Multiple Switch statements in a single iRule

Question

Hi there,&nbsp;I have several ranges of addresses which I want to see if traffic is coming from and deny traffic. Say the ranges are as follows as an example:&nbsp;10.11.0.0/16 10.12.0.0/16 10.13.13.0/22 10.14.14.0/22 10.23.23.0/24 10.24.24.0/24&nbsp;I am wondering if I can have multiple switch statements in the CLIENT_ACCEPTED section of code such as (obviously some default statement would need to be added somewhere along the line or an overarching check to bypass this lookup if it is not required):&nbsp;when CLIENT_ACCEPTED {
    switch -glob [IP::addr [IP::client_addr]/16] {
        "10.11.0.0" { 
             some action
        }
        "10.12.0.0" { 
             some action
        }
    }

switch -glob [IP::addr [IP::client_addr]/22] {                                                                                                                                                                                                            switch -glob [IP::addr [IP::client_addr]/22] {
        "10.13.13.0" { 
             some action
        }
        "10.14.14.0" { 
             some action
        }
    }

switch -glob [IP::addr [IP::client_addr]/24] {                                                                                                                                                                                                            switch -glob [IP::addr [IP::client_addr]/22] {
        "10.23.23.0" { 
             some action
        }
        "10.24.24.0" { 
             some action
        }
    }
}

vernon_97235 · Accepted Answer

Yes, but what you really want to do is use a Data Group.  Let's say you have a Data Group that looks like this:
create ltm data-group internal dg-address-matchers type ip \
  records add { 10.11.0.0/16 { data "action1" } \
                10.12.0.0/16 { data "action2" } \
                10.13.13.0/22 { data "action3" } ... }

You would then use it thusly:
when CLIENT_ACCEPTED {
    set indicator [class lookup [IP::client_addr] dg-address-matchers]
        
    switch [class lookup [IP::client_addr] dg-address-matchers] {
        action1 {
             ... do something ...
        }
                
        action2 {
             ... do something else ...
        }
        
         ... etc ... 
        
        "" {
             this means the IP matches no netblocks in the data-group
        }
    }
}

squeezebox_2829 · Answer

Thanks for this information, I have two questions:&nbsp;
1) I am currently operating on Firmware version 10.2.4, is this the correct format for this version?
2) Second, I am trying to get some more information on how this comparison is going to work. I was under the impression I would need to provide a netmask for [IP::client_addr] to convert it to its given class IP address (network IP) ie. 192.168.1.45/24 == 192.168.1.0 for comparison purposes. Is the provided data-group performing that operation natively due to the data-group type ip? I am searching for more information on this.&nbsp;
Thanks,&nbsp;

squeezebox_2829 · Answer

Thanks for this information, I have two questions:&nbsp;
1) I am currently operating on Firmware version 10.2.4, is this the correct format for this version?
2) Second, I am trying to get some more information on how this comparison is going to work. I was under the impression I would need to provide a netmask for [IP::client_addr] to convert it to its given class IP address (network IP) ie. 192.168.1.45/24 == 192.168.1.0 for comparison purposes. Is the provided data-group performing that operation natively due to the data-group type ip? I am searching for more information on this.&nbsp;
Thanks,&nbsp;

vernonwells · Answer

The data group format is somewhat different in v10:
iRules Data Group Formatting Rules
but as long as the entries are declared as network, it should work.
If a Data Group is declared to be type ip then the equals operator will perform network-wise comparisons against IP addresses.

vernon_97235 · Answer

The data group format is somewhat different in v10:
iRules Data Group Formatting Rules
but as long as the entries are declared as network, it should work.
If a Data Group is declared to be type ip then the equals operator will perform network-wise comparisons against IP addresses.

Forum Discussion

Multiple Switch statements in a single iRule

9 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

APM AdAuth HTTP Header Insert iRule Switch Statement

Use switch for multiple conditions

iRule and multiple switch-statements

Comparing iRule Control Statements

Help with irule using switch