Last Modified: Oct 16, 2026
Affected Product(s):
BIG-IP PEM
Fixed In:
17.1.3.6
Opened: Feb 26, 2025 Severity: 3-Major
You can not use an iRule to look up the SNI/hostname from SSL, HTTP, and QUIC traffic.
You are unable to look up the SNI or hostname.
You need to look up the SNI/hostname in an iRule
None
The new iRule 'CLASSIFICATION::sni' has been implemented to extract the SNI/Hostname from SSL, HTTP, and QUIC traffic. Users can configure the iRule to take action on matched SNIs based on their specific use cases. Steps to configure: Go to Policy Enforcement > Policies > Create > Give Name > Create & Add rule > give name, precedence > select Custom and add below irule set sni [CLASSIFICATION::sni] log local0.debug "Classification SNI: $sni" set result [CLASSIFICATION::result] log local0.debug "Classification result: $result" and keep Gate status > Enabled > Finished Go to Policy Enforcement > Profiles > spm > Global Policy bring your pem policy to left > Update Go to Virtual Servers > Configuration: Advanced > Classification Profile: classification_pem > Policy Enforcement Profile: spm > Update With this config send traffic from client you can see logs in LTM LTM logs: Sep 3 22:11:30 bigip.com debug tmm[xxxx]: Rule myrule <TCL_SCRIPT>: Classification SNI: google.com Sep 3 22:11:30 bigip.com debug tmm[xxxx]: Rule myrule <TCL_SCRIPT>: Classification result: tcp http google