Forum Discussion

Masaru_Takahash's avatar
Masaru_Takahash
Icon for Nimbostratus rankNimbostratus
Mar 23, 2005

IPv6 address prefix difinition

Please teach the definition method when the IPv6 address is used.

I did not do the operation for which I had hoped though I tried various rule.

I want to make the rule that limits only the access from 3ffe:1234:1234:5678::/64 prefix.

However, it did not operate in the following rule. 

   
 [Rule 1]  
 -------------------------------------------------------  
 when CLIENT_ACCEPTED {   
   if { [IP::remote_addr] eq 3ffe:1234:1234:5678::/64 ] }  
   {   
     pool lb_pool   
   } else {   
     discard  
   }   
 }   
 -------------------------------------------------------  
    
 [Rule 2]  
 -------------------------------------------------------  
 when CLIENT_ACCEPTED {   
   if { [IP::remote_addr] eq 3ffe:1234:1234:5678::0 netmask ffff:ffff:ffff:ffff::0 ] }  
   {   
     pool lb_pool   
   } else {   
     discard  
   }   
 }   
 -------------------------------------------------------

Please teach the method of defining rule that can recognize the Prefix
application delivery
dev
devops
iRules

3 Replies

Sort By
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Mar 23, 2005
    As drteeth pointed out in an earlier post today: "Listen to the forum"!

    You are comparing the IP addresses as strings. Thus the application of a netmask is not observed at all. To accomplish this you need to compare the IP addresses as IP addresses by using the IP::addr command.

    Also, there is currently an issue with comparing network masks that has been corrected in 9.0.5, which involves which address you apply the mask to. In pre-9.0.5 versions, you need to apply the netmask to host address.

    Here's an Example: 

     
 when CLIENT_ACCEPTED { 
    if { [IP::addr "[IP::remote_addr]/64" eq 3ffe:1234:1234:5678::] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 }

    Also, you can use either / notation or " mask " notation. However, with the long netmasks of IPv6, I would suggest sticking with the / notation.

    Second example: 

     
 when CLIENT_ACCEPTED { 
    if { [IP::addr "[IP::remote_addr] mask ffff:ffff:ffff:ffff::0" eq "3ffe:1234:1234:5678::"] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 }

    After 9.0.5, you can do the following: 

     
 when CLIENT_ACCEPTED { 
    if { [IP::addr [IP::remote_addr] eq 3ffe:1234:1234:5678::/64] } { 
       pool lb_pool 
    } else { 
       discard 
    } 
 }
  • Masaru_Takahash's avatar
    Masaru_Takahash
    Icon for Nimbostratus rankNimbostratus
    Mar 23, 2005
    I tested by both V9.0.2 and V9.0.4.

     

     

    When all samples were changed from "eq" to "equals", it operated correctly.

     

    However, only one sample operated in V9.0.4.

     

     

    V9.0.2(OK), V9.0.4(OK)

     

    ---------------------------------------------------------------------

     

    when CLIENT_ACCEPTED {

     

    if { [IP::addr "[IP::remote_addr]/64" equals 3ffe:1234:1234:5678::] } {

     

    pool lb_Pool

     

    } else {

     

    discard

     

    }

     

    }

     

    ---------------------------------------------------------------------

     

     

    V9.0.2(OK), V9.0.4(NG)

     

    ---------------------------------------------------------------------

     

    when CLIENT_ACCEPTED {

     

    if { [IP::addr "[IP::remote_addr] mask ffff:ffff:ffff:ffff::0" equals "3ffe:1234:1234:5678::"] } {

     

    pool lb_Pool

     

    } else {

     

    discard

     

    }

     

    }

     

    ---------------------------------------------------------------------

     

     

    V9.0.2(OK), V9.0.4(NG)

     

    ---------------------------------------------------------------------

     

    when CLIENT_ACCEPTED {

     

    if { [IP::addr [IP::remote_addr] equals 3ffe:1234:1234:5678::/64] } {

     

    pool lb_Pool

     

    } else {

     

    discard

     

    }

     

    }

     

    ---------------------------------------------------------------------
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Mar 23, 2005
    Can you please open a support case with the information about when it does not work as expected? That is the best route to getting things corrected in a future release. Thanks.