lb condition

The lb condition command creates the conditions that determine in which traffic an action will be applied. A condition does nothing on its own: when it is bound to an action or to a profile, it makes that work run only on the matching requests. Its panel equivalent is the Conditions section.

The first field written is criteria

What will be looked at is selected first; this selection determines which fields will be asked for. No other field is listed until the criterion is written.

Command Summary

TR7 WEB-CLI · lb condition

# Tab after the command

admin@TR7LBWAF01> lb condition

add delete list show update

 

admin@TR7LBWAF01> lb condition list # list all of them

admin@TR7LBWAF01> lb condition show <id> # show one

admin@TR7LBWAF01> lb condition add criteria <criterion> … # new condition

admin@TR7LBWAF01> lb condition update id <id> … # change

admin@TR7LBWAF01> lb condition delete <id> # delete

admin@TR7LBWAF01>  

Writing Order

Step 1 Select the criterion

There are forty-two criteria; Tab lists them all. lb condition add criteria path

Step 2 Write the required fields of the criterion

Fields such as the value to be searched, the header name and the cookie name are asked for according to the criterion.

Step 3 Add the matching form and the name

--content_placement start --name admin-path

Step 4 Bind it to an action

lb action update id <action> --cond <condition>

Required Fields

The criterion is a discriminator in this command: the CLI first asks for criteria, then asks for the required fields of that criterion in order. The required fields specific to the criterion are written without a prefix even if the field starts with -- in the line, and no field starting with -- is accepted until they are all completed. In the criteria that are not in the list there is no additional required field.

Order	Field	Status	Value
1	criteria	Required	One of the forty-two criteria; Tab lists them
2	query	Conditionally required	The value to be searched in the req_body · res_body · query_param · path · pathq · url criteria
2 · 3	headerName · query	Conditionally required	http_header; the header name and the value to be searched
2 · 3	cookieName · query	Conditionally required	user_cookie · be_cookie; the cookie name and the value to be searched
2 · 3	rdpCookieName · query	Conditionally required	rdp_cookie; the RDP cookie name and the value to be searched
2 · 3	mapKey · mapContent	Conditionally required	custom_map; the key to be searched and the list content
2	acceptLanguage	Conditionally required	accept_language; the language code
2 · 3	srcIpType · country · city · src · asn	Conditionally required	src_ip; first the type, then the country, the city, the address or the ASN according to the type
2	dst	Conditionally required	dst; the destination address
2	manualCondContent	Conditionally required	manualCond; the condition expression
2 · 3	smartVar · smartOperator	Conditionally required	smartCond; the variable and the operator. Then the value field of the operator is asked for (see Dynamic Conditions)
2 · 3	agsVar · agsOperator	Conditionally required	agsCond; the variable and the operator. Then the value field of the operator is asked for
4 · 5	smartStrRefValue · staticStrRefValue · staticRegexRefValue · smartIntRefValue · smartIntRefFrom · smartIntRefTo · staticIpCidrRefValue.ip · staticIpCidrRefValue.cidr	Conditionally required	smartCond and agsCond; the value field of the selected operator. Which one will be asked for is in the Dynamic Conditions table; in the bool operator there is no value field

The Fields That Can Be Found in Every Criterion

Field	What it does	What is written after it
--name	Gives a name to the condition; a named condition can be selected from other places	The name of the condition. It is not required
--content_placement	Determines how the searched value will match	exactMatch exact match (default) · start starts with · end ends with · sub contains · regex regular expression · found looks only at the existence of the field
--caseInsensitive	Removes the distinction between uppercase and lowercase in the matching	true · false (default false)
--condLoc	Selects whether the condition will be evaluated in the request or in the response	atRequest (default) · atResponse
--condPro	Selects at which stage the condition will be evaluated	atRequest (default) · atResponse

In which criterion these fields open depends on the type of the criterion: the matching form and the case sensitivity appear only in the criteria that search text, and --condLoc and --condPro only in the criteria whose stage can be selected.

The Criteria

In the tables below all forty-two criteria are given with their required and criterion-specific optional fields. The common fields above are not written again.

