Scenarios where Service Policy should be used over iRule and Vice versa

Forums Technical Forums
,
1

can anyone help me with some examples where service policy should be used instead of using an iRule and vice versa but remember example should be where requirement can be acheived using both service policy and irule but wanted to know where service policy is best fit over irule and example where iRule is best fit over service policy

2

This largely comes down to what you’re used to.
Some people prefer using Policies for straightforward logic, turning to iRules only when more complex behavior is required.
Others, however, will use iRules regardless of the situation.

Policies are generally easier to configure and maintain, especially for those with less experience—which can be a key factor in long-term maintainability.
On the other hand, iRules offer nearly limitless flexibility, making them ideal for advanced use cases.

3

Got it but if we have configured multiple service policy rules which one takes precedence. In irules lower priority takes precedence but I want to know the execution order of service policies

4

Injeyan one more question can you please assist with the request evaluation process how does BIG-IP enforce its security modules when a request comes to it if both ltm and asm all modules are implemented i mean complete security check like Distributed Cloud has mentioned in the attached snapshot

image_340707.png
image_340707.png819Ă—302 56.7 KB

5

If you have both Policy and iRule, Policy comes first.

If you have multiple policies with confilcting controls you will not be able even to apply them
check https://my.f5.com/manage/s/article/K55864758#ai-recommendations-42

6

There is a great article explaining what you are asking, have a look
Knowledge sharing: An example of the general order of precedence for the BIG-IP modules. Also, the F5 ASM DDOS Protection or Bot Protection order of precedence explained. | DevCentral

7

Perfect thanks

8

thanks for your prompt response
Appreciated :heart_eyes:

9

It is written ASM DDoS is going to be executed first then Bot Defense and after that ASM Policy.

With respect to LTM and ASM like we have service polices, irules etc etc

Is it the order would be like ASM DDos > Bot Defense > Service Policies > Irule (if configured) > then rest of the settings configured at layer 7 security in ASM

10

It depends on the context of Policy or iRule.
For example an irule could have Client_Connect event which is triggered before even the actual request, or HTTP_REQUEST_RELEASE which hits just before the request leaves F5.
More over you could even disable ASM with an irule or select spesific ASM policy.