# iRules vs LTM policy classifier > Per when block, an honest verdict: expressible in an LTM policy (with a migration sketch in the vendor's own example grammar), verify on your version, or iRule-required with the blockers named. Policies are the no-programming layer; this tool tells you which blocks belong there. - Tool: https://ronutz.com/en/tools/f5-irules-vs-ltm-policy - Family: Networking --- # iRules vs LTM Policy classifier The vendor ships its Local Traffic Policies examples in both forms, policy and equivalent iRule, because the two genuinely overlap. The question worth automating is which of your when blocks live in the overlap. Paste an iRule and each block gets one of three verdicts, and only three, because honesty needs a middle bucket. Policy-expressible means every construct maps onto grammar the vendor's own 12.1 examples demonstrate: http-uri, http-header, and http-cookie conditions with equals, contains, starts-with, and ends-with; forwarding to a pool or resetting; log write, tcl: substitution included; header replace and insert; compression enable. Those blocks come with a migration sketch in exactly that grammar, marked for validation with tmsh. Verify-on-version means the constructs are plausibly covered on current releases but the sources this tool verified did not demonstrate them; HTTP::redirect is the canonical resident, and the tool says check your version's condition and action lists instead of guessing. iRule-required names the blockers: events beyond the HTTP request and response pair, Tcl loops and procedures, regex logic (the verified grammar matches with operand lists, not patterns), variables (policies have none; the tcl: substitution inside an action is the narrow documented exception), table and session state, sideband connections, payload collection, timers. The strategies keyword renders the three matching strategies with the ltm policy-strategy reference's own semantics: first-match terminates the engine on the first matching condition; all-match executes actions for everything that matches; best-match lets the more specific match win, ties falling through to the built-in precedence table whose head the tool reproduces. Why migrate what can migrate: LTM Policy, native to BIG-IP LTM - Local Traffic Manager, is the layer the sources describe as highly performant and, unlike iRules, requiring no programming, and none of the iRule CMP-demotion hazards exist inside a policy. The migration mechanics per the Getting Started manual: draft, publish, attach to the virtual. Everything runs locally; nothing you paste leaves the page. ## Standards and references - [F5 TMSH Reference: ltm policy-strategy (first-match / all-match / best-match semantics verbatim; the built-in precedence table; user-defined strategies)](https://clouddocs.f5.com/cli/tmsh-reference/v14/modules/ltm/ltm_policy-strategy.html) - the strategies mode's semantics and precedence head - [BIG-IP Local Traffic Management: Getting Started with Policies 12.1 - the examples chapter (the policy grammar this tool's verified sets and sketches reproduce; the vendor's own iRule-equivalent examples; draft/publish/attach lifecycle)](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/local-traffic-policies-getting-started-12-1-0/2.html) - the policy-expressible grammar sets, the tcl: substitution exception, the sketch shape - [F5 DevCentral: LTM Policy - Matching Strategies (policy anatomy: rules as condition/action if-thens; the no-programming, highly performant framing; best-match tie-breaking)](https://community.f5.com/t5/technical-articles/ltm-policy-matching-strategies/ta-p/276312) - the summary's performance framing and tie-break narrative - [F5 iRules API Reference: CMP Compatibility (the demotion hazards a policy migration retires)](https://clouddocs.f5.com/api/irules/CMPCompatibility.html) - the global-variable blocker's CMP note ## Related reading - [CMP: The Cores You Paid For, and the iRule Lines That Give Them Back](https://ronutz.com/en/learn/bigip-cmp-clustered-multiprocessing.md): Clustered multiprocessing runs one TMM per core and spreads flows across them. A demoted virtual server runs everything on TMM0. The demotion list is short and documented: global variables above all, with static:: as the cure, plus two per-TMM traps (RULE_INIT keys, statistics profiles) that do not demote but quietly break assumptions.