The Criteria That Match Content

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
path	Path	query	—
pathq	Path + query	query	—
url	URL	query	—
query_param	Query parameter	query	—
http_header	HTTP header	headerName · query	—
user_cookie	User cookie name	cookieName · query	—
be_cookie	Server cookie name	cookieName · query	—
rdp_cookie	RDP cookie	rdpCookieName · query	—
req_body	HTTP request body	query	--bodySize
res_body	HTTP response body	query	--bodySize

The Criteria That Recognize the Client

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
browser	Browser	—	--browserName.N
operatingSystem	Operating system	—	--operatingSystem.N
mobile	Mobile platform	—	--mobilePlatform.N
bot	Bot type	—	--botType.N
nettype_group	Network type group	—	--nettypeGroup.N
nettype_category	Network type category	—	--nettypeCategory.N
blacklist_ip_category	Blacklist IP category	—	--blacklistIpCategory
accept_language	Client language preference	acceptLanguage	--acceptLanguageCompare.N

The Address and Port Criteria

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
src_ip	Source IP	srcIpType → country · city · src · asn according to the type	—
dst	Destination IP	dst	—
dst_port	Destination port	—	--dst_port.op · --dst_port.val

The Numeric Criteria

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
status	Status code	—	--status_op.op · --status_op.val
resp_time	Server response time	—	--resp_time_op.op · --resp_time_op.val
nbsrv	Number of active servers	—	--nbsrv_op.op · --nbsrv_op.val
req_size	Request size (bytes)	—	--req_size_op.op · --req_size_op.val
res_size	Response size (bytes)	—	—
fe_conn	Frontend connection	—	--fe_conn_op.op · --fe_conn_op.val
fe_sess_rate	Frontend number of new sessions / s	—	--fe_sess_rate_op.op · --fe_sess_rate_op.val
fe_req_rate	Frontend number of HTTP requests / s	—	--fe_req_rate_op.op · --fe_req_rate_op.val

The TLS Criteria

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
ssl_fc_cipher	SSL cipher	—	—
ssl_fc_protocol	SSL version	—	—
ssl_fc_sni	SSL SNI info	—	—

The Identity and WAF Criteria

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
http_auth	User authentication	—	--userPassPairs.N.username · --userPassPairs.N.password
waf_attack_id	WAF attack ID	—	--wafAttackIds.N
waf_attack_group	WAF attack group	—	--wafAttackGroups.N

The List and Dynamic Criteria

criteria	Panel equivalent	Required fields	Optional fields specific to the criterion
url_list	Response based URL list	—	—
custom_map	Dynamic list	mapKey · mapContent	--mapMethod
manualCond	Manual condition	manualCondContent	—
smartCond	Dynamic condition	smartVar · smartOperator	—
agsCond	AGS condition	agsVar · agsOperator	—
trackingCond	Tracking condition	trackingCondCriteria · trackingCondOp.val · trackingTableTag	--trackingCondOp.op
quarantineCond	Quarantine condition	trackingCondCriteria · trackingCondOp.val	--trackingCondOp.op

The Equivalents of the Criterion Fields

Field	What it does	What is written after it
query	Carries the value to be searched	The searched text; how it will match is determined by --content_placement
headerName	Determines which HTTP header will be looked at	The header name, for example X-Forwarded-For
cookieName	Determines which cookie will be looked at	The cookie name
rdpCookieName	Determines which RDP cookie will be looked at	The RDP cookie name
--bodySize	Limits how many bytes of the body will be parsed	The number of bytes
--browserName.N · --operatingSystem.N · --mobilePlatform.N · --botType.N	Looks at which browser, operating system, mobile platform or bot type the client is	The values selected from the list; each with its own index
--nettypeGroup.N · --nettypeCategory.N	Looks at the network type group or the category of the source address	The values selected from the list
--blacklistIpCategory	Looks at which blacklist category the source address is in	The category value
acceptLanguage	Looks at the language preference of the client	The language code
--acceptLanguageCompare.N	Determines the additional languages to be compared	The language codes
srcIpType	Selects how the source address will be determined	country according to the country · city according to the city · manual the address written by hand · asn according to the autonomous system number
country · city · src · asn	Carries the value to be compared according to the selected type	The country, the city, the address or the ASN; which one will be asked for is determined by srcIpType
dst	Looks at the destination address	The IP address
--dst_port.op · --dst_port.val · --dst_port.val2	Compares the destination port with a threshold or with a range	The operator (default =), the number and the upper limit in a range
--status_op.op · --status_op.val · --status_op.val2	Compares the status code of the response	The operator, the number and the upper limit in a range
--resp_time_op.op · --resp_time_op.val · --resp_time_op.val2	Compares the response time of the backend	The operator, the time value and the upper limit in a range
--nbsrv_op.op · --nbsrv_op.val · --nbsrv_op.val2	Compares the number of servers that are up	The operator, the number and the upper limit in a range
--req_size_op.op · --req_size_op.val · --req_size_op.val2	Compares the request size	The operator, the number of bytes and the upper limit in a range
--fe_conn_op.op · --fe_conn_op.val · --fe_conn_op.val2	Compares the number of connections on the listening side	The operator, the number and the upper limit in a range
--fe_sess_rate_op.op · --fe_sess_rate_op.val · --fe_sess_rate_op.val2	Compares the number of new sessions per second	The operator, the number and the upper limit in a range
--fe_req_rate_op.op · --fe_req_rate_op.val · --fe_req_rate_op.val2	Compares the number of requests per second	The operator, the number and the upper limit in a range
--userPassPairs.N.username · --userPassPairs.N.password	Defines the users that will be accepted in the basic authentication	The user name and the password; every pair with its own index
--wafAttackIds.N · --wafAttackGroups.N	Looks at the attack id or the group that WAF has marked	The id or the group values
mapKey · mapContent	Determines which key will be searched in which list in the dynamic list	The key to be searched and the list content
--mapMethod	Selects the form of the dynamic list search	exactMatch (default) · start · end · sub · regex · ip
manualCondContent	Writes the condition directly as an expression	The condition expression
smartVar · agsVar	Determines which variable will be looked at in the dynamic condition	The variable name
trackingCondCriteria	Selects which measure will be tracked in the tracking table	The tracking criterion
trackingCondOp.val · --trackingCondOp.op · --trackingCondOp.val2	Compares the tracked measure with a threshold or with a range	The number, the operator (default =) and the upper limit in a range
trackingTableTag	Determines which tracking table will be looked at	The table tag; it is asked for only in the trackingCond criterion

