1. Seattle DevCentral User Group iRules Optimization Techniques
Joe Pruitt – Senior Strategic Architect

2. Agenda iRules Overview Optimization Techniques Troubleshooting Tips
Open Q&A

3. What are iRules? Programming language integrated into TMOS
Traffic Management Operating System
Based on industry standard TCL language
Tool Command Language
Provide ability to intercept, inspect, transform, direct and track inbound or outbound application traffic
Core of the F5 “secret sauce” and key differentiator
Colin 3

4. What makes iRules so unique?
Full-fledged scripts, executed against traffic on the network, at wire-speed
Powerful logical operations combined with deep packet inspection
The ability to route, re-route, re-direct, retry, or block traffic
Community support, tools and innovation
Redundant? Replace? 4

5. (HTTP_REQUEST, HTTP_RESPONSE, etc.)
How do iRules Work?
iRules allow you to perform deep packet inspection (entire header and payload)
Coded around Events (HTTP_REQUEST, HTTP_RESPONSE, CLIENT_ACCEPTED etc.)
Full scripting language allows for extremely granular control of inspection, alteration and delivery on a packet by packet basis
Requests
iRule Triggered
HTTP Events Fire
(HTTP_REQUEST, HTTP_RESPONSE, etc.)
Modified Request*
Modified Responses*
Original Request
*Note: BIG-IP’s Bi-Directional Proxy capabilities allow it to inspect, modify and route traffic at nearly any point in the traffice flow, regardless of direction.

6. What can an iRule do?
Read, transform, replace header or payload information (HTTP, TCP, SIP, etc.)
Work with any protocol, such as SIP, RTSP, XML, others, whether with native ( or generic (TCP::payload) commands
Authentication assistance, offload, inspection and more for LDAP, RADIUS, etc.
Caching, compression, profile selection, rate shaping and much, much more 6

7. Key elements of an iRule
Event declarations
Define when code will be executed
Operators
Define under what conditions you will perform an action
iRule commands
Define the action to perform 7

8. iRule elements - Events
Events are anything that may trigger the processing of the rule in the first place
Examples:
HTTP_REQUEST
HTTP_RESPONSE
CLIENT_ACCEPTED
LB_FAILED
Additional events found at
when HTTP_REQUEST {
http_pool1 } 8

9. iRule elements - Operators
There are two types or operators, Relational and Logical
Operators compare the operands in an expression
Relational operators
contains, matches, equals,
starts_with, ends_with,
matches_regex, switch
Logical operators
if, and, not, or
when HTTP_REQUEST {
if{[ ends_with “bob.com”}{
pool http_pool1 }
when HTTP_REQUEST {
if{([ ends_with “bob.com”) or ([ contains “/portal/”)}{
pool http_pool1 } 9

10. iRule elements – iRule commands
As implied, the action that is to be carried out upon a operator match
Does the rule look for data, manipulate data, send to a location?
Statement commands – can cause actions such as destination selection or SNAT assignment
Query commands – search for header or content data, such as IP::remote_addr
Data manipulation – as stated, manipulate the data content, such as insert or remove headers
Utility commands – useful for parsing data and manipulating content, such as decode_uri <string>
Many additional commands available - 10

11. iRule Event Taxonomy GLOBAL LINE TCP RTSP HTTP CACHE UDP SIP CLIENTSSL
AUTH
AUTH_ERROR
AUTH_FAILURE
AUTH_RESULT
AUTH_SUCCESS
AUTH_WANTCREDENTIAL
GLOBAL
LB_FAILED
LB_SELECTED
RULE_INIT
LINE
CLIENT_LINE
SERVER_LINE
TCP
CLIENT_ACCEPTED
CLIENT_CLOSED
CLIENT_DATA
SERVER_CLOSED
SERVER_CONNECTED
SERVER_DATA
USER_REQUEST
USER_RESPONSE
AUTH
GLOBAL
LINE
TCP
RTSP
RTSP_REQUEST
RTSP_REQUEST_DATA
RTSP_RESPONSE
RTSP_RESPONSE_DATA
RTSP
HTTP
HTTP_CLASS_FAILED
HTTP_CLASS_SELECTED
HTTP_REQUEST
HTTP_REQUEST_DATA
HTTP_REQUEST_SEND
HTTP_RESPONSE
HTTP_RESPONSE_CONTINUE
HTTP_RESPONSE_DATA
HTTP
CACHE
CACHE_REQUEST
CACHE_RESPONSE
CACHE
UDP
CLIENT_ACCEPTED
CLIENT_CLOSED
CLIENT_DATA
SERVER_CLOSED
SERVER_CONNECTED
SERVER_DATA
UDP
SIP
SIP_REQUEST
SIP_REQUEST_SEND
SIP_RESPONSE
SIP
CLIENTSSL
CLIENTSSL_CLIENTCERT
CLIENTSSL_HANDSHAKE
CLIENTSSL IP
CLIENT_ACCEPTED
CLIENT_CLOSED
CLIENT_DATA
SERVER_CLOSED
SERVER_CONNECTED
SERVER_DATA IP
SERVERSSL
SERVERSSL_HANDSHAKE
SERVERSSL
XML
XML_BEGIN_DOCUMENT
XML_BEGIN_ELEMENT
XML_CDATA
XML_END_DOCUMENT
XML_END_ELEMENT
XML_EVENT
DNS
DNS_REQUEST
DNS_RESPONSE
NAME_RESOLVED
XML
DNS
STREAM
STREAM_MATCHED
STREAM 11

