BIGIP_LTM_iRule.ppt

1、BIG-IP V9.0iRule,F5 Product training,20 / 4 / 06,Basic Review,3 / 25 / 04,Virtual Server to Pool Members,Internet,:8080,:80,:4002,:80,Virtual Server,7:80,Pool Members,Maps to,Profile Dependencies,Some cant be combined in VS,Some dependent on oth

2、ers,Think in terms of OSI Model,TCP,HTTP,Cookie,UDP,FTP,L3 Network,L2 Data Link,L1 Physical,Traffic Flow Big Picture,Virtual Server,NAT,SNAT,Client side,Node side,Address Translation,Address not Translated,Forwarding VS,Transparent VS,What is Layer 7 Switching,Application Data oriented Eg. HTTP URL,

3、 HTTP Header. Delay binding required Extra memory buffer session Extra processing power (ASIC/CPU),What is iRule,An iRule is a script that you write if you want to make use of some of the extended capabilities of the BIG-IP that are unavailable via the CLI or GUI. based on the Tool Command Language

4、(Tcl) programming standard Additional F5 extension,Architecture,TM/OS,How consolidation is achieved?,React to a Single Communication, One Direction,Packet Based,Legacy Approach,TMOS Architecture,SSL,Compression,Client Side,Server Side,TCP Express,Server,TCP Express,Caching,Microkernel,TMOS Traffic P

5、lugins High-performance Networking Microkernel Powerful Application Protocol Support iControl External monitoring and control iRules Network Programming Language,High Performance HW,iRules,Client,iControl API,TCP Proxy,OneConnect,XML,Rate Shaping,TrafficShield,Web Accel,3rd Party,iRule basic element

6、,Event declaration Operators iRules command,Basic iRule Format,Event declarations Operators iRule commands ,Event declarations,Event declarations = when event type An example: when CLIENT_ACCEPTED if IP:addr IP:remote_addr equals 0 pool my_pool1 ,Event types,Global events HTTP events SSL eve

7、nts Authentication events Referrence to LTM_config_guide.pdf page 302,303, table 13.2,Event types:Global Events,CLIENT_ACCEPTED CLIENT_DATA LB_SELECTED (before send to server) LB_FAILED (no node available for this vs) SERVER_CONNECTED SERVER_DATA RULE_INIT CLIENT_CLOSED SERVER_CLOSED,No matter what

8、L7 iRules, Global Event can take effective .,CLIENT_ACCPTED,CLIENT_DATA,LB_SELECTED,LB_FAILED,SERVER_ACCPTED,SERVER_DATA,CLIENT_CLOSED,SERVER_CLOSED,RULE_INIT,START,L7 Event types:HTTP Events,HTTP_REQUEST HTTP_REQUEST_DATA HTTP_RESPONSE HTTP_RESPONSE_DATA HTTP_RESPONSE_CONTINUE,HTTP_REQUEST,HTTP_REQ

9、UEST_DATA,HTTP_RESPOND,HTTP_RESPOND_DATA,START,HTTP_RESPOND_CONTINUE,TMOS Architecture,Server,iRules,Client,Client Side Event Client_accept Client_data Cache_request DNS_request HTTP_REQUEST HTTP_REQUEST_DATA RTSP_REQUEST . . . .,Server Side Event Server_connect Server_data Cache_response DNS_respon

10、se HTTP_RESPONSE HTTP_RESPONSE_DATA RTSP_RESPONSE . . . .,Operator,Compare two operands TCL standard Eg. = Relational Operators Eg. Contains, matches, equals, end_with Logical Operators Eg. and , or, not,iRules command,Statement command action taken, eg. Use pool, SNAT, log Query command query info/

11、data, eg. HTTP:header, IP:remote_addr Data manipulation command perform data manipulation, eg. HTTP:header remove, HTTP:header add Utility command Parsing and manipulating content, eg. Decode_uri ,iRule Events,Global Events (L3/4 Client Accepted Syn, SynAck, Ack Server Data html page to client HTTP

12、Events (L7) HTTP request or HTTP response SSL Events Client SSL handshake Authentication Events Auth Failure,Profile Dependencies,Some cant be combined in VS,Some dependent on others,Think in terms of OSI Model,TCP,HTTP,Cookie,UDP,FTP,iRule Concepts & Syntax,iRules Often Select Pool Basic Syntax If

13、then else ,when EVENT if conditional_statement action_when_condition_true ,Example 1: Layer 7 content switching,rule BrowserType when HTTP_REQUEST if HTTP:uri ends_with “jpg pool cache_pool else pool main_pool ,rule BrowserType when HTTP_REQUEST if HTTP:header User-Agent contains “MSIE” pool IE_pool