The Numeric Comparison Fields

All the numeric criteria use the same three-part structure: the operator, the value and, when the range operator is selected, the second value.

Part	What it does	What is written after it
--<criterion>_op.op	Selects the comparison operator	= equal (default) · < smaller · > greater · - range. Since it contains a sign, it is written inside double quotes
--<criterion>_op.val	Gives the value to be compared	A number; it is the lower limit in a range
--<criterion>_op.val2	Gives the upper limit of the range	A number; it opens only when --<criterion>_op.op "-" is written

The fields that use this structure: status_op · dst_port · resp_time_op · nbsrv_op · req_size_op · fe_conn_op · fe_sess_rate_op · fe_req_rate_op · trackingCondOp. For example, in order to search the status code between 500 and 599, --status_op.op "-" --status_op.val 500 --status_op.val2 599 is written.

Dynamic Conditions: The Operator and the Value Field

In the smartCond and agsCond criteria first the variable to be looked at (smartVar or agsVar), then the operator is written. Which field the value will be written to is determined by the selected operator.

Operator	What it does	Value field
strEq	Is the text exactly equal	smartStrRefValue
strSub	Does the text contain	staticStrRefValue
strStart	Does it start with the text	staticStrRefValue
strEnd	Does it end with the text	staticStrRefValue
strRegex	Does it match the regular expression	staticRegexRefValue
intEq	Is the number equal	smartIntRefValue
intGt	Is the number greater	smartIntRefValue
intLt	Is the number smaller	smartIntRefValue
intRange	Is the number between two values	smartIntRefFrom and smartIntRefTo
bool	Is the value true	There is no value field
ipCidr	Does the address fall into the given network	staticIpCidrRefValue.ip and staticIpCidrRefValue.cidr

The moment the operator is written, the related value field becomes required and is written without a prefix; the other value fields drop from the list.

Examples

TR7 WEB-CLI · A) Path and header conditions

# the requests that start with /yonetim

admin@TR7LBWAF01> lb condition add criteria path query /yonetim \

--content_placement start --name admin-path

 

# the requests that carry a certain API key

admin@TR7LBWAF01> lb condition add criteria http_header headerName X-API-Key query <value> \

--caseInsensitive true --name api-key

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) Source address and numeric criterion

# the source address according to the country

admin@TR7LBWAF01> lb condition add criteria src_ip srcIpType country country <country> --name abroad

 

# the response time threshold; since the operator contains a sign it is quoted

admin@TR7LBWAF01> lb condition add criteria resp_time --resp_time_op.op ">" --resp_time_op.val 2000 \

--name slow-response

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) A dynamic condition and binding it to an action

# when the ipCidr operator is selected, the address and mask fields open

admin@TR7LBWAF01> lb condition add criteria smartCond smartVar <variable> smartOperator ipCidr \

staticIpCidrRefValue.ip 10.0.0.0 staticIpCidrRefValue.cidr 8 --name internal-network

 

admin@TR7LBWAF01> lb action update id <action> --cond <condition>

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

admin@TR7LBWAF01> lb condition update id <id> --query /panel

admin@TR7LBWAF01> lb condition delete <id>

admin@TR7LBWAF01>  

Things to Know

• A condition does not work on its own. It comes into play when it is bound to an action (lb action → --cond), to a cache rule or to a profile field.
• The name is not required. A condition without a name can also be created; however, giving a name makes it easier for it to be selected from other places.
• The operator values require quotes. Signs such as > and < carry a special meaning for the parser on the command line; they are written inside double quotes.
• The operator determines the value field. In the dynamic conditions, when the operator changes, the previous value field drops from the list and the new one becomes required.
• The matching form is not found in every criterion. --content_placement and --caseInsensitive appear only in the criteria that search text.