12. Prize Giveaway #1
What does TCL stand for?

13. iRules Optimization Techniques

14. Optimization Tip #1 – Don’t use an iRule
If you aren’t doing custom conditional testing, let the profiles do the work.
HTTP header insert
HTTP header erase
HTTP fallback
HTTP compress uri <exclude|include>
HTTP compress gzip level
HTTP redirect rewrite
HTTP insert xforwarded for
HTTP ramcache uri <exclude|include|pinned>
Stream Profile for content replacement
Class profile for URI matching.

15. Optimization Tip #2 - Planning
Plan your iRule before attempting to code
Determine what protocols involved
Decide what commands you'll need
Choose how to achieve the desired effect in the least steps
Confirm what needs to be logged
Determine where/how you will test

16. Optimization Tip #3 – Tools and Preparation
Have a test System available
Install and get familiar with a packet capture tool
Find your favorite TCL resource(s)
Browse DevCentral
Use a code editing tool

17. F5 iRule Editor First network rule editor optimizes development
Includes:
Syntax checking
Auto-complete
Template support
Doc Links
Deployment integration
Statistics monitoring
Data group editing
Optional post to CodeShare feature
Available: Now
Tutorials: on DevCentral

18. Optimization Tip #4 – Control Your Control statements
Think “switch”, then “class”, then “if/elseif”
when HTTP_REQUEST {
switch –glob [ {
“/img*” -
“/image*” -
“/pics*” { pool imagePool } }
class image_dirs {
“/img”
“/image”
“/pics” } …
when HTTP_REQUEST {
if { [matchclass [ starts_with $::image_dirs] } {
pool imagePool
when HTTP_REQUEST {
if { [ starts_with “/img” } {
pool imagePool
} elseif { [ starts_with “/image” } {
} elseif { [ starts_with “/pics” } { }

19. Optimization Tip #5 – Regex is EVIL
Regex’s are cool, but are CPU hogs and should be considered pure evil. Most often there are better alternatives.
when HTTP_REQUEST {
if { [regex {^/myPortal} [ } {
regsub {/myPortal} [ “/UserPortal” newUri
$newUri
pool http_pool1 }
when HTTP_REQUEST {
if{[ starts_with “/myPortal”}{
newUri [string map {myPortal UserPortal [
$newUri
pool http_pool1 }
But sometimes they are a necessary evil…
when HTTP_RESPONSE_DATA {
# Find ALL the possible credit card numbers in one pass
set card_indices [regexp -all -inline -indices {(?:30[0-5]\d{11})|(?:3[6|8]\d{12})|(?:3[4|7]\d{13})|(?:4\d{12})|(?:4\d{15})|(?:5[1-5]\d{14})|(?:6011\d{12})} [ }

20. Optimization Tip #6 – Don’t Use Variables
Don’t use variables unless you HAVE to. They may make it easier to read, but they do chew up memory and CPU.
when HTTP_REQUEST {
set host [
set uri [
if{[ contains “bob.com”}{
log “Host = $host”
log “URI = $uri”
pool http_pool1 }
when HTTP_REQUEST {
if{[ contains “bob.com”}{
log “Host = [ ; URI = [
pool http_pool1 }

