Showing posts with label load-balance. Show all posts
Showing posts with label load-balance. Show all posts
This iRule is strait forward, I am redirecting clients accessing a website using an older versions of IE to a browser friendly version. This is done by evaluating the HTTP request and identifying the browsers user-agent string. As part of the redirect the F5 presents a web page that informs the users their browser is unsupported instead of blindly redirecting them. It will auto redirect after a pre determined count down, this example is set for 15 seconds.
Disclaimer Microsoft does not make this easy, Compatibility modes and Document modes in IE can send a different user-agent string. For example IE 11 users running in Compatibility mode may still be redirected because their browser sends an MSIE 7.0 user-agent string. I am sure your could right variables that would check for compatibility in the user agent string, but iI chose not to.
Here is the iRule:
when RULE_INIT {
set static::refresh_time 15
set static::notification_page {
<html lang=\"en_US\">
<head><title>System Notification</title>
<meta http-equiv=\"Content-Type\" content=\"text/html; charset=us-ascii\">
<meta http-equiv=\"CACHE-CONTROL\" content=\"NO-CACHE\">
<meta http-equiv=\"PRAGMA\" content=\"NO-CACHE\">
<meta http-equiv=\"refresh\" content=\"15;URL=http://myspace.com">
</head>
<body>
<h1>System Notification</h1>
<hr>
<p>You are using an unsupported browser and will be redirected to Myspace.com</p>
<p>Wait $static::refresh_time seconds to continue, or click <a href=\"http://myspace.com\">here to continue.</a></p>
</body>
</html>
}
}
when HTTP_REQUEST {
switch -glob [ string tolower [HTTP::header User-Agent]] {
"*msie 10.0*" -
"*msie 9.0*" -
"*msie 8.0*" -
"*msie 7.0*" -
"*msie 6.*" {
HTTP::respond 200 content [subst $static::notification_page] Mime-Type "text/html"
log local0. "Client IP:[IP::client_addr] has been redirected with user agent :[HTTP::header User-Agent]"
}
default {
# go to a default location if nothing matches
}
}
}
The iRule below was spawn from a request to block access to specific URIs on a website and only allow access from whitelisted IP networks and hosts.
In my first attempt I used concatenated OR statements which worked but was less sexy and probably less efficient then the switch I ended up using.
As for the Data List in this example it's named "AllowedIPDatalist." I created a network data list not because it was efficient, its not, I wanted to make it easier for co workers that didn't feel comfortable editing an iRule a place to enter Networks and Hosts in a format they where used to.
when HTTP_REQUEST {
switch -glob [string tolower [HTTP::uri]] {
"*/uri/sample1*" -
"*/uri/sample2*" -
"*/uri/sample3*" {
if { !([matchclass [IP::client_addr] equals AllowedIPDatalist])} {
reject
log local0. "Client IP Discard: \ [IP::client_addr]:[TCP::client_port] -> [IP::local_addr]:[TCP::local_port]"
}
}
}
}
For everyone who has worked on a Cisco ACE you have experienced the pains of troubleshooting, especially in a long complicated config. Often you are reverse engineering from the policy-map multi-match to the r servers and probes to find all the pieces that make up the service. We have asked people within Cisco is there a command that will show everything related to a policy-map multi-match class and the answer has always been no, until recently. A colleague of mine was working with a Cisco TAC engineer via a webex and came across a most useful undocumented command. Here is what the TAC engineer entered:
show run filter policy-map multi-match class name
ex. show run filter L4_SLB_CLASS
This returned most of the associated parts of the service i.e. class-map, load-balance, server-farm, real server etc. Sounds like a dream right? Here is the kicker, I am not sure what platforms are supported. I know it worked on a 4710 appliance running A3 code, but I have attempted it on an ACE 20 module running A2 code and it didn't work. So if anyone has any info about this command send me an email and if I find any more documentation I will link it to this post.