Forum Discussion

ipman_1988_5418's avatar
ipman_1988_5418
Icon for Nimbostratus rankNimbostratus
Aug 08, 2017

Apply AFM policy dynamically via iRule

Is there a way to apply an AFM policy dynamically via an irule based on source country? I used to have an irule that did this using data-group list now we use AFM on the any/any forwarder but we've found that blocking our dns listener is causing email failures for some email hosts (gmail) with overseas MTAs. I haven't found a way to do this other than go back to an irule for that one listener. Thanks

 

AFM
BIG-IP DNS
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Aug 08, 2017

    Hi,

     

    You can use country as AFM source. Why do you want to choose AFM policy in irule?

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Aug 10, 2017

    Hi,

    This Irule will work for ltm with dns profile. You may be able to enable on arm rule.

    when DNS_REQUEST {
   switch [DNS::question type] {       
       "MX" - "SOA" - "NS" {           
           return           
       }           
       default {
           DNS::header rcode NOERROR
           DNS::return 
   }   
}