Forum Discussion

Kevhed's avatar
Kevhed
Icon for Nimbostratus rankNimbostratus
Jan 06, 2017

Bypass APM login page for internal users

Hi group.

 

I have one virtual server/website that will be accessed by both external and internal users. This virtual server has an APM profile associated with it that is presenting a login page and is doing basic forms based authentication.

 

For the external users, I want them to get the APM login page and authenticate...if successful, then be sent to a backend pool. THIS IS WORKING FINE.

 

For internal users (coming from RFC1918 networks) I DO NOT want them to see that APM login page, but rather I want the F5 to send those connections directly back to the same backend pool. I'm sure I've seen an iRule for this in the past and I can't seem to find it.

 

Does anyone have an irule that will bypass the APM login page coming from specified networks?

 

Thanks in advance

 

APM
application delivery
iRules

5 Replies

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 08, 2017

    Hi,

    you can use this irule:

    when HTTP_REQUEST {
    if { [IP::addr [IP::client_addr]/8 equals 10.0.0.0] or [IP::addr [IP::client_addr]/16 equals 192.168.0.0] or [IP::addr [IP::client_addr]/12 equals 172.16.0.0] } {
        ACCESS::disable
    }
}

    if you use a empty box in VPE, it will :

    • create a Access session URI is stored in landinguri
    • redirect user to /my.policy
    • execute VPE with empty box
    • allow user session
    • redirect user to the the landinguri previously stored

    with this irule, APM will be ignored and the request will go through the virtual server to the pool member without any redirect.

  • JC_BW's avatar
    JC_BW
    Icon for Nimbostratus rankNimbostratus
    Sep 21, 2017

    I've found ACCESS::disable does not work as expected. Even when disable is issued in HTTP_REQUEST the connection proceeds to ACCESS_SESSION_STARTED and gets a session id. Because of that I had to use the VPE to allow internal users to bypass the login page.

     

    Anyone know why this might be or have a similar experience?

     

    BIG-IP 11.6.1HF1

     

    • Stanislas_Piro2's avatar
      Stanislas_Piro2
      Icon for Cumulonimbus rankCumulonimbus
      Sep 22, 2017

      Hi,

      I used the 

      ACCESS::disable
      command on version 11.5.1, 11.5.4, 11.6, 11.6.1, 12.0, 12.1.X, 13.0 and I never had issue with this command.

  • JC_BW_297539's avatar
    JC_BW_297539
    Icon for Nimbostratus rankNimbostratus
    Sep 21, 2017

    I've found ACCESS::disable does not work as expected. Even when disable is issued in HTTP_REQUEST the connection proceeds to ACCESS_SESSION_STARTED and gets a session id. Because of that I had to use the VPE to allow internal users to bypass the login page.

     

    Anyone know why this might be or have a similar experience?

     

    BIG-IP 11.6.1HF1

     

    • Stanislas_Piro2's avatar
      Stanislas_Piro2
      Icon for Cumulonimbus rankCumulonimbus
      Sep 22, 2017

      Hi,

      I used the 

      ACCESS::disable
      command on version 11.5.1, 11.5.4, 11.6, 11.6.1, 12.0, 12.1.X, 13.0 and I never had issue with this command.