Download presentation
Published byDana Tyler Modified over 10 years ago
1
Seattle DevCentral User Group iRules Optimization Techniques
Joe Pruitt – Senior Strategic Architect
2
Agenda iRules Overview Optimization Techniques Troubleshooting Tips
Open Q&A
3
What are iRules? Programming language integrated into TMOS
Traffic Management Operating System Based on industry standard TCL language Tool Command Language Provide ability to intercept, inspect, transform, direct and track inbound or outbound application traffic Core of the F5 “secret sauce” and key differentiator Colin 3
4
What makes iRules so unique?
Full-fledged scripts, executed against traffic on the network, at wire-speed Powerful logical operations combined with deep packet inspection The ability to route, re-route, re-direct, retry, or block traffic Community support, tools and innovation Redundant? Replace? 4
5
(HTTP_REQUEST, HTTP_RESPONSE, etc.)
How do iRules Work? iRules allow you to perform deep packet inspection (entire header and payload) Coded around Events (HTTP_REQUEST, HTTP_RESPONSE, CLIENT_ACCEPTED etc.) Full scripting language allows for extremely granular control of inspection, alteration and delivery on a packet by packet basis Requests iRule Triggered HTTP Events Fire (HTTP_REQUEST, HTTP_RESPONSE, etc.) Modified Request* Modified Responses* Original Request *Note: BIG-IP’s Bi-Directional Proxy capabilities allow it to inspect, modify and route traffic at nearly any point in the traffice flow, regardless of direction.
6
What can an iRule do? Read, transform, replace header or payload information (HTTP, TCP, SIP, etc.) Work with any protocol, such as SIP, RTSP, XML, others, whether with native ( or generic (TCP::payload) commands Authentication assistance, offload, inspection and more for LDAP, RADIUS, etc. Caching, compression, profile selection, rate shaping and much, much more 6
7
Key elements of an iRule
Event declarations Define when code will be executed Operators Define under what conditions you will perform an action iRule commands Define the action to perform 7
8
iRule elements - Events
Events are anything that may trigger the processing of the rule in the first place Examples: HTTP_REQUEST HTTP_RESPONSE CLIENT_ACCEPTED LB_FAILED Additional events found at when HTTP_REQUEST { http_pool1 } 8
9
iRule elements - Operators
There are two types or operators, Relational and Logical Operators compare the operands in an expression Relational operators contains, matches, equals, starts_with, ends_with, matches_regex, switch Logical operators if, and, not, or when HTTP_REQUEST { if{[ ends_with “bob.com”}{ pool http_pool1 } when HTTP_REQUEST { if{([ ends_with “bob.com”) or ([ contains “/portal/”)}{ pool http_pool1 } 9
10
iRule elements – iRule commands
As implied, the action that is to be carried out upon a operator match Does the rule look for data, manipulate data, send to a location? Statement commands – can cause actions such as destination selection or SNAT assignment Query commands – search for header or content data, such as IP::remote_addr Data manipulation – as stated, manipulate the data content, such as insert or remove headers Utility commands – useful for parsing data and manipulating content, such as decode_uri <string> Many additional commands available - 10
11
iRule Event Taxonomy GLOBAL LINE TCP RTSP HTTP CACHE UDP SIP CLIENTSSL
AUTH AUTH_ERROR AUTH_FAILURE AUTH_RESULT AUTH_SUCCESS AUTH_WANTCREDENTIAL GLOBAL LB_FAILED LB_SELECTED RULE_INIT LINE CLIENT_LINE SERVER_LINE TCP CLIENT_ACCEPTED CLIENT_CLOSED CLIENT_DATA SERVER_CLOSED SERVER_CONNECTED SERVER_DATA USER_REQUEST USER_RESPONSE AUTH GLOBAL LINE TCP RTSP RTSP_REQUEST RTSP_REQUEST_DATA RTSP_RESPONSE RTSP_RESPONSE_DATA RTSP HTTP HTTP_CLASS_FAILED HTTP_CLASS_SELECTED HTTP_REQUEST HTTP_REQUEST_DATA HTTP_REQUEST_SEND HTTP_RESPONSE HTTP_RESPONSE_CONTINUE HTTP_RESPONSE_DATA HTTP CACHE CACHE_REQUEST CACHE_RESPONSE CACHE UDP CLIENT_ACCEPTED CLIENT_CLOSED CLIENT_DATA SERVER_CLOSED SERVER_CONNECTED SERVER_DATA UDP SIP SIP_REQUEST SIP_REQUEST_SEND SIP_RESPONSE SIP CLIENTSSL CLIENTSSL_CLIENTCERT CLIENTSSL_HANDSHAKE CLIENTSSL IP CLIENT_ACCEPTED CLIENT_CLOSED CLIENT_DATA SERVER_CLOSED SERVER_CONNECTED SERVER_DATA IP SERVERSSL SERVERSSL_HANDSHAKE SERVERSSL XML XML_BEGIN_DOCUMENT XML_BEGIN_ELEMENT XML_CDATA XML_END_DOCUMENT XML_END_ELEMENT XML_EVENT DNS DNS_REQUEST DNS_RESPONSE NAME_RESOLVED XML DNS STREAM STREAM_MATCHED STREAM 11
12
Prize Giveaway #1 What does TCL stand for?
