Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Jan 13, 2009

Virtual Server Pool versus ASM Class Pool

I'm struggling trying to understand the difference between using a pool applied to a Virtual Server versus a pool applied to an ASM class, and when I might want to use one versus the other.

Is there anything wrong with not defining an ASM pool, and allowing the Default Pool or iRules applied to the Virtual Server determine where to route the traffic?

For example say I have an HTTP VS, with no default pool, and an iRule which checks the URI to determine where to route traffic, i.e.: 

   
   when HTTP_REQUEST {   
     if {[HTTP::uri starts_with "/navigation"]} {   
       pool navigation_pool   
     } else {   
       pool browse_pool   
     }   
   }

I've also got an ASM Class applied to this VS which has no default Pool. Can you see anything wrong with simply allowing ASM to scan the incoming requests and afterwards hand them back off to the VS for routing? I fail to see how one could make any type of dynamic routing decision like an iRule can when specifying an ASM pool.
APM
app sec
security

3 Replies

Sort By
  • Chris_Paulraj_1's avatar
    Chris_Paulraj_1
    Icon for Nimbostratus rankNimbostratus
    Jan 14, 2009
    We are also using it the way you described, iRule is too valuable to give up in our environment.It seems to be working fine, iRules get processed after ASM.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 14, 2009
    Here is a diagram which illustrates the logical flow for requests:

     

     

     

    SOL6754 - Traffic flow for ASM-enabled virtual servers (Click here)

     

     

    And SOL8018 (Click here) gives a similar overview of this in text and includes some common configuration options.

     

     

    The typical suggestion has been to use a pool on each HTTP class and not configure a default pool on the VIP. This ensures that all traffic must explicitly match a class in order to get through the BIG-IP. It makes it more difficult to accidentally allow traffic to slip through the classes and go to the default pool without being validated by ASM.

     

     

    A common exception to this configuration would be if you wanted to use the same HTTP class and ASM web app + policy on multiple VIPs. If you wanted to reuse the same class/web app/policy, you could not configure the pool on the class, but instead use a default pool on the VIP. If you want to use any filters on the HTTP class, you should add a default class to the VIP(s) with no filters to ensure no traffic bypasses ASM.

     

     

    Aaron
  • smp_86112's avatar
    smp_86112
    Icon for Cirrostratus rankCirrostratus
    Jan 15, 2009
    Thank you cpaulraj for the sanity check, and hoolio for the references. I am much more comfortable knowing now that I am not planning to do anything extrordinary.