Forum Discussion

Kevin_Leicht_51's avatar
Icon for Nimbostratus rankNimbostratus
Sep 10, 2013

Problem with iRule upgrading to 11.4.

I'm trying to upgrade to 11.4 but am at a bit of a loss to know how to replace the HTTP_CLASS_SELECTED functionality we currently have in one of our iRules. The iRule aborts a session when it encounters a user-agent listed in the 'UserAgentBlacklist' data group, but it then checks to see if there's an ASM class assigned, and if so, it disables ASM. Without the last part, we were getting error messages written to the log. Any idea on how to rewrite this iRule in 11.4?


Code when HTTP_REQUEST {
set abort_trans 0
if { [class match -- [string tolower [HTTP::header "User-Agent"]] contains AVUserAgentBlacklist ] } {
  set abort_trans 1}}
if {[HTTP::class asm]==1}{
  if {$abort_trans==1}{
    drop }}
{if {$abort_trans==1} 
    {drop  }}}

8 Replies

  • nathe's avatar
    Icon for Cirrocumulus rankCirrocumulus

    Hopefully this old post should get you going forward with this. N


  • Richard__Harlan's avatar
    Historic F5 Account

    Which 11.4 the HTTP Class iRule event is gone the following solution should get you what you need.



  • Hmmm. Seems you can move the commands to the HTTP_REQUEST event and then use POLICY::targets command instead of HTTP::class no?


  • I saw that post, but have to figure out what to do with POLICY::. Was trying to find an iRules reference manual, but realize now it's only on devcentral, so will work through the syntax. Thanks.


    • What_Lies_Bene1's avatar
      Icon for Cirrostratus rankCirrostratus
      There is a book available (I wrote it ;-) but unfortunately it's LTM focussed and I haven't yet updated it for v11.3/4 and some other module related changes/additions.
  • Actually, I think I'm in a bit of a catch-22 situation, if I read the documentation correctly. It appears that POLICIES are introduced in 11.4, but I need to figure out how to convert my iRule that uses HTTP_CLASS_SELECTED to use a POLICY instead. BUT.... I can't do that until AFTER I upgrade, AND I can't upgrade until AFTER I change the iRule.


    Am I losing my grasp on reality, or is Monty Python in the house?


  • It's not quite that bad. I'd suggest you simply remove the iRules, do the upgrade and then re-create them but with the new commands etc.


  • With V11.4 you can call the ASM::disable command directly from your HTTP_REQUEST event. So you don't need to set variables anymore to instruct the HTTP_CLASS_SELECTED event.

    when HTTP_REQUEST {
        switch -exact -- [class match -- [string tolower [HTTP::header "User-Agent"]] contains AVUserAgentBlacklist ] 1 {

    Cheers, -Kai