VS Order of Precedence When Using iRules
Hoping you guys will help me out here with a couple of questions. I have a defined VS that accepts conns from any src_ip to the dest_ip of the VS on a list of ports as defined in an irule. This works fine.
I need to insert another VS with the same IP and I am trying to use the higher order of precedence as defined by f5 of preferring specific src_IP to dest_IP on any port. I also want to define these source IPs in a data group. I am creating a new VS for this due to a number of different settings being needed on this VS versus the existing VS.
So really, my questions are:
-
If I configure a VS with a datagroup for source IPs and reference that in an irule, will that take precedence over the other VS that allows ANY source IP but is limited by port ranges as defined in that VS irule. Based on K14800, I think it should, though it doesn't really specify that setting the src_ip port etc by irule plays by the same precedence rules as a static definition in the VS config.
-
If 1 will work as I understand it, what would the irule look like in the new higher precedence VS? I believe the following will send a RST to any client that doesn't match the DG, when I really just want it to move on to the next best matching VS.
when CLIENT_ACCEPTED { if { not ([class match [IP::client_addr] equals SRC_IP_DG])} { reject } }