Forum Discussion

sauravkhanna_20's avatar
sauravkhanna_20
Icon for Nimbostratus rankNimbostratus
Jun 18, 2015

APM with F5 2000S

Hi Guys,

 

I have created an access policy that invokes radius authentication for any user coming from internet. I have also added in that policy that it should not invoke any authentication when users are coming from subnet let's say 192.168.x.x.

 

The part which is not working is when users are coming from 192.168.x.x. In the logs I see "Rule evaluation with error" and it prompts for Radius authentication.

 

The policy for excluding the subnet is: expr { [IP::addr [mcget {session.user.clientip}] equals "192.168.0.0/16"] }

 

Any suggestions on where I am going wrong

 

Saurav

 

application delivery
BIG-IP Access Policy Manager (APM)
design
LTM
security

2 Replies

  • arpydays's avatar
    arpydays
    Icon for Nimbostratus rankNimbostratus
    Jun 18, 2015

    try using an rule,

    when ACCESS_SESSION_STARTED {
    if { [IP::addr [ACCESS::session data get session.user.clientip] equals 192.168.0.0/16] } {
        ACCESS::session data set session.user.radiusbypass 1
    }
}

    then in VPE

    expr { [mcget {session.user.radiusbypass}] == 1 }
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 21, 2015

    where did you use your code? could you show the policy?

     

    you could try the ip with the quotes. beyond that nothing stands out a lot, i usually just try part by part until it works :)