For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Richard_Cowell's avatar
Richard_Cowell
Icon for Nimbostratus rankNimbostratus
Dec 11, 2019

AD Account Lockout

We are using a RADIUS auth with an AD Query for user access. We have set the user to be allowed 2 attempts to login. This is 1 less than out AD lockout policy. IF the user attempts to login in 2 diff...
Yoann_Le_Corvi1's avatar
Yoann_Le_Corvi1
Icon for Cumulonimbus rankCumulonimbus
Dec 11, 2019

Hi

 

You should be able to achieve what you want with tables : https://clouddocs.f5.com/api/irules/table.html

 

You would just need to determine the decision algorithme.

 

You could for example :

  • Create an entry in the table when a new session is started storing the username and mrh session
  • When a new connexion is initiated, if an entry already exist, then drop the connexion
  • When the APM session is established or completely denied, delete the entry in the table to avoid memory issues.

That's just an example.

 

Also another way using the default settings of APM policy :

  • Max Sessions per User
  • Max InProgress Session per Client IP.

 

It's less flexible than tables, but less devops also :)

 

Yoann