Forum Discussion

MatthewStyles_3's avatar
MatthewStyles_3
Icon for Nimbostratus rankNimbostratus
Mar 20, 2017
Solved

iRule for custom traffic flow

Hi!   We currently have a setup where we have a HTTPS website which customers can upload both text and media (Sound or video) to a server and this data is stored in the cloud. This data is then p...
application delivery
iRules
LTM
  • Jeremy_Church_3's avatar
    Jeremy_Church_3
    Mar 20, 2017

    Matt,

    To perform this action, there are a couple things you need.

    1. Client-ssl and server-ssl profile on the virtual server.
    2. Identify requests with content.

    Here is a simple example iRule that should accomplish what you need. I'm working under the assumption any POST will have content you want to inspect.

    when HTTP_REQUEST {
    if {![info exists DEFAULT_POOL]} { set DEFAULT_POOL [LB::server pool] }

    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    } else {
        pool $DEFAULT_POOL
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

    If you use a OneConnect profile, you should be able to remove the default pool selection as long as you're not running 11.5.3 HF2 or 12.0.0 - 12.0.0 HF3.

    when HTTP_REQUEST {
    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

    As with anything, there is often more than one answer. Hopefully this will at least point you in the right direction.

Jeremy_Church_3's avatar
Jeremy_Church_3
Icon for Cirrus rankCirrus
Mar 20, 2017

Matt,

To perform this action, there are a couple things you need.

  1. Client-ssl and server-ssl profile on the virtual server.
  2. Identify requests with content.

Here is a simple example iRule that should accomplish what you need. I'm working under the assumption any POST will have content you want to inspect.

when HTTP_REQUEST {
    if {![info exists DEFAULT_POOL]} { set DEFAULT_POOL [LB::server pool] }

    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    } else {
        pool $DEFAULT_POOL
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

If you use a OneConnect profile, you should be able to remove the default pool selection as long as you're not running 11.5.3 HF2 or 12.0.0 - 12.0.0 HF3.

when HTTP_REQUEST {
    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

As with anything, there is often more than one answer. Hopefully this will at least point you in the right direction.

  • MatthewStyles_3's avatar
    MatthewStyles_3
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2017

    Hi Jeremy!

     

    Wow! Thank you for the quick response! As I understand it, the http POST method is used when uploading a file to a server, however in our instance, the upload has already been completed to our internet server, and it is this server that is then transferring the data via HTTPS to our internal server via the F5 in question, so I don't think the F5 would see a HTTP POST request? I may be wrong, my understanding of HTTP processes is limited!

     

    Many thanks Matt

     

  • Jeremy_Church_3's avatar
    Jeremy_Church_3
    Icon for Cirrus rankCirrus
    Mar 20, 2017

    Matt,

     

    It is quite possible I did not understand your original question. Here is my interpretation.

     

    Current configuration:
    1. File transferred from client to server_1 via HTTPS and F5 virtual server.
    2. File transferred from server_1 to server_2 via HTTPS and F5 virtual server.
    Desired configuration:
    1. File transferred from client to server_1 via HTTPS and F5 virtual server.
    2. File transferred from server_1 via HTTPS and F5 virtual server to:

       

      a. server_2 via HTTPS if there is no attachment.

       

      b. server_3 via HTTP if there is an attachment.

    Is this correct? Are there any additional steps or something else missing?

     

    In step 2, if an HTTP(S) transfer is initiated from server_1 to server_2, server_1 is acting as an HTTP client.

     

  • MatthewStyles_3's avatar
    MatthewStyles_3
    Icon for Nimbostratus rankNimbostratus
    Mar 27, 2017

    Hi Jeremy,

     

    Apologies for the wait, over the last week we've had a redesign of the application which now means that my original question no-longer applies to our situation. I didn't want to be one of those guys that never come back after an answer is given and so I just wanted to say thank you for helping me out, it really is very much appreciated.

     

    iRules are definitely something I will need to understand further and your answer was a very good start in helping me understand how they operate.

     

    Thanks again Matt

     

  • Jeremy_Church_3's avatar
    Jeremy_Church_3
    Icon for Cirrus rankCirrus
    Mar 29, 2017

    Matthew,

     

    Glad you learned something even if it won't be used.

     

    If you would like to learn iRules, I found a few things very helpful:

     

    1. Learning TCL to get a firm grasp on the syntax and behavior of language itself.
    2. Understand the protocol being balanced, usually HTTP, but the F5 can load balance lots of things.

    I use the TCL manual as a reference quite often. When I first started learning, I installed TCL on my computer and took time to test certain commands and syntax prior to writing an iRule. I still use it to test and demonstrate certain behaviors. Beyond the disabled TCL commands, the F5 has slightly different behavior so testing is still needed in iRules.