Forum Discussion

SanYang

Cirrus

Oct 11, 2023

Solved

About IP intelligence

Hello,

I would like to ask about the difference between these two IP Intelligences.
1. In Policy

2. In Security ›› Network Firewall : IP Intelligence : Policies

Any Help is appraciate

application delivery

Mohamed_Ahmed_Kansoh
Nov 14, 2023
Hi SanYang ,

When I reviwed the AFM module , I found that I was wrong to say that there is not diffierence between IPI in AWAF and AFM.
Beside Nikoolayy1 and Amine_Kadimi
IPI in AWAF : works per ASM policy also your appliance should be IPI licensed ( 1 Y or 3 Y .... etc ) , it's detectable in XFF headers as well.

IPI in AFM module : is very interesting , first it can work same as AWAF and your devices should be licensed for IPI

For your info ( License means : your Bigip able to get updates from a third party such as " brightCloud " , it updates its data base each 5 minutes with the latest bad reputation ips. )
That's not all for AFM IPI,

you have another 2 functions can be used in AFM IPI ...

1- you can create IPI policy and assign it to Virtual server context or globally in bigip , this policy contains a defined Feed URL which enable your Bigip to get " Black listed or White listed " IPs information in a specific file format bigip ip can understand it , also you can define manually some IPs you want to drop or allow it with a defined duration for blocking if you need that.

Sample of the format that bigip gets from the defined feed in IPI policy: 10.0.0.2,32,bl,spam_sources 10.0.0.3,,wl, 10.10.0.12,,botnets 10.0.0.12,,, 10.0.0.13,,bl,

For more info check this : https://techdocs.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-12-1-0/7.html

2- You can use IPI shun :
briefly IPI shun works with AFM D(DoS) Vectors such as " Endpoint Sweep Vector " , if there is an IP exceeds a defined limits or thresholds of packets , AFM DDoS Sweep vector will be triggered and dynamically add this IP to IPI shun list which can be dropped furtherly very quickly without furher inspection, because AFM DDoS vector detected it as a malicious.

Also you can Configure something like Shun Black hole which means ( If bigip detedted bad actor or malicious IP , it advertise this ip to peer routers via BGP announcements , and these routers will be configured to send any trials of these bad ips which detected by AFM DDoS vectors to a black hole hop or drop these ips from the first layer in your network. " That's the Black hole and shun list role briefly "

Also you can configure scrubber instead of black hole which means bigip will send the malicious IPs trails to external scrubber such as " F5 server line/scrubber to clean or remove unwanted patterns in the packets from these Ips.
it follows the same mechanism of Black hole in advertising malicious IPs.
Both of Black hole and scrubber rely on ZebOS/BGP.

you can review this : https://community.f5.com/t5/technical-articles/ip-intelligence-and-ip-shunning/ta-p/286783

I hope my comment give you some insights 🙂

4 Replies

Mohamed_Ahmed_Kansoh
MVP
Oct 11, 2023
Hi SanYang ,

there is no difference ,

you have to know that IP Inteligence is an independent function (it does not need a very specific module to work), you can use it with ltm, asm, afm, ...etc

this function acts on the IP source in order defined IP classification configured in IP intelligence policies. F5 utilises the IP intelligence (reputation) database to drop traffic from source IP that match the threat categories from WebRoot.

look at this too : https://community.f5.com/t5/technical-forum/difference-between-asm-ip-address-intelligence-and-afm-ip/td-p/97107
Amine_Kadimi
MVP
Oct 11, 2023
Actually, there is an important difference: the ASM one is applied at layer 7, and the other is applied at layer 3 (earlier than L7) and can leverage PVA. The ASM one can also block based on XFF header value.

You can check BIG-IP Life of A Packet - YouTube to know when each one is being exactly applied
- Nikoolayy1
  MVP
  Oct 12, 2023
  Amine_Kadimi mentioned the most important thing 🙂 Still if you have only IPI without ASM/AWAF you can still use XFF but you have to follow the irule workaround that I have mentioned in https://community.f5.com/t5/codeshare/irule-for-afm-ip-intelligence-security-policy-to-work-with-http/ta-p/319281
Mohamed_Ahmed_Kansoh
MVP
Nov 14, 2023
Hi SanYang ,

When I reviwed the AFM module , I found that I was wrong to say that there is not diffierence between IPI in AWAF and AFM.
Beside Nikoolayy1 and Amine_Kadimi
IPI in AWAF : works per ASM policy also your appliance should be IPI licensed ( 1 Y or 3 Y .... etc ) , it's detectable in XFF headers as well.

IPI in AFM module : is very interesting , first it can work same as AWAF and your devices should be licensed for IPI

For your info ( License means : your Bigip able to get updates from a third party such as " brightCloud " , it updates its data base each 5 minutes with the latest bad reputation ips. )
That's not all for AFM IPI,

you have another 2 functions can be used in AFM IPI ...

1- you can create IPI policy and assign it to Virtual server context or globally in bigip , this policy contains a defined Feed URL which enable your Bigip to get " Black listed or White listed " IPs information in a specific file format bigip ip can understand it , also you can define manually some IPs you want to drop or allow it with a defined duration for blocking if you need that.

Sample of the format that bigip gets from the defined feed in IPI policy: 10.0.0.2,32,bl,spam_sources 10.0.0.3,,wl, 10.10.0.12,,botnets 10.0.0.12,,, 10.0.0.13,,bl,

For more info check this : https://techdocs.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-12-1-0/7.html

2- You can use IPI shun :
briefly IPI shun works with AFM D(DoS) Vectors such as " Endpoint Sweep Vector " , if there is an IP exceeds a defined limits or thresholds of packets , AFM DDoS Sweep vector will be triggered and dynamically add this IP to IPI shun list which can be dropped furtherly very quickly without furher inspection, because AFM DDoS vector detected it as a malicious.

Also you can Configure something like Shun Black hole which means ( If bigip detedted bad actor or malicious IP , it advertise this ip to peer routers via BGP announcements , and these routers will be configured to send any trials of these bad ips which detected by AFM DDoS vectors to a black hole hop or drop these ips from the first layer in your network. " That's the Black hole and shun list role briefly "

Also you can configure scrubber instead of black hole which means bigip will send the malicious IPs trails to external scrubber such as " F5 server line/scrubber to clean or remove unwanted patterns in the packets from these Ips.
it follows the same mechanism of Black hole in advertising malicious IPs.
Both of Black hole and scrubber rely on ZebOS/BGP.

you can review this : https://community.f5.com/t5/technical-articles/ip-intelligence-and-ip-shunning/ta-p/286783

I hope my comment give you some insights 🙂