13
iRules Optimization Techniques
14
Optimization Tip #1 – Don’t use an iRule
If you aren’t doing custom conditional testing, let the profiles do the work. HTTP header insert HTTP header erase HTTP fallback HTTP compress uri <exclude|include> HTTP compress gzip level HTTP redirect rewrite HTTP insert xforwarded for HTTP ramcache uri <exclude|include|pinned> Stream Profile for content replacement Class profile for URI matching.
15
Optimization Tip #2 - Planning
Plan your iRule before attempting to code Determine what protocols involved Decide what commands you'll need Choose how to achieve the desired effect in the least steps Confirm what needs to be logged Determine where/how you will test
16
Optimization Tip #3 – Tools and Preparation
Have a test System available Install and get familiar with a packet capture tool Find your favorite TCL resource(s) Browse DevCentral Use a code editing tool
17
F5 iRule Editor First network rule editor optimizes development
Includes: Syntax checking Auto-complete Template support Doc Links Deployment integration Statistics monitoring Data group editing Optional post to CodeShare feature Available: Now Tutorials: on DevCentral
18
Optimization Tip #4 – Control Your Control statements
Think “switch”, then “class”, then “if/elseif” when HTTP_REQUEST { switch –glob [ { “/img*” - “/image*” - “/pics*” { pool imagePool } } class image_dirs { “/img” “/image” “/pics” } … when HTTP_REQUEST { if { [matchclass [ starts_with $::image_dirs] } { pool imagePool when HTTP_REQUEST { if { [ starts_with “/img” } { pool imagePool } elseif { [ starts_with “/image” } { } elseif { [ starts_with “/pics” } { }
19
Optimization Tip #5 – Regex is EVIL
Regex’s are cool, but are CPU hogs and should be considered pure evil. Most often there are better alternatives. when HTTP_REQUEST { if { [regex {^/myPortal} [ } { regsub {/myPortal} [ “/UserPortal” newUri $newUri pool http_pool1 } when HTTP_REQUEST { if{[ starts_with “/myPortal”}{ newUri [string map {myPortal UserPortal [ $newUri pool http_pool1 } But sometimes they are a necessary evil… when HTTP_RESPONSE_DATA { # Find ALL the possible credit card numbers in one pass set card_indices [regexp -all -inline -indices {(?:30[0-5]\d{11})|(?:3[6|8]\d{12})|(?:3[4|7]\d{13})|(?:4\d{12})|(?:4\d{15})|(?:5[1-5]\d{14})|(?:6011\d{12})} [ }
20
Optimization Tip #6 – Don’t Use Variables
Don’t use variables unless you HAVE to. They may make it easier to read, but they do chew up memory and CPU. when HTTP_REQUEST { set host [ set uri [ if{[ contains “bob.com”}{ log “Host = $host” log “URI = $uri” pool http_pool1 } when HTTP_REQUEST { if{[ contains “bob.com”}{ log “Host = [ ; URI = [ pool http_pool1 }
21
Optimization Tip #7 – Use Variables
Use variables to reduce repetitive costly evaluations, but don’t make the names too long… when HTTP_REQUEST { if { [string tolower [ starts_with “/img” } { pool imagePool } elseif { ([string tolower [ ends_with “.gif”]) || ([string tolower [ ends_with “.jpg”]) || ([string tolower [ ends_with “.png”]) } { } } when HTTP_REQUEST { set theUriThatIAmMatchingInThisiRule [string tolower [ if { $theUriThatIAmMatchingInThisiRule starts_with “/img” } { pool imagePool } elseif { ($theUriThatIAmMatchingInThisiRule ends_with “.gif”) || ($theUriThatIAmMatchingInThisiRule ends_with “.jpg”) || ($theUriThatIAmMatchingInThisiRule ends_with “.png”) } { } when HTTP_REQUEST { set uri [string tolower [ if { $uri starts_with “/img” } { pool imagePool } elseif { ($uri ends_with “.gif”) || ($uri ends_with “.jpg”) || ($uri ends_with “.png”) } { }
