Forum Discussion

jdiaz_170339's avatar
jdiaz_170339
Icon for Nimbostratus rankNimbostratus
Apr 08, 2015

iRule to isolate node

I need help with an iRule. I have BigIP LTM v11.6 HF4

 

We have a webfarm configuration that runs a primary server node and several secondaries. What I want to accomplish, is to ensure that when somebody connects from our corporate office, they connect to the primary node's website (so files and data can be updated and such). However, I don't want anybody from the outside world (non corp) to be able to hit the primary server's page. Currently, I have an iRule that forces people from my corp office (38.1.0.1 in this example) and locks them into the primary node (192.168.1.100) on port 80 so website content can be updated. See below:

 

when CLIENT_ACCEPTED { if { [IP::addr [IP::client_addr] equals 38.1.0.1] } { node 192.168.1.100 80 } }

 

I think that I should use some kind of "else CLIENT_REJECT" statement, or "else redirect". This way, I can protect access to my primary server, but still allow visitors to the page (via one of the secondary servers). Can this be done?

 

Hope this makes sense,

 

Thanks!

 

JD

 

application delivery
devops
irule
iRules
security

3 Replies

Sort By
  • shaggy's avatar
    shaggy
    Icon for Nimbostratus rankNimbostratus
    Apr 08, 2015

    Should corporate users use the secondary nodes if the primary node is offline?

    If so, I would create two separate pools - one with all pool members (primary and secondary) using priority group activation to use the primary server if it's available, and another pool that only contains secondary nodes.

    The iRule would be very similar:

    when CLIENT_ACCEPTED {
if { [IP::addr [IP::client_addr] equals 38.1.0.1] } {
  pool primary-secondary_pool
}
else {
  pool secondary_pool
}
}
  • jdiaz_170339's avatar
    jdiaz_170339
    Icon for Nimbostratus rankNimbostratus
    Apr 08, 2015

    Thank you! If primary is offline, yes corp can \ should use secondary nodes. The two pool solution sounds good.

     

    As I understand it, I should leave the pool that contains all members as the default pool for the virtual server, and then the iRule would handle the redirect to the pool that contains only the primary server.

     

    At the pool level, the Priority Group activation should be set to "less than" 1 available member for the "new" primary only pool, but for the pool the contains all the nodes, Priority Group activation should remain disabled?

     

    Sound correct?

     

    Thanks again.

     

    • shaggy's avatar
      shaggy
      Icon for Nimbostratus rankNimbostratus
      Apr 13, 2015
      There won't be a pool that contains only the primary server. The two pools would be - 1) a pool with all members and priority group activation enabled (less than 1, and the primary node has the highest priority) and 2) a pool with only secondary servers (no priority group activation). The default pool shouldn't matter since the iRule will make all pool decisions in this configuration. Does this VS have persistence enabled?