lb action

The lb action command manages the actions to be applied to the traffic: adding and changing a header, redirection, blocking, showing content, rate and bandwidth limiting, logging and more. Its panel equivalent is the Actions section.

An action does not work on its own: it is bound to a vService and is applied there by being matched with a condition.

The first field written is type

In this command the type is selected first, the name of the record is asked for after it. Without the type being written, the name field is not listed.

Command Summary

TR7 WEB-CLI · lb action

# Tab after the command

admin@TR7LBWAF01> lb action

add delete list show update

 

admin@TR7LBWAF01> lb action list # list all of them

admin@TR7LBWAF01> lb action show <id> # show one

admin@TR7LBWAF01> lb action add type <type> name <name> … # new action

admin@TR7LBWAF01> lb action update id <id> … # change

admin@TR7LBWAF01> lb action delete <id> # delete

admin@TR7LBWAF01>  

Writing Order

Step 1 Select the type

lb action add type add_header

There are thirty-seven types; Tab lists them all. After the type is selected, only the fields of that type are asked for.

Step 2 Write the name

name add-client-ip

Step 3 Write the fields of the type

In most types there is no additional required field; the ones that have them are marked in the table below.

Step 4 Bind it to a vService

lb service update id <vService> --rules.0 <action>

Required Fields

Order	Field	Status	Value
1	type	Required	The action type; one of 37 values
2	name	Required	The name of the action
3	mirrorBackend	Conditionally required	Only mirror; the backend to which the copy will be sent
3 · 4	headerNameToAdd · headerContent	Conditionally required	Only add_header; the header name and its content
3–5	headerNameToEdit · headerContent · headerNameToDelete	Conditionally required	Only set_header
3–5	headerNameToReplace · headerReplaceRegex · headerReplaceContent	Conditionally required	Only replace_header
3	trafficInspectionTag	Conditionally required	Only advancedTrafficInspection
3	matcher	Conditionally required	Only modifyResponse
3	manualRuleContent	Conditionally required	Only manualRule
3	redirectLoc	Conditionally required	req_redirect_location · error_redirect_at_tm · error_redirect_at_res; the redirection address
3	newPath	Conditionally required	set_path · set_pathq; the new path
3	cookieName	Conditionally required	Only cookie_based

The action type is a discriminator in this command: all the fields in the table are written without a prefix even if there is a field starting with -- in the line, and the CLI does not accept any field starting with -- until the required fields specific to the type are completed. In the types that are not in the list there is no additional required field.

The Action Types

The table below is the map of the types: the command value, its equivalent in the panel and the additional required fields asked for after the name. All the fields of every type are given in the sections under this table.

type	Panel equivalent	Additional required fields
add_header	Add HTTP Header	headerNameToAdd · headerContent
set_header	Set HTTP Header	headerNameToEdit · headerContent · headerNameToDelete
replace_header	Replace HTTP Header Content	headerNameToReplace · headerReplaceRegex · headerReplaceContent
del_header	Delete HTTP Header	—
headerFix	HTTP Header 1.0 Compatibility	—
keepHeaderNames	Keep Header Names	—
securityHeaders	Manage HTTP Security Headers	—
cors	CORS	—
cookie_based	Cookie Based Connection Persistency	cookieName
cookieSecurity	HTTP Cookie Security	—
cookieEncryption	Cookie Encryption	—
set_path	Set Path	newPath
set_pathq	Set Path + Query	newPath
normalize_uri	URL Normalization	—
req_redirect_location	Location Redirection	redirectLoc
redirect_scheme	Redirect to HTTPS	—
error_redirect_at_tm	Redirect for Traffic Manager Errors	redirectLoc
error_redirect_at_res	Redirect for Backend Service Errors	redirectLoc
showContent	Show Content	—
error_file_at_tm	Show Content for Traffic Manager Errors	—
error_file_at_res	Show Content for Backend Service Errors	—
deny	Block	—
quarantine_table	Quarantine	—
advancedCaptcha	Advanced CAPTCHA	—
req_auth	User Authentication on HTTP Request	—
bandwidthRule	Bandwidth Limitation	—
tcp_conn_mgmt	TCP Connection Management	—
http-reuse	HTTP/TCP Multiplexing	—
mirror	Traffic Mirroring	mirrorBackend
set_variable	Create Traffic Variable	—
advancedTrafficInspection	Advanced Traffic Inspection	trafficInspectionTag
modifyResponse	Modify Response Content	matcher
manualRule	Manual Action	manualRuleContent
silentLog	Conditional Silent Log	—
ipMask	IP Log Masking	—
ipFix	IPFIX Log Sending	—
prometheusService	Provide Prometheus Service	—

The Fields Repeated in Many Types

The five fields below belong not to a single type but to many types. Their meanings are the same in every type; in which type they are found appears in the tables in the type sections.