21. Optimization Tip #7 – Use Variables
Use variables to reduce repetitive costly evaluations, but don’t make the names too long…
when HTTP_REQUEST {
if { [string tolower [ starts_with “/img” } {
pool imagePool
} elseif { ([string tolower [ ends_with “.gif”]) ||
([string tolower [ ends_with “.jpg”]) ||
([string tolower [ ends_with “.png”]) } {
} }
when HTTP_REQUEST {
set theUriThatIAmMatchingInThisiRule [string tolower [
if { $theUriThatIAmMatchingInThisiRule starts_with “/img” } {
pool imagePool
} elseif { ($theUriThatIAmMatchingInThisiRule ends_with “.gif”) ||
($theUriThatIAmMatchingInThisiRule ends_with “.jpg”) ||
($theUriThatIAmMatchingInThisiRule ends_with “.png”) } { }
when HTTP_REQUEST {
set uri [string tolower [
if { $uri starts_with “/img” } {
pool imagePool
} elseif { ($uri ends_with “.gif”) ||
($uri ends_with “.jpg”) ||
($uri ends_with “.png”) } { }

22. Optimization Tip #8 – Return Early
Use "return" to exit early to save as many CPU cycles as possible.
when HTTP_REQUEST {
if { [ contains “/images” {
pool imagePool }
if { [ exists “SomeHeader” } {
log local0. “SomeHeader found”
when HTTP_REQUEST {
if { [ contains “/images” {
pool imagePool
return }
if { [ exists “SomeHeader” } {
log local0. “SomeHeader found”

23. Optimization Tip #9 – Operators and Data Types
Polymorphism is a blessing and a killer.
Use the right operator for the right type
Use eq, ne on strings
Use ==, != on numbers
set x 0
foreach dir {[split [ "/"]} {
incr x
if {$x == 4} {
... }
set x 0
foreach dir {[split [ "/"]} {
incr x
if {$x eq 4} {
... }
Use [IP::addr] to
compare addresses
if { [IP::addr [IP::client_addr]/8 equals ] } { … }
Things are not always as they seem
set x 5
if { $x == 5 } { } # this evaluates as true
if { $x eq 5 } { } # this evaluates as true
if { $x == 05 } { } # this evaluates as true
if { $x eq 05 } { } # this evaluates as false

24. Optimization Tip #9 – Operators and Data Types
Group expressions with curly’s to avoid unnecessary conversions (especially with “expr”).
when CLIENT_ACCEPTED {
set newOct [expr 3 + [getfield [IP::client_addr] "." 4] ]
set total [expr $newOct]
... }
when CLIENT_ACCEPTED {
set newOct [expr {3 + [getfield [IP::client_addr] "." 4]}]
set total [expr {128 + $newOct}]
... }

25. Optimization Tip #10 – Timing
Use the “timing” command to turn on profiling statistics in your iRule. Use the GUI, bigpipe, or the iRule Editor to monitor and test your optimizations.
timing on
when HTTP_REQUEST {
if { [ starts_with “/img” } {
pool imgPool
} elseif { [ starts_with “/doc” } {
pool docPool
} elseif { [ starts_with “/blog” } {
pool blogPool
} }
when HTTP_RESPONSE {
if { [ == 500 } {
200 content “An error occurred”
when HTTP_REQUEST {
if { [ starts_with “/img” } {
pool imgPool
} elseif { [ starts_with “/doc” } {
pool docPool
} elseif { [ starts_with “/blog” } {
pool blogPool
} }
when HTTP_RESPONSE timing on {
if { [ == 500 } {
200 content “An error occurred”

26. Optimization Tip #11 – Use the community

27. How may *::payload iRule commands are there?
Prize Giveaway #2
How may *::payload iRule commands are there?

28. Troubleshooting tips
Verify that the rule is looking for the correct item to act upon, such as the URI
Ensure you’re using the right events
Check the logs for hints
Try using single-case comparisons
Analyze traffic with a capture tool
Use “timing” to measure efficiency gains 28

29. Troubleshooting tips continued
Use log statements to verify the information
Logging practices that can be helpful:
Log variable values before and after each time they are set
Log at least once in each event to ensure all events are firing as intended
Add a log entry inside each conditional block to see if the conditional returned true or false (don't forget Else clauses)
Log the result of each command being executed if possible by re-logging any variable that was effected

30. Where can I find out more?
F5 DevCentral:
Home:
Editor:
TCL Links:
Overview:
Tutorial:
Reference:

31. What two functions does OneConnect perform?
Prize Giveaway #3
What two functions does OneConnect perform?

32. Know How. Now.