iRules LX – AFM/APM Dynamic Firewall Rules

One of the iRules LX projects I’ve been working on is the ability to dynamically open firewall rules based upon a user’s APM Access Session.  In this example the user is external trying to access internal server resources but is blocked by AFM’s default firewall policies.  The user then logs into an APM policy and upon successful login AFM allows that external user access to internal resources.  See the video below for a demo:

iRules do not have direct access to control plane settings.  So prior to TMOS 12.1 this wasn’t easily doable without some serious iRule foo around sideband connections. However, with the introduction of iRules LX we can leverage Node.js to help us interact with the control plane via API calls.

So how does it work?

You still leverate iRules in iRules LX but a new set of commands allow you to pass data from TMM (data plane) to Node.js (control plane) and process that data via javascript – more information in the Getting Started With iRules LX series on DevCentral.

So what does this look like?

Your iRules do not change much except for the addition of the ILX commands:

  • ILX::init – invokes the specified node methods
  • ILX::call – establishes a communication path from an iRules to the node process
  • ILX::notify  – sends a message to the specified node method but does not wait for a response

As an example I’ve included the  iRule used in the AFM/APM dynamic firewall rule project below:

Notice the ILX::init on line 7 – this is configured with the iRules LX plugin name and the iRules LX extension inside our workspace.


What about Node.js

Next, you provide the Node.js methods your iRule calls in the index.js file

Not too hard and it offers a world of possibilities with the inclusion of NPM modules.

Where’s the rest of the code?

For a complete view of the iRules LX code please visit the Github repository.

iRules LX – 5 Tips to Get You Started

iRules LX is now GA with the release of TMOS 12.1.  I’ve been using iRules LX over the past two weeks working on some cool projects I hope to share in the near future.  In the meantime I wanted to provide some tips I’ve picked up while learning Node.JS and iRules LX.

1 – NPM makes life easier

Wow… I was speechless when I first heard that iRules LX would have native access to NPM.  I’ve seen some pretty cool internal projects that leverage publically available NPM tool sets and now you have the power of NPM inside TMOS.  So what does this mean… well for all you APM fans out that you can now read/write to SQL!  NPM allows you to quickly create applications and features without having to write everything from scratch.  This opens up a new world of possibilities for F5’s advance modules like APM and AFM.  More to come on this in the near future.

2 – Learn Node.js or make friends with a developer

There are probably more Node.js developers in your city than there are TCL developers in your state.. and probably your surrounding states.  So I was happy to hear F5 was opening up our development capabilities to a wider audience.  If you’re new to Node.JS I highly recommend Code School or if your organization has a membership to Safari Books  they have some great resources as well.

I’m also a big fan of test driven development. Mocha and Chai are great tools and supper easy to learn.  The benefit of TDD is you always know your code works.  If any update breaks something, the TDD process will find it.I also like developing the Node.js code on my laptop so TDD helps me verify that my java libraries work before I upload them to the BIG-IP for integration with iRules.

3 – DevCentral

Eric Flores over on DevCentral publish a great 5 part Getting Started with iRules LX series.  Between this and the Node.js video tutorial in the Safari Books online library I was ready to go.  DevCentral is also a great place to ask question and get assistance.  With over 250,000+ members it’s definitely a site you should familiarize yourself with.

4 – {}; or {}

Okay, so I’ve written some Node.js code and I’m finishing my iRules code to glue the processes together and when I hit the “Reload from Workspace” button I get a slew of iRule error…. guess what I did wrong 🙂  Can’t write JavaScript in iRules

Syntax issues bit me several times as I moved between iRules and JavaScript so be sure you keep an eye on this.  Some of the most common issues:

Accessing a variable in iRules requires a $, in JavaScript it does not
JavaScript uses a semicolon (;) at the end of a statement, iRules does not

5 – Callback hell

One of the hardest things for me to wrap my head around while learning Node.js is the concept of synchronous vs asynchronous processes.  I’ve always been use to writing code in a synchronous way so it stumped me why my functions would not return a value or my debug statements were always empty.

An easy way to think about it:

if you’re reading/writing to a filesystem or a web server then use an asynchronous process
if you’re reading/writing to a local function, say generating a secret key for Google Authenticator, then use a synchronous process
Also, in your Mocha test framework you’ll need to use the break() function for any process that are synchronous.

I hope these tips help you has your dive into iRules LX.  I’ve definitely enjoyed working with iRules LX over the past two weeks and I’ll share my projects with you once they’re publically available.

Hosting Static Content with an iRule and iFiles

If you didn’t know about this feature it is a neat trick to host maintenance pages.  I’ve recently implemented this to host a static website on the BIG-IP without the need for a backend web server.  The use case I’m looking at is for F5 training labs running in Google’s Cloud Compute Engine via Ravello.  We’ll be running anywhere from 30 to 50 training instances so to keep costs down I only want to run an F5 image.

I used the HTML5 Initializr tool to generate a responsive web application shell and them customized with the traditional F5 red and information about using an iRule and iFiles to host content.

Demo Page
Demo Page

To host this content i created an ifile folder on the BIG-IP in the config director then I uploaded the HTML, CSS and Javascript files to it.  From here I used TMSH to create the iFile butyou can also use the GUI. Example below for main.css:

create sys file ifile main.css source-path file://localhost/config/ifile/main.css
create ltm ifile main.css file-name main.css

I then created the following iRule and assigned it to my test virtual server:

  switch [HTTP::uri] {
    "/" -
    "/index.html" {
      HTTP::respond 200 content [ifile get index.html]
    "/js/vendor/jquery-1.11.2.min.js" {
      HTTP::respond 200 content [ifile get jquery-1.11.2.min.js]
    "/img/f5-logo-solid-rgb.png" {
      HTTP::respond 200 content [ifile get f5-logo-solid-rgb.png]
    "/css/main.css" {
      HTTP::respond 200 content [ifile get main.css]
    "/js/vendor/modernizr-2.8.3-respond-1.4.2.min.js" {
      HTTP::respond 200 content [ifile get modernizr-2.8.3-respond-1.4.2.min.js]
    "/css/normalize.min.css" {
      HTTP::respond 200 content [ifile get normalize.min.css]

Easy enough!

Tar file of the demo site and iRule here:demo_site