Technical Tip: How to use LUA script for content routing with the matching of the user's IP address

[kmak]

Description	This article describes using the LUA script to match the user's IP address for content routing.
Scope	FortiADC.
Solution	Prerequisite: FortiADC version 7.6.0 and above. The user's IP does not source NAT from upstream. FortiADC Server Load-Balance (SLB) supports content routing based on clients’ IP addresses. Each content routing policy can only match 1 single IP address or 1 subnet address. If there is more than one single IP address or subnet range address, it is required to create multiple content routing policies for each IP address or subnet range address. Alternatively, it is possible to use a LUA script to do content routing for the FortiADC SLB. First, create the Content Routing Policy in the FortiADC SLB settings. Assign the respective real server pool to the Content Routing Policy. Leave the matching condition empty in the Content Routing Policy.                                     Create a SLB script in FortiADC -> Server Load Balance -> Scripting.                                                         Insert the below scripts into the FortiADC new script. when RULE_INIT{ --initialize the address group here --for IPv4 address, mask can be a number between 0 to 32 or a dotted format --support both IPv4 and IPv6, for IPv6, the mask is a number between 0 and 128 --for each IP address/subnet, add into new line of addr_group= addr_group = "192.168.0.0/24" addr_group = addr_group..",192.168.1.128/27" addr_group = addr_group..",10.253.0.22/32" } when HTTP_REQUEST{ client_ip = HTTP:client_addr() matched = cmp_addr(client_ip, addr_group) if matched then LB:routing("sp1") else LB:routing("sp2") end } In the sample script, it will match the user's IP address to the 3 IP address groups, the range 192.168.0.0/24, 192.168.1.128/27, and 10.253.0.22/32. More IP addresses or subnet ranges can be added by adding the 'addr_group=' below each addr_group. For IP address matching with the IP groups, the script will route the request to the sp1 content routing policy (server pool in sp1), else it will be routed to sp2. In the FortiADC SLB Virtual Server, enable Content Routing and select the created Content Routing Policy.                                               In the General tab, enable Scripting and select the script that has been created for the content routing.                                                        Test browsing the Virtual Server and check out the traffic log to verify the HTTP request content routing.                                                    Related document: LUA script for content routing