Forum Discussion

Akshay_SK's avatar
Akshay_SK
Icon for Nimbostratus rankNimbostratus
Dec 15, 2023

Auto removal of IP addresses from F5 data group.

Hello, We have been using a F5 datagroup in our org for IP blacklisting approach. So an IP added to this data group will be rejected traffic by our F5. Now this datagroup has IP addresses added more...
security
whisperer's avatar
whisperer
Icon for MVP rankMVP
Dec 15, 2023

Think the poster also needs to address the time stamp storage. I checked the API for datagroups, and we dont support a 'description' field where an epoch timestamp would be ideal.

https://clouddocs.f5.com/api/icontrol-rest/APIRef_tm_ltm_data-group_internal.html

Instead, we can use key / value pairs. Store the IP address as NAME and the epoch time in DATA. Using this approach, it would be easy via iRule or whatever to lookup a source IP against the datagroup, retrieve the last acess time in epoch format, and either perform a comparison or update. Of course one could also programmatically iterate through the datagroup list and purge out old entries.