Calling an ICALL from an IRULE

Question

HI,&nbsp;
I am trying to call an Icall from an Irule but couldn't do it. I try this =&nbsp;
sys icall istats-trigger delete_entry_trigger_istats {
    event-name deletecon
    istats-key "wa policy string prueba_xxa"
}&nbsp;
then in the irule I put this &nbsp;
when  CLIENT_ACCEPTED {
ISTATS::set "wa policy string prueba_xxa" 1
}&nbsp;
But the Icall won't triggered &nbsp;
ICALL SCRIPT&nbsp;
sys icall script delete_entry_conecction_script {
    app-service none
    definition {
        tmsh::delete sys connection cs-client-addr 192.168.1.97
        exec istats remove "wa policy string prueba_xxa"
    }
    description none
    events none
}&nbsp;
ICALL HANDLER&nbsp;
sys icall handler triggered delete_entry_conecction_handler {
    script delete_entry_conecction_script
    subscriptions {
        messages {
            event-name deletecon
        }
    }
}&nbsp;
ICALL TRIGGER&nbsp;
sys icall istats-trigger delete_entry_trigger_istats {
    event-name deletecon
    istats-key "wa policy string prueba_xxa"
}&nbsp;
For now the goal is to achieve the tmsh command delete sys connection cs-client-addr 192.168.1.97 via Icall&nbsp;
Thanks for your support.&nbsp;

jaikumar_f5 · Answer

Icall script/handler everything looks good to me, can you confirm if it did not delete the connection table ?&nbsp;

jaikumar_f5 · Answer

Happened to this using custom trap (/config/user_alert.conf), this does work though, 
alert testing "JAI" {
    exec command="tmsh generate sys icall event deletecon"
}

Checking the connection table cleared the entries.

stanislas_piro2 · Answer

irules are executed in data plane, icall are executed in control plane.&nbsp;
you can't execute icall from irule. the only solution is to execute a sideband connection to icontrol API from irule.&nbsp;

sergio000_19532 · Answer

Hi I make a change recently to try to achieve the final goal, which is to when a new connection comes the big IP closed the already established.
when LB_QUEUED {
ISTATS::set "wa policy string prueba_xxa" 1
}
So I put a queue un depth 1 an at pool member level a connection limit of 1 an also put the CMP Mode of the virtual server in single-cpu mode.
When I test this scenario I open two telnet session and just the first connection appears in show sys connection ss-server-addr then I force the Icall with generate sys icall event deletecon and the queue connection is established with the pool member. So I think that the Icall is working but I couldn't link the Irule with the Icall, so in the even of an LB_QUEUED drops the stablished connection a permit the queded.
Thx all for your answers.

sergio000_19532 · Answer

Hi please, how can I call this :&nbsp;
alert testing "JAI" {
    exec command="tmsh generate sys icall event deletecon"
}&nbsp;
through the iRULE ?&nbsp;

Forum Discussion

Calling an ICALL from an IRULE

7 Replies

Recent Discussions

Geo Fence in ASM through irule for URI

Client certificate Authentication - open multiple tabs

google autenticator broken barcode

Chrome V 124+ on MacOS - Virtual Server Access Issue

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Related Content

AppWorld 2024 Call For Speakers open

Passing Arguments to iCall Scripts

Modifying iCall from TMSH

loop for iCall

Lightboard Lessons: iCall