Field	Panel label	Value
--cond	Action condition	The condition in which the action will be applied; it is built from the lb condition records
--ruleLoc	Execution level	atRequest · atResponse, default atRequest
--rulePro	Rule protocol	http · tcp, default http
--countHits	Hit counter	true · false, default false
--setVarOnHit	Set variable on hit	The traffic variable to be written when the action is applied

The Fields Specific to the Type

Every type is listed with its own fields. The required fields are written without a slash, the optional fields with the -- prefix; if there is a field starting with -- in the line, the required fields take -- as well. The panel label column is the equivalent of the same field in the interface.

The Header Actions

add_header — Add HTTP Header

Field	Status	Panel label	Value
headerNameToAdd	Required	Header to add	Text
headerContent	Required	Header content	Text
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

set_header — Set HTTP Header

Field	Status	Panel label	Value
headerNameToEdit	Required	Header to edit	Text
headerContent	Required	Header content	Text
headerNameToDelete	Required	Header to delete	Text
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

replace_header — Replace HTTP Header Content

Field	Status	Panel label	Value
headerNameToReplace	Required	Header to replace	Text
headerReplaceRegex	Required	Regex to match	Text
headerReplaceContent	Required	Replacement content	Text
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--headerReplaceType	Optional	Match type	replace-header · replace-value, default replace-header

del_header — Delete HTTP Header

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

headerFix — HTTP Header 1.0 Compatibility

Field	Status	Panel label	Value
--headerFixContent	Optional	Headers to fix	Text, default Accept Accept-Auth Accept-Encoding Ac…

keepHeaderNames — Keep Header Names

It has no field specific to the type; the type and the name are enough.

securityHeaders — Manage HTTP Security Headers

Field	Status	Panel label	Value
--securityHeaderOptions.N	Optional	Response headers	8 options (contentSecurityPolicy · strictTransportSecurity · xFrameOptions …)

cors — CORS

Field	Status	Panel label	Value
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--corsAllowedMethods	Optional	Allowed methods	Text, default *
--corsAllowedOrigins	Optional	Allowed origins	Text, default *
--corsAllowedHeaders	Optional	Allowed headers	Text, default *

The Cookie Actions

cookie_based — Cookie Based Connection Persistency

Field	Status	Panel label	Value
cookieName	Required	Cookie name	Text
--cookieAction	Optional	Cookie action	Selected from the list, default insert
--cookieHttpOnly	Optional	Mark as only HTTP	true · false, default false
--cookieSecure	Optional	Mark as secure	true · false, default false
--cookieDomain	Optional	Cookie domain	—
--cookieIndirect	Optional	Create indirectly	true · false, default true
--cookieNoCache	Optional	No cache	true · false, default true
--cookiePostOnly	Optional	Mark as post only	true · false, default false
--cookiePreserve	Optional	Preserve cookie	true · false, default false
--cookieDynamic	Optional	Cookie is dynamic	true · false, default true
--cookieMaxIdle.val	Optional	Max. idle time Value	A number (at least 0)
--cookieMaxIdle.unit	Optional	Max. idle time unit	Selected from the list, default ms
--cookieMaxLife.val	Optional	Max. life time Value	A number (at least 0)
--cookieMaxLife.unit	Optional	Max. life time unit	Selected from the list, default ms
--cookieAttr	Optional	Cookie attribute	Text

cookieSecurity — HTTP Cookie Security

Field	Status	Panel label	Value
--cookieSecurityOptions.N	Optional	Cookie security options	More than one is selected from the list

cookieEncryption — Cookie Encryption

Field	Status	Panel label	Value
--cookiesToEncrypt.N	Optional	—	Text

The Path and Redirection Actions

set_path — Set Path

Field	Status	Panel label	Value
newPath	Required	New path info	Text
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

set_pathq — Set Path + Query

Field	Status	Panel label	Value
newPath	Required	New path info	Text
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

normalize_uri — URL Normalization

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--normalizationOptions.N	Optional	Normalization	More than one is selected from the list, default ['percent-decode-unreserved']

req_redirect_location — Location Redirection

Field	Status	Panel label	Value
redirectLoc	Required	Redirect location	Text
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--redirectCode	Optional	Redirect code	9 options (300 · 301 · 302 …), default 300

redirect_scheme — Redirect to HTTPS

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--redirectSchemeCode	Optional	Redirect scheme code	9 options (300 · 301 · 302 …), default 300

error_redirect_at_tm — Redirect for Traffic Manager Errors

Field	Status	Panel label	Value
redirectLoc	Required	Redirect location	Text
--errorCodes	Optional	Error codes	67 options (400 · 401 · 402 …), default 400

error_redirect_at_res — Redirect for Backend Service Errors

Field	Status	Panel label	Value
redirectLoc	Required	Redirect location	Text
--errorCodes	Optional	Error codes	67 options (400 · 401 · 402 …), default 400

