ronutz
← Tools

iRule event order

Pick the profile stack on a BIG-IP virtual server — client-SSL, HTTP, server-SSL, pool — and see the order the common iRule events fire, from CLIENT_ACCEPTED to CLIENT_CLOSED, as a timeline and a list. All in your browser.

Virtual server profile stack

Presets:

Computed in your browser. Nothing is sent anywhere.

A model of documented F5 behavior for a Standard virtual server. It never contacts a BIG-IP.

Event sequence

client sideserver sideglobal
1CLIENT_ACCEPTEDConnection setup · client side2CLIENTSSL_CLIENTHELLOClient-side TLS · client side3CLIENTSSL_HANDSHAKEClient-side TLS · client side4HTTP_REQUESTRequest · client side5LB_SELECTEDLoad balancing · global6SERVER_CONNECTEDServer-side setup · server side7SERVERSSL_HANDSHAKEServer-side TLS · server side8HTTP_REQUEST_SENDSend to server · server side9HTTP_RESPONSEResponse · client side10SERVER_CLOSEDTeardown · server side11CLIENT_CLOSEDTeardown · client side

Events in order

  1. CLIENT_ACCEPTEDclient side

    A client connection is established. On a Standard virtual server this is when the TCP three-way handshake completes; on FastL4 it fires on the initial SYN.

  2. CLIENTSSL_CLIENTHELLOclient side

    The client's TLS ClientHello has been received, before the handshake is processed. Useful for SNI-based decisions.

  3. CLIENTSSL_HANDSHAKEclient side

    The client-side TLS handshake has completed successfully.

  4. HTTP_REQUESTclient side

    The system has fully parsed the complete client HTTP request headers.

  5. LB_SELECTEDglobal

    The system has selected a pool member for the connection.

  6. SERVER_CONNECTEDserver side

    The server-side connection to the selected pool member has been established.

  7. SERVERSSL_HANDSHAKEserver side

    The server-side TLS handshake has completed successfully.

  8. HTTP_REQUEST_SENDserver side

    Immediately before the HTTP request is sent to the server-side TCP stack. Runs in the server-side context.

  9. HTTP_RESPONSEclient side

    The system has parsed all of the response status and header lines from the server response.

  10. SERVER_CLOSEDserver side

    The server-side connection has been closed.

  11. CLIENT_CLOSEDclient side

    The client-side connection has been closed.

Conditional events

These fire only under specific conditions: a TCP::collect or HTTP::collect, a load-balancing failure, or a 100 Continue response.

  • HTTP_REQUEST_DATA↪ HTTP_REQUEST

    After an HTTP::collect has gathered the specified amount of request payload.

  • LB_FAILED↪ LB_SELECTED

    Instead of LB_SELECTED, when the system fails to select a pool or member, or the selected resource is unreachable.

  • HTTP_RESPONSE_CONTINUE↪ HTTP_RESPONSE

    Before HTTP_RESPONSE, whenever the server sends a 100 Continue interim response.

  • HTTP_RESPONSE_DATA↪ HTTP_RESPONSE

    After an HTTP::collect has gathered the specified amount of response payload.

  • Within a single event, multiple iRules run by priority (default 500, lowest number first); the priority command overrides that. This ordering is across events, not within one.
  • Availability also depends on provisioning: module events (APM ACCESS_*, ASM/Advanced WAF, bot defense) only fire when that module is provisioned. And CLIENT_DATA, SERVER_DATA, HTTP_REQUEST_DATA, and HTTP_RESPONSE_DATA need an explicit TCP::collect or HTTP::collect first.

References