Content Switching and Policy-Based Traffic Steering
How a content-switching decision is made
A content-switching (CS) vserver receives the client connection, evaluates bound CS policies by priority, and forwards the flow to the target LB vserver named in the matching action. Lower priority numbers are evaluated first. If no policy matches, the CS vserver's default LB vserver handles the traffic; if no default exists, the connection is not steered to a backend. CS vserver type limits the available expressions: HTTP and SSL CS vservers can use HTTP request expressions, while a TCP CS vserver cannot evaluate HTTP host or URL rules.
Rules, actions, and evaluation
- A CS policy pairs a rule expression with a CS action; the action's target is typically an LB vserver.
- Advanced expressions can combine host, path, header, and client address tests, for example
HTTP.REQ.HOSTNAME.EQ("www.example.com") && HTTP.REQ.URL.PATH.STARTSWITH("/api"). gotoexpressions can stop evaluation or continue to the next policy; mishandling them changes which later policies run.- Responder policies can redirect or return a response before load balancing; rewrite policies can alter requests or responses.
- An SSL CS vserver terminates TLS and therefore needs a certificate, even though the target LB vservers may use plain HTTP.
Worked example
A CS vserver for www.example.com must send /api to lb_api, /images to lb_images, and everything else to lb_web. Create priority 100 for HTTP.REQ.HOSTNAME.EQ("www.example.com") && HTTP.REQ.URL.PATH.STARTSWITH("/api") with action targeting lb_api; priority 110 for the /images path; bind lb_web as the default. If the rules were reversed and a broad / rule had priority 100, it would capture every request and the specific policies would never be reached. The host test matters if the same VIP serves multiple hostnames; without it, /api on any host goes to lb_api.
Traps
The most common error is priority inversion: a broad rule evaluated before a specific rule. Another is forgetting the default vserver and expecting traffic to fall through to a target. Do not put HTTP expressions on a TCP CS vserver, and do not forget the certificate on an SSL CS vserver. Also check that the target LB vserver exists, is up, and has bound services; a matching CS policy does not make an empty LB vserver work.