22
Optimization Tip #8 – Return Early
Use "return" to exit early to save as many CPU cycles as possible. when HTTP_REQUEST { if { [ contains “/images” { pool imagePool } if { [ exists “SomeHeader” } { log local0. “SomeHeader found” when HTTP_REQUEST { if { [ contains “/images” { pool imagePool return } if { [ exists “SomeHeader” } { log local0. “SomeHeader found”
23
Optimization Tip #9 – Operators and Data Types
Polymorphism is a blessing and a killer. Use the right operator for the right type Use eq, ne on strings Use ==, != on numbers set x 0 foreach dir {[split [ "/"]} { incr x if {$x == 4} { ... } set x 0 foreach dir {[split [ "/"]} { incr x if {$x eq 4} { ... } Use [IP::addr] to compare addresses if { [IP::addr [IP::client_addr]/8 equals ] } { … } Things are not always as they seem set x 5 if { $x == 5 } { } # this evaluates as true if { $x eq 5 } { } # this evaluates as true if { $x == 05 } { } # this evaluates as true if { $x eq 05 } { } # this evaluates as false
24
Optimization Tip #9 – Operators and Data Types
Group expressions with curly’s to avoid unnecessary conversions (especially with “expr”). when CLIENT_ACCEPTED { set newOct [expr 3 + [getfield [IP::client_addr] "." 4] ] set total [expr $newOct] ... } when CLIENT_ACCEPTED { set newOct [expr {3 + [getfield [IP::client_addr] "." 4]}] set total [expr {128 + $newOct}] ... }
25
Optimization Tip #10 – Timing
Use the “timing” command to turn on profiling statistics in your iRule. Use the GUI, bigpipe, or the iRule Editor to monitor and test your optimizations. timing on when HTTP_REQUEST { if { [ starts_with “/img” } { pool imgPool } elseif { [ starts_with “/doc” } { pool docPool } elseif { [ starts_with “/blog” } { pool blogPool } } when HTTP_RESPONSE { if { [ == 500 } { 200 content “An error occurred” when HTTP_REQUEST { if { [ starts_with “/img” } { pool imgPool } elseif { [ starts_with “/doc” } { pool docPool } elseif { [ starts_with “/blog” } { pool blogPool } } when HTTP_RESPONSE timing on { if { [ == 500 } { 200 content “An error occurred”
26
Optimization Tip #11 – Use the community
27
How may *::payload iRule commands are there?
Prize Giveaway #2 How may *::payload iRule commands are there?
28
Troubleshooting tips Verify that the rule is looking for the correct item to act upon, such as the URI Ensure you’re using the right events Check the logs for hints Try using single-case comparisons Analyze traffic with a capture tool Use “timing” to measure efficiency gains 28
29
Troubleshooting tips continued
Use log statements to verify the information Logging practices that can be helpful: Log variable values before and after each time they are set Log at least once in each event to ensure all events are firing as intended Add a log entry inside each conditional block to see if the conditional returned true or false (don't forget Else clauses) Log the result of each command being executed if possible by re-logging any variable that was effected
30
Where can I find out more?
F5 DevCentral: Home: Editor: TCL Links: Overview: Tutorial: Reference:
31
What two functions does OneConnect perform?
Prize Giveaway #3 What two functions does OneConnect perform?
32
Know How. Now.
Similar presentations
© 2025 SlidePlayer.com Inc.
All rights reserved.