The Content Showing Actions

showContent — Show Content

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--contentProfile	Optional	Content page	Selected from the list, default builtin_denied_en
--statusCode	Optional	Status code	84 options (200 · 201 · 202 …), default 200

error_file_at_tm — Show Content for Traffic Manager Errors

Field	Status	Panel label	Value
--contentProfile	Optional	Content page	Selected from the list, default builtin_denied_en
--statusCode	Optional	Status code	84 options (200 · 201 · 202 …), default 200
--errorCodes	Optional	Error codes	67 options (400 · 401 · 402 …), default 400

error_file_at_res — Show Content for Backend Service Errors

Field	Status	Panel label	Value
--contentProfile	Optional	Content page	Selected from the list, default builtin_denied_en
--statusCode	Optional	Status code	84 options (200 · 201 · 202 …), default 200
--errorCodes	Optional	Error codes	67 options (400 · 401 · 402 …), default 400

The Blocking and Verification Actions

deny — Block

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--denyType	Optional	Deny type	Selected from the list, default deny
--denyStatusCode	Optional	Deny status code	84 options (200 · 201 · 202 …), default 403

quarantine_table — Quarantine

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--rulePro	Optional	Rule protocol	http · tcp, default http
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

advancedCaptcha — Advanced CAPTCHA

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--captchaType	Optional	Captcha Type	text · math · invisible, default text
--captchaDifficulty	Optional	Difficulty	1 · 2 · 3 · 4 · 5, default 3
--captchaLanguage	Optional	—	en · tr
--captchaTitle	Optional	Tab Title	Text
--captchaTheme	Optional	Theme	auto · light · dark, default auto
--captchaVerifiedTtl.val	Optional	Verification Duration Value	A number (at least 0), default 24
--captchaVerifiedTtl.unit	Optional	Verification Duration unit	Selected from the list, default h
--captchaSize	Optional	Size	small · medium · large, default medium
--captchaBgColor	Optional	Background Color	Text
--captchaTextColor	Optional	Text Color	Text

The fields that appear in the completion list but do not become active

The five fields below appear in the Tab list; their conditions are bound to the type field having the value captchaRule and, since this value is not in the action type set, the fields do not become active in any type.

Field	What it does	What is written after it
--captchaTimes	It is the field that determines how many times the verification will be asked for	It does not become active in this version
--blacklistTimeout.val · --blacklistTimeout.unit	They are the fields that determine how long the source taken into the blacklist will stay in the list	It does not become active in this version
--whitelistTimeout.val · --whitelistTimeout.unit	They are the fields that determine how long the source taken into the whitelist will stay in the list	It does not become active in this version

req_auth — User Authentication on HTTP Request

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--realm	Optional	Realm	Text, default Restricted

The Traffic Management Actions

bandwidthRule — Bandwidth Limitation

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--downloadLimit	Optional	Download limit	A number (at least 1, at most 33554432)
--uploadLimit	Optional	Upload limit	A number (at least 1, at most 33554432)
--bwLimitType	Optional	Limit type	dynamic · stream, default static
--bandwidthKeys.N	Conditional	Bandwidth group keys	It opens when --bwLimitType dynamic is written; the variables that determine the group

tcp_conn_mgmt — TCP Connection Management

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--tcpAction	Optional	Action	Selected from the list, default reject

http-reuse — HTTP/TCP Multiplexing

Field	Status	Panel label	Value
--connectionMode	Optional	Connection mode	keep-alive · server-close · close, default keep-alive
--reuseCode	Optional	Connection share strategy	never · safe · aggressive · always, default never

mirror — Traffic Mirroring

Field	Status	Panel label	Value
mirrorBackend	Required	Mirror target service	Selected from the list
--cond	Optional	Action condition	A condition expression
--mirrorSampling	Optional	Sampling	true · false, default false
--mirrorMaxBody	Optional	Maximum body size (KB)	A number (at least 1, at most 32768), default 256
--mirrorTimeout.val	Optional	Shadow response timeout Value	A number (at least 0), default 2
--mirrorTimeout.unit	Optional	Shadow response timeout unit	Selected from the list, default s
--mirrorMaxInflight	Optional	Concurrent copy limit	A number (at least 1, at most 65535), default 500
--mirrorAddXff	Optional	Add X-Forwarded-For header	true · false, default false
--mirrorScrubHeaders.N	Optional	—	Text
--mirrorSample	Conditional	Sampling percentage	It opens when --mirrorSampling true is written; between 0 and 100, default 10
--mirrorSampleKey	Conditional	Sampling key	It opens when --mirrorSampling true is written; according to which key the sampling will be done

