topic Re: StorageGrid Traffic Classification - AND matching rules instead of OR in Object Storage

StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Wed, 04 Jun 2025 09:53:03 GMT

Is there an easy way to create a traffic classification policy that does AND instead of OR on the matching rules? I'd like to match if clients from a certain CIDR are hitting a sub-optimal endpoint.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

elementx — Tue, 14 Feb 2023 02:21:43 GMT

Have you tried? Is it not possible? Or not easy?

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Tue, 14 Feb 2023 14:19:52 GMT

As documented, it's an OR of all conditions, and I've confirmed that. (https://docs.netapp.com/us-en/storagegrid-116/admin/creating-traffic-classification-policies.html -- "Traffic that matches any rule is included in the policy.") It also has inverse matches, and thinking back to a logic course many years ago, I was hoping I could leverage that, but it looks like I need more levels of NOT than available.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

elementx — Tue, 14 Feb 2023 15:19:24 GMT

Right, so if your "allow" IPs are all over the place and there are many, then it may not be possible.

In that case I'd try to keep rules in a flat file and commit them with Ansible with SG modules?

I haven't looked if the module that can set the rules is available. If not, just write a shell script loop with curl and process manually crafted request template, perhaps?

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Tue, 14 Feb 2023 15:20:12 GMT

Right now, I'm trying with even just one and no success.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

elementx — Tue, 14 Feb 2023 15:35:15 GMT

Just one rule or just one Ansible/curl script?

If you're in the mood to try Discord, there may be some folks online for available for real-time chat.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Tue, 14 Feb 2023 15:36:53 GMT

Just one IP hitting one wrong endpoint.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

elementx — Tue, 14 Feb 2023 16:31:49 GMT

🤔

Maybe there's a bug? If you could share your rule, someone from the SG team could try on a real SG (or maybe even tell you if the rule's not correct).

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Tue, 14 Feb 2023 16:35:44 GMT

It doesn't look like a bug -- it's operating as designed. Just not designed the way we want to use it.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

elementx — Tue, 14 Feb 2023 17:05:27 GMT

I thought you used a NOT rule and tried to access from an allowed address.

Re: StorageGrid Traffic Classification - AND matching rules instead of OR

benkorvemaker — Tue, 14 Feb 2023 17:11:42 GMT

It's not the access rules, but the traffic classification.

IP + Endpoint A, with IP accessing Endpoint A, matches (and also matches anything else hitting Endpoint A)

NOT IP + Endpoint A, with IP accessing Endpoint A, matches (ditto)

IP + NOT Endpoint A, with IP accessing Endpoint A, matches (and also matches anything else hitting any other endpoint)

NOT IP + NOT Endpoint A, with IP accessing Endpoint A, does not match (ditto)