Creating Custom Classifications

 **Note:** Entries in feed lists must consist of all lowercase characters. Also, any entry of the form www.*tld* or www.*domain*.com will not match.

</td></tr><tr id="GUID-99010A1E-E274-4DF8-AADD-4BCF4F75BA2D"><td id="d15061e710">

**__FTP__**

</td><td>

Type the ftp location and the **User** and **Password**.

</td></tr><tr id="GUID-11A47361-07D5-406E-807C-F5DE0C37CA81"><td id="d15061e724">

**__HTTP__**

</td><td>

Type the HTTP location and the **User** and **Password**.

</td></tr><tr id="GUID-02C0F4AF-B51E-4DB5-BB90-6A673893CD55"><td id="d15061e738">

**__HTTPS__**

</td><td>

Type the HTTPS location and the **User** and **Password**.

</td></tr></tbody>
</table>

8.  In the **Poll Interval** field, type the time interval in hours at which the url needs to be polled.

9.  Click **Finished**.

The category lookup is done in the custom database, and the URL list is loaded into the custom database through file input. You can also perform URL categorization by looking up the server name indication \(SNI\) in SSL traffic.

### Using iRules with classification categories and applications {#GUID-27FEE4BE-153F-403F-A302-CBE5702AEEE9}

If you are using custom classification categories or applications, you can use iRules to identify the traffic for the custom classifications, or you can initiate an action based on how the traffic is classified.

1.  On the Main tab, click **Local Traffic** &gt; **iRules**.

2.  Click **Create**.

3.  In the **Name** field, type a 1- to 31-character name.

4.  In the **Definition** field, type the syntax for the iRule using Tool Command Language \(Tcl\) syntax.

    For example, to classify traffic as `xxx_app`, a custom classification application that you created, you can use this iRule:

    ```
    when HTTP_REQUEST {
                            if { [HTTP::header "Host"] contains "xxx" }  {  
                            CLASSIFY::application set xxx_app 
                            }  
                            }  
                            } 
                        
    ```

    For example, to perform an action \(in this case, drop\) on traffic classified as `xxx_app`, you can use this iRule:

    ```
    when CLASSIFICATION_DETECTED {
                            if { [CLASSIFICATION::APP == "xxx_app"]}  {  
                            drop 
                            }  
                            } 
                        
    ```

    For complete and detailed information about iRules syntax, see the F5 Networks DevCentral web site `http://devcentral.f5.com`.

5.  Click **Finished**.

After creating the iRules, you must assign them as resources for each relevant virtual server on the BIG-IP system.

### Modifying iRule event for URL categories {#GUID-FA4D6269-BCDF-4CFE-BC05-978B0F93F8D4}

On the BIG-IP system, you can modify iRules Event settings for URL categories.

1.  On the Main tab, click **Traffic Intelligence** &gt; **Categories** &gt; **Category List**.

2.  Select a URL category.

    The URL Properties screen opens.

3.  In the **Name** field, type a unique name for the URL category policy.

4.  In the **Description** field, type optional descriptive text for the classification presets.

5.  In the **Category ID** field, type an identifier for this category, a unique number.

6.  For the **Application List** setting, move applications that you want to associate with this category from the **Unknown** list to the **Selected** list.

    If the applications are not listed yet, you can associate the applications with the category when you create them.

7.  Click **Finished**.

8.  On the Main tab, click **Local Traffic** &gt; **Profiles** &gt; **Classification**.

    The Classification screen opens.

9.  Select a classification profile or create one.

10. From the **URL Categorization** field, select **Enabled** from the drop-down list.

11. In the **iRule Event** field, select the appropriate setting.

    -   To trigger an iRule event for this category of traffic, select **Enabled**. You can then create an iRule that performs an action on this type of traffic.
    -   If you do not need to trigger an iRule event for this category of traffic, select **Disabled**.
    **Note:** `CLASSIFICATION::DETECTED` is the only event that is supported.

You have modified an iRule event setting for an existing URL category.

## Classification iRule commands {#GUID-26204546-A699-428E-BF9F-C949F9C2AE49}

When the BIG-IP system identifies a specific type of traffic with iRules enabled, it triggers a `CLASSIFICATION_DETECTED` event. You can use the commands within iRules for additional system flexibility to classify the flow as one or more of the application or category classifications. The `CLASSIFY` commands are available from the `HTTP_REQUEST` or `HTTP_RESPONSE` iRule events.




















    

  

      

          
iRule Command
          
Description
      
  
  

      

          
CLASSIFICATION::app
          
Gets the name of the classified application (the most explicit classified application).
      
      

          
CLASSIFICATION::category
          
Gets the category of the application.
      
      

          
CLASSIFICATION::disable
          
Disables the classification for a flow.
      
      

          
CLASSIFICATION::enable
          
Enables the classification for a flow.
      
      

          
CLASSIFICATION::protocol
          
Gets the name of the classified protocol (the least explicit classified application).
      
      

          
CLASSIFY::application set appname
          
Classifies the flow as appname and associates the category that appname belongs to.
      
      

          
CLASSIFY::category set catname
          
Classifies the flow as catname and also associates the flow with the unknown category.
      
      

          
CLASSIFY::application add appname
          
Adds the application appname to the classification statistics.
      
      

          
CLASSIFY::category add catname
          
Adds the category catname to the classification statistics.