F5 301B BIG-IP LTM: iRules and traffic manipulation

Domain 7 covers iRules: event order, which commands are valid where, and how to route or rewrite traffic without breaking performance. Questions are usually short code snippets containing one wrong line.

Events and context

• Rules run by event priority (default 500) across the events that fire.
• Typical order: RULE_INIT (at configuration load) → CLIENT_ACCEPTED → HTTP_REQUEST → LB_SELECTED → SERVER_CONNECTED → HTTP_RESPONSE → HTTP_REQUEST_SEND → CLIENT_CLOSED.
• Commands are context-bound: HTTP::uri only in HTTP events, LB::reselect only in LB_FAILED, SSL::cert after the handshake.
• HTTP events require an HTTP profile on the virtual server.

Manipulating traffic

• pool overrides the default pool; node bypasses load balancing entirely.
• HTTP::header insert|replace|remove, HTTP::uri, HTTP::redirect and HTTP::respond handle requests; HTTP::cookie reads and writes cookies.
• class match [IP::client_addr] equals $::canary_subnets keeps lists in data groups outside the rule.
• table provides shared state, useful for simple rate limiting or deduplication.
• LB::reselect in LB_FAILED lets you choose a fallback pool when the selected member fails.

Worked example

when HTTP_REQUEST {
  if { [HTTP::uri] starts_with "/legacy" } {
    HTTP::redirect "https://[HTTP::host]/new[HTTP::uri]"
    return
  }
  if { [class match [IP::client_addr] equals canary_subnets] } {
    pool web_v2
  } else {
    pool web_v1
  }
}

Reasoning: HTTP::redirect sends the response but does not stop rule execution, so without return the later pool command still runs on a request that was already answered. class match with a data group avoids hard-coding subnets. starts_with compares a prefix, whereas equals compares whole values.

Traps

• Writing HTTP logic on a virtual server that has no HTTP profile.
• Using LB::reselect outside LB_FAILED, which raises an error and terminates the rule silently.
• Forgetting return after redirect or respond.
• Reading payloads with HTTP::payload on large uploads and exhausting memory.
• Logging with log local0. when no log destination is configured.