What are Condition and Action, and what are they used for?

Short answer

Condition checks a property of the traffic (source IP, path, header, country…) and returns true or false; Action performs an operation on the traffic (blocking, redirection, adding a header…). Together, they are TR7's counterpart of iRules and LTM policies in F5 or Responder / Rewrite policies in NetScaler; rules are defined from the interface without writing scripts. When an Action is created on its own, it does not affect any traffic; it runs when it is added to the Actions list of a vService, and if a condition is attached, it is applied only when the condition is met.

How Does It Work?

1. The condition is defined. On the Load Balancer → Conditions screen, the property to be checked (Criteria) and the value are entered. A condition does nothing on its own.
2. The action is defined and the condition is attached. On the Load Balancer → Actions screen, the action type is selected; in the Conditions field, the conditions under which it runs are specified. Multiple conditions are combined with and (all must be true) or or (at least one must be true). At this stage, too, the action does not yet affect any traffic.
3. The action is added to the vService. It takes effect once it is added to the Actions list in the vService form and saved. Whether the action is applied to the request or to the response is determined by Execution Level: On Request (before the request goes to the Backend Service) or On Response (before the response returns to the client); for action types that run in only one stage, this field is not shown.
4. The conditions are evaluated. If the result is true, the action is applied; if it is false, the action is skipped and processing moves on to the next action. An action with no condition attached runs on all the traffic of the vService.
5. Actions are processed in order. Actions run from top to bottom in the list on the vService. If an action blocks or redirects the request, the subsequent actions do not run for that request.

Examples:

Condition	Action	Result
Path starts with /admin and Source IP is not the office network (!Ofis-agi)	Block	The management panel is accessible only from the office
Source IP → Country = a specific country	Location Redirection	Visitors from that country are redirected to another address
None (unconditional)	Manage HTTP Security Headers	Security headers are added to all responses

Conditions are not used only in actions: they are also used in the Conditional Backend Services (Content Switching) section of the vService to send traffic that matches a condition to different Backend Services.

Comparison

	Condition	Action
Question it answers	When?	Do what?
Its result	True / false	An operation on the traffic
Where it is attached	To an action, to Conditional Backend Services or to the condition fields in security profiles	To the Actions list of the vService
Effect on its own	None; it becomes meaningful when attached to an action or a routing rule	None; it runs when added to a vService. An action added without a condition is applied to all the traffic of that vService; Location Redirection and User Authentication (On HTTP request), however, never run without a condition attached
Industry counterpart	The condition within an iRule / policy (F5 LTM policy condition, NetScaler policy expression)	The action within an iRule / policy (F5 LTM policy action, NetScaler Responder / Rewrite action)
Example types	Source IP, Path, HTTP Header, Browser, SSL SNI Info	Block, Location redirection, Add HTTP Header, Quarantine, Show Content

Condition and Action in TR7

• Creation: They are added from the Load Balancer → Conditions and Load Balancer → Actions screens; an action is put into effect by selecting it from the Actions list in the vService form and saving.
• Reuse: A condition is used in multiple actions and vServices; a change made to it is reflected everywhere it is used. Where it is used is seen in the Used in tab of the preview panel.
• Automatic negation (NOT): Each condition is offered in selection lists with two options, itself and its negation; the negation is shown with ! at the beginning of its name (e.g. !Ofis-agi). There is no need to define a separate condition for "if not".
• vService type: Conditions and actions are used in HTTP and L7 TCP vServices; they are not available in Network vServices. The vService types in which each type can be used are stated on the relevant condition and action page in the docs.

Common Misconceptions

• "Creating the action is enough." An action does not affect any traffic until it is added to the Actions list of a vService and saved.
• "Conditions are case-insensitive." By default, they are case-sensitive (/Admin ≠ /admin); if no distinction is wanted, the Case Insensitive option is turned on.
• "Even if an action blocks the request, the subsequent actions run." The actions that come after a blocking or redirecting action do not run for that request; this is why ordering matters.
• "Conditions and actions exist in every vService type." They are used only in HTTP and L7 TCP vServices.

How it is done in the documentation

• Conditions · What Are Conditions?
• Conditions · How Conditions Work
• Actions · What Are Actions?
• Actions · How Actions Work

Related questions

• What is the difference between a Condition and an Action?
• How do I combine multiple conditions with AND / OR?
• In what order do Actions run; how do I change the order?
• What is Content Switching?