14、 elseif HTTP:header User-Agent contains “Mozilla” pool Mz_pool ,Example 2: Layer 3 IP decision,when CLIENT_ACCEPTED if IP:addr IP:client_addr equals 0 pool my_pool ,when HTTP_REQUEST if IP:hops = 10 COMPRESS:disable ,Example 3 : Layer 4 decision,when CLIENT_ACCEPTED if TCP:client_port 1000

15、 pool slow_pool else pool fast_pool ,when RULE_INIT array set :active_clients when CLIENT_ACCEPTED set client_ip IP:remote_addr if info exists :active_clients($client_ip) if $:active_clients($client_ip) 5 reject return else incr :active_clients($client_ip) else set :active_clients($client_ip) 1 when

16、 CLIENT_CLOSED if info exists :active_clients($client_ip) incr :active_clients($client_ip) -1 if $:active_clients($client_ip) = 0 unset :active_clients($client_ip) ,Configuring iRules,Create Rule,Configuring iRules,Create Pools first Create Rule next Then point VS to Rule,DevCentral,Officially suppo

17、rted by marketing Community is mostly made up of volunteers especially those from F5 Product Development. What about Support? What can DevCentral do better? Having trouble searching? Check this out: Rules Wiki,Lab setup,Connect WiFi SSID: MaskedRider WEP: ab12cd34ef Channel: 6 IP address

18、-253/24 BIGIP v9 54 Admin logon: admin/f5training Training web server -3,Lab 1 : Basic Setup,Internet,192.168.0.x/24,:80,:80,:80,Purpose: setup basic load balance configuration,Step 1: create a pool including 3 training server Step 2: create

19、 a virtual Server with your name as description and bind your own pool as resource Step 3: test the virtual server and check the statistic,Lab 2 : logging iRule,Internet,192.168.0.x/24,:80,:80,:80,Purpose: log custom information by iRules,Step 1: create a iRule to

20、 log client source IP address and source port Step 2: add your iRule into Virtual server Step 3: access the virtual server and check the BIGIP log by command: tail f /var/log/ltm | grep ,when CLIENT_ACCEPTED log local0. TCP session IP:client_addr:TCP:client_port ,Lab 3 : pool selection,Internet,192.

21、168.0.x/24,:80,:80,:80,Purpose: select a dedicated pool for a specific Client,Step 1: create a new pool create a iRule to select a yourname2 pool for your IP address Step 2: add your iRule into Virtual server Step 3: access the virtual server and check the BIGIP l

22、og by command: tail f /var/log/ltm | grep Step 4: ask your classmate to access your VS and check the log,when CLIENT_ACCEPTED if IP:addr IP:client_addr equals pool yourname2 log local0. TCP session IP:client_addr:TCP:client_port selected yourname2 pool else pool yourname log local0. TCP session IP:c

23、lient_addr:TCP:client_port selected default pool ,Lab 4 : Object type switching,Internet,192.168.0.x/24,:80,:80,:80,Purpose: select a dedicated pool for a specific Client,Step 1: create a new pool create a iRule to select a yourname2 pool for your IP address Step

24、2: add your iRule into Virtual server Step 3: access the virtual server and check the BIGIP log by command: tail f /var/log/ltm | grep Step 4: ask your classmate to access your VS and check the log,when HTTP_REQUEST set uri HTTP:uri log local0. “The URI is $uri” if $uri ends_with .gif pool yourpool

25、else HTTP:uri / pool yourpool2 ,Lab 5 : manipulate HTTP Header,Internet,192.168.0.x/24,:80,:80,:80,Purpose: rewrite WEB server Header for security thread,Step 1: install a HTTP watch Step 2: access your VS and check the http header “server” value Step 3: create a

26、iRule to rewrite Server response HTTP header “server” to your name. Step 4: add your iRule into Virtual server Step 5: access the virtual server and check the BIGIP log by command: tail f /var/log/ltm | grep ,when HTTP_RESPONSE log local0. Original Server type is : HTTP:header Server HTTP:header rep

27、lace Server F5_server log local0. HEADER modified is : HTTP:header Server ,Lab 6 : Selective SNAT address,Internet,192.168.0.x/24,:80,:80,:80,Purpose: specify a SNAT address for a selected source IP address when access VS,Hints: search “snat” irules command and ex

28、ample at Wiki,Thank You!,iRuleV4 vs V9,What can V9 really do that V4 cant?,Use less rule for more functionality. Rules can be written to utilize dynamic data (eg: a pool name can come from a header or cookie). Complete universal persistence Persistence records can be added based on data from the res

29、ponse. Ability to maintain state Session table can track arbitrary information for a period of time. Variables can reference data for the life of the connection. Global variables can reference data indefinitely.,What can V9 really do that V4 cant?,Manipulate the response. Insert or remove headers and cookies in the response. Sanitize headers and cookies from the respo