The Inspection, Variable and Log Actions

set_variable — Create Traffic Variable

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--rulePro	Optional	Rule protocol	http · tcp, default http
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--varEntries.N.name	Optional	Variable name	—
--varEntries.N.value	Optional	Variable value	Text

advancedTrafficInspection — Advanced Traffic Inspection

Field	Status	Panel label	Value
trafficInspectionTag	Required	Traffic tag	Text
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--rulePro	Optional	Rule protocol	http · tcp, default http
--trafficKeys.N	Optional	Field to track	Text
--trafficPeriod.val	Optional	Tracking period Value	A number (at least 0), default 1
--trafficPeriod.unit	Optional	Tracking period unit	Selected from the list, default s
--trafficTableSize	Optional	Max. table size	A number (at least 5, at most 1000000), default 10000

modifyResponse — Modify Response Content

Field	Status	Panel label	Value
matcher	Required	Mask query	Text
--cond	Optional	Action condition	A condition expression
--modifyType	Optional	Modify type	mask · htmlTag · replace, default mask; the selected value opens the sub-fields
--matcherType	Optional	Query type	plain · regex, default plain
--omittedCharacters	Conditional	Omitted characters	It opens while --modifyType mask; the characters that will not be masked
--maskChar	Conditional	Masking character	It opens while --modifyType mask; default *
--maskOffset	Conditional	Masking tolerance	It opens while --modifyType mask; a number (at least 0), default 1
--maskFrom	Conditional	Min. occurrences for masking	It opens while --modifyType mask; a number (at least 1), default 1
--tagName	Conditional	HTML tag	It opens while --modifyType htmlTag: html · head · body · title
--tagModifyType	Conditional	Tag modify type	It opens while --modifyType htmlTag: append · prepend
--htmlContent	Conditional	HTML content to add	It opens while --modifyType htmlTag; the HTML content to be added
replacement	Conditionally required	New content	It becomes required while --modifyType replace; the content to be written instead
--matcherCaseSensitive	Conditional	Case sensitive	It opens while --modifyType mask or replace and --matcherType regex

manualRule — Manual Action

Field	Status	Panel label	Value
manualRuleContent	Required	Manual rule content	Text
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--manualRuleTarget	Optional	Manual rule field	global · defaults · frontend · defaultBackend · dynamicBackends, default global
--manualRulePriority	Optional	Manual rule priority	A number

silentLog — Conditional Silent Log

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--ruleLoc	Optional	Execution level	atRequest · atResponse, default atRequest
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text

ipMask — IP Log Masking

Field	Status	Panel label	Value
--countHits	Optional	Hit counter	true · false, default false
--setVarOnHit	Optional	Set variable on hit	Text
--ipMaskCidr	Optional	Masking(subnet)	A number (at least 0, at most 128), default 24

ipFix — IPFIX Log Sending

Field	Status	Panel label	Value
--ipFixIpPort.ip	Optional	—	Ip
--ipFixIpPort.port	Optional	—	Port
--ipFixType	Optional	Send type	enterprise · standard, default enterprise

prometheusService — Provide Prometheus Service

Field	Status	Panel label	Value
--cond	Optional	Action condition	A condition expression
--metricAddress	Optional	Metric address	Text, default /metrics

Examples

TR7 WEB-CLI · A) Adding a header and redirection

admin@TR7LBWAF01> lb action add type add_header name add-client-ip \

headerNameToAdd X-Client-IP headerContent <value>

admin@TR7LBWAF01> lb action add type req_redirect_location name redirect-old-address \

redirectLoc https://portal.kurum.com.tr/

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A type without an additional field

# the type and the name are enough, the behavior is set with the optional fields

admin@TR7LBWAF01> lb action add type redirect_scheme name redirect-https

admin@TR7LBWAF01> lb action add type deny name block

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) Traffic mirroring and binding to a vService

admin@TR7LBWAF01> lb action add type mirror name test-mirror mirrorBackend <backend> \

--mirrorTimeout.val 3 --mirrorTimeout.unit s

admin@TR7LBWAF01> lb service update id <vService> --rules.0 <action>

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

admin@TR7LBWAF01> lb action update id <id> --headerContent <new-value>

admin@TR7LBWAF01> lb action delete <id>

admin@TR7LBWAF01>  

Things to Know

• An action does not work without being bound to a vService. The binding is done with lb service update id <vService> --rules.N <action> and is valid only in the vServices of the HTTP and TCP types.
• It can be matched with a condition. In which traffic the action will be applied is determined with the lb condition records.
• The type can be changed later. When the type is changed in an update, the required fields of the new type have to be given as well.
• The duration fields are two parts. The timeout and duration fields are written in the form --field.val and --field.unit.
• The field list opens together with the type. After the type is written, -- with Tab lists only the fields of that type; when ? is put at the end of the line, the explained table of the fields comes.