolf]

Hi Danielzi,

I’m travelling this week, I can write you such iRule when I’m back home. However, I would be very cautious with 500+ HTTP  status code pages. They might give attackers valuable information about the stack and frameworks used in your app. Like PHP version or DB server type.

KR
Daniel

[Danielzi]

Hi

Yes, you are right, but I don’t want to display the error code. I just want to show a different error page than the custom error page I currently have so that I can immediately notify the system administrators that it’s a server issue and not a blockage due to an illegal request.

[Daniel_Wolf]

when HTTP_RESPONSE {
  if { [HTTP::status] == 502 } { set static::illegal_status 1 }
}

when ASM_RESPONSE_VIOLATION {
    if { ( [info exists static::illegal_status] ) } {
        HTTP::header remove Content-Length
        foreach {viol} [ASM::violation names] {
            if {$viol eq "VIOLATION_HTTP_STATUS_IN_RESPONSE"} {
            set response "<html><head><title>WAF Block</title></head><body><h1>Blocked because of Illegal HTTP status in response</h1></body></html>"
            ASM::payload replace 0 [ASM::payload length] ""
            ASM::payload replace 0 0 $response
            }  
        }
    }
}

Remarks:

1. Maybe add a condition, so that this iRule only get’s executed from internal IP addresses.
2. Maybe change [HTTP::status} to match a regex instead
3. Maybe add a catch statement to check if info exists
4. Add an unset to illegal_status for cleaner code

My overall comment to this iRule: It’s not a story the Jedi would tell you. It’s a Sith legend.

[LiefZimmerman]

Daniel_Wolf - i was speaking with alfozaav about AI earlier today and he mentioned that https://claude.ai/ is a favorite tool of his for code (generally).

I wonder if you might do the same challenge with Claude? How does it stack up?
(if you have time)

[Daniel_Wolf]

LiefZimmerman - I think, I already had that conversation with Claude briefly after I wrote this article. Just the write-up is missing. Next week there might be some time to finish that.

[LiefZimmerman]

Announced today is F5’s own GenAI tooling to help generate iRules - The F5 AI Assistant for BIG-IP