Use Content Switching to filter and allow certain hostname on a Virtual service

[Salman Butt]

I had create a Content Switching Virtual Service with a rule that only allows traffic to pass through if it matches a certain hostname.

I can easily accomplish this by using HTTP.REQ.HOSTNAME.EQ("google.com").

However this is not scalable and after adding a few FQDN to the list i get a "maximum limit error".

Would anyone know what will be therecommended way will be to accomplish this, filter a VIP and only allow certain group of hostnames to pass through.

[Helge Brust]

Hi,

if you want to stay with one cs policy for this I would use a pattern set for this.

1. create a pattern set with all FQDNs
2. set your policy to HTTP.REQ.HOSTNAME.EQALS_ANY("<patternsetname>")

In this chapter of docs you can see how it works.

[Terry Hooper]

To add to this, using pattern set functionality will result in a less resource-intensive expressions matching process 😉

[Salman Butt]

Thank you so much @Terry Hooper​ and @Helge Brust​ . That seems to have resolved my issue.

Didnt know this feature existed, the appending to expression did seem redundant.

For the community heres what it looks like on the CLI:

1. create pattern set

# add policy patset <pattern_name>

add policy patset pattern_svc

2. bind policy to pattern set

# bind policy patset <pattern_name> <hostname> -index <index_value> -charset ASCII

bind policy patset pattern_svc fedoramagazine.org -index 1 -charset ASCII

3. your content switching policy

# add cs policy <cs_policy> -rule "HTTP.REQ.HOSTNAME.EQUALS_ANY("<pattern_name>")" -action <action_name>

add cs policy cs_svc_pol -rule "HTTP.REQ.HOSTNAME.EQUALS_ANY("pattern_svc")" -action cs_svc_act

4. create a corresponding action

# add cs action <action_name> -targetLBVserver <target_lb_vserver>

add cs action cs_svc_act -targetLBVserver lb_svc_ssl

-------------------------------------------------

Also, if you have a file with the hostnames, here a quick and dirty script to generate the command, so you can run it on the CLI:

(Attached)