Profiles, Persistence, and iRules
Domain 3 - Profiles, Persistence, and iRules
This domain tests how BIG-IP changes protocol behavior and maintains session affinity without breaking load balancing.
Profiles
Profiles are inheritance-based settings containers. A parent profile supplies defaults; a child profile overrides selected fields. Protocol profiles such as TCP, HTTP, UDP, DNS, client SSL, and server SSL shape parsing, timeouts, and security behavior. The default profile is not a universal answer: compression, acceleration, and explicit proxy behavior need the right profile. Profiles attach to virtual servers, and profile changes affect traffic only where the profile is referenced.
Persistence
Persistence profiles keep a client tied to a member: source address, cookie, SSL session ID, destination address, hash, or SIP. Cookie persistence can insert a cookie, rewrite an existing application cookie, or use passive or active modes. Persistence has a timeout and can be mirrored. Match Across Services and Match Across Virtual Servers widen the match. Fallback can use another persistence method or none.
iRules
iRules are Tcl-based event handlers: when CLIENT_ACCEPTED, HTTP_REQUEST, LB_SELECTED, SERVER_CONNECTED, or HTTP_RESPONSE. Commands include pool, node, persist, snat, drop, reject, redirect, and HTTP::redirect. Event order matters: LB_SELECTED fires after selection and can override the choice with pool or node. iRules run per connection or per request depending on the event; heavy iRules cost CPU.
Worked example
A virtual server uses cookie persistence and an iRule: when HTTP_REQUEST { if { [HTTP::uri] starts_with '/old' } { HTTP::redirect https://example.com/new } }. A returning client with a valid persistence cookie still has affinity, but the redirect is issued before pool selection, so no member is chosen for that request. If the rule instead ran at LB_SELECTED and issued pool webpool, it would override the load-balancing decision.
Traps
- Thinking a profile change is immediate without updating the virtual server reference.
- Confusing cookie insert with cookie rewrite; insert adds a BIG-IP cookie, rewrite modifies an application cookie.
- Forgetting persistence timeout and mirroring behavior.
- Writing an iRule for every request when a profile setting would be cheaper.
- Assuming events fire in the order they appear in the file; they fire by event stage.
- Overriding a pool at the wrong event and wondering why selection did not change.