class match with OR - irule not capturing traffic as expected
Guys can someone help with the below – I have a funny feeling I could be heading for a “plant face on desk” moment …
Requirement to selectively block a HSL logging irule from logging to my SIEM by IP or by xff.
Initial irule has
if { not [class match [IP::client_addr] equals ip_external_scan_addresses] } {
Log some stuff }
This works fine with my src IP in “ip_external_scan_addresses” no log. Src IP removed for datagroup = log
(Works also for xff in the same code snippet)
I then moved to add an OR against xff –
if { not ([class match [IP::client_addr] equals ip_external_scan_addresses]) or ([class match [HTTP::header "X-Forwarded-For"] equals ip_external_scan_addresses]) } {
Log some stuff }
Which complies fine and doesn’t break website access BUT now whatever IP I put in the datagroup nothing gets logged – the line does not capture ANY traffic – noting in my test case xff and client_addr are the same IP.
Any ideas – Thanks !!