Forum Discussion

eroach5's avatar
eroach5
Icon for Nimbostratus rankNimbostratus
Mar 08, 2018

APM rule or access profile to block traffic from Apple devices via HTTP Header filters.

Hello, Moving from Microsoft TMG to F5 APM. F5 software version 11.6.1. Been crawling the F5 support site and web to find a way to block MAC's (OS X) from using Exchange free / busy app.

 

On the TMG the signature was MacOutlook for blocking action in addition to the HTTP header and signature Mac+OS+X. I have tried adding a new Access profile based on client type, but with no luck. I am leaning towards an iRule, but having difficulty translating MS TMG - speak to F5 iRule speak.

 

Any suggestions would be greatly appreciated.

 

application delivery
BIG-IP Access Policy Manager (APM)
LTM
security
  • eroach5's avatar
    eroach5
    Icon for Nimbostratus rankNimbostratus
    Jul 19, 2018

    The quest to block Mac clients using the F5 APM access policy or an iRule continue. The access policy (attached or embedded image) did not work as expected.

     

    In addition, one of my colleagues tried to accomplish the same goal by using an iRule.

     

    when HTTP_REQUEST { switch -glob [string tolower [HTTP::header value User-Agent]] { "AppleExchangeWebServices" - "macoutlook" - "mac os x" - "mac+os+x" { reject } default { return } } }

     

    This too, did not work completely. See log from Exchange 2013 server:

     

    POST /EWS/Exchange.asmx - 444 xxxxx\xxxxx 1.1.1.1 AppleExchangeWebServices/287.4.1+Mail/3445.8.2

     

    If anyone has any suggestions they would be greatly appreciated. If additional information is required please let me know.

     

  • KeesvandenBos's avatar
    KeesvandenBos
    Icon for MVP rankMVP
    Aug 18, 2018

    Your using string tolower in the irule but want it to match against uppercase... AppleExchangeWebServices.

     

    Could you test it with lowercases?

     

    Cheers,

     

    Kees

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Aug 19, 2018

    Hi,

    as defined here: https://developers.whatismybrowser.com/useragents/explore/operating_system_name/mac-os-x/

    mac os user agent seems to (don't take care about version):

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7

    when HTTP_REQUEST {

set useragent [HTTP::header value User-Agent]
set tolower_useragent [string tolower [HTTP::header value User-Agent]]


if {$useragent contains "Mac OS X" or $tolower_useragent contains "mac os x"} {
    log local0. "User Agent Info: $useragent - $tolower_useragent"
    reject
}

}

    If it'w not working can you test the following irule (with regex for blank space):

    when HTTP_REQUEST {

set useragent [HTTP::header value User-Agent]

if {$useragent matches_regex {.*(?i)mac.os.x.*} } {
    log local0. "User Agent Info: $useragent"
    reject
}

}

    Hope it help you, keep me in touch if it's working.

    regards