Add address to IP Address Exception via REST API

What you can try if you don't find the REST-API command (as I also couldn't and under another post it was still not found) is to turn off the Ip inteliigence for the asm security policies that you have issues and enable it under the virtual servers with an irule and make data group that will be checked and if the client ip address is not in the data group then use the IP intelligence. Something like whitelist and the Data groups can be managed and updated with REST-API and ansible:

https://docs.ansible.com/ansible/latest/collections/f5networks/f5_modules/bigip_data_group_module.html

F5 Irule links from where I got the idea:

https://clouddocs.f5.com/api/irules/IP-reputation.html

https://clouddocs.f5.com/api/irules/IP__intelligence.html

https://clouddocs.f5.com/api/irules/class.html

F5 article that you probably know that again shows how to use irule with ip intelligence and the asm module:

https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/8.html

example:

when CLIENT_ACCEPTED {

if { [class match [IP::client_addr] equals "whitelist_dg" ] } {

# Do nothing if it matches the witelist

} else {

# Check if the IP reputation list for the client IP is not 0

if {[llength [IP::reputation [IP::client_addr]]] != 0}{

# Drop the connection

drop

}

}

}

A more optimized version of the irule:

when CLIENT_ACCEPTED {

# Check if the IP reputation list for the client IP is not 0 and not matching the data group

if { ([llength [IP::reputation [IP::client_addr]]] != 0) && (not([class match [IP::client_addr] equals "whitelist_dg"])) } {

# Drop the connection

drop

}

}

Unfortunately, the solution you suggest is more sort of a workaround. I would need to extend it's logic to match certain URIs and apply different matching categories (Botnets, Denial of Service) on differnet URIs. This will quickly become a beast of an iRule.

Based on my requirements I would need to find a way to automatically update IP Intelligence Exceptions on a IPI policy that is applied on a per security policy basis.

As an alternative updating the IP Intelligence Exceptions on a IPI policy that is applied on a per VS basis would be also fine.

AFM and a feed list is not an option, I have only AdvWAF provisioned.