Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

2 and more irules together

Hi everyone, I would like to ask if is possible to use this kind of irule for multiple headers Location

when HTTP_RESPONSE {

if { [HTTP::is_redirect] }{

HTTP::header replace Location [string map {"[http://domainA"](http://domainA); "[https://domainA"](https://domainA);} [HTTP::header Location]]

HTTP::header replace Location [string map {"[http://domainB](http://domainB) " "[https://domainB"](https://domainB);} [HTTP::header Location]]

HTTP::header replace Location [string map {"[http://domainC](http://domainC) " "[https://domainC"](https://domainC);} [HTTP::header Location]]

} }

Or if is it better to create 3 separated irule for each domain

one vs 3 or more, what is better for performance of F5 in general? irule vs policy? Policy are more clear and easier to create for me, but which way is better for f5?

Thank you AK

0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Just use the HTTP profile - Redirect Rewrite. It will rewrite redirects from HTTP to HTTPS which seems to be what you want.

0
Comments on this Answer
Comment made 2 months ago by kouriada 56

Hi, no no it isn't about that, my question was about if I can link together multiple header locations into one irule, bcs app needs this header type... and then was asking about experiences with irule vs policy

0
Comment made 2 months ago by Pete White

OK, so you should use an LTM policy where you are concerned about performance or an iRule where you want it to be easy to edit on the fly.

If it were me, I would retrieve the Location header, do any modifications and then replace it, rather than keep doing the replace function multiple times.

when HTTP_RESPONSE {
    if { [HTTP::is_redirect] }{
        set location [HTTP::header Location]
        switch -glob $location {
            "http://domainA*" { set location "https://domainA" }
            "http://domainB*" { set location "https://domainB" }
        }
        HTTP::header replace Location $location
     }
}

Why don't you just change http:// to https:// for all redirects? You could use a datagroup to do the matching and then just change the http part to https.

Maybe you can outline a bit better what functionality you want.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

you can use this code:

when HTTP_RESPONSE {
  if { [HTTP::is_redirect] }{
    #create an empty list 
    set rewrite_list [list]
    # for each valiue in the following list, add in rewrite_list both values http and https  
    foreach domain [list domainA domainB domainC] {
      lappend rewrite_list "http://$domain" "https://$domain"
    }
    # for each value pair in a list, string map replace odd index value with even index value...
    HTTP::header replace Location [string map $rewrite_list [HTTP::header Location]]
  } 
}
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hello Kouriada,

Generally, anything that can be done without an iRule is best done without an iRule. They are a very useful tool for doing something that could not otherwise be done, but they affect performance much more heavily.

As for your other question, the way a BIG-IP interprets iRules, there is no functional difference between having a single iRule with all of your code or multiple iRules with smaller snippets, as long as they are all triggered by the same event.

When an iRule is saved into your configuration, it basically gets broken down and sorted by events. This means that the flow of the iRule from that point on is event-based, and the TCL engine runs through only the events that trigger instead of the rest of your code. Thus, if you have a single iRule with a couple different events inside it, vs multiple iRules with only a single event, or your example, where multiple iRules have the same event, it makes no difference.

This, while incredibly beneficial, can lead to some issues with organization. Generally, my coworkers and I try to keep an iRule organized by functionality instead of by events. With your example above, I think it makes more organizational sense for your code to be within a single iRule.

This article here has a lot of good information on iRules, and this one has some tips on optomization.

Feel free to ask if you have any questions,

Austin

0