Forum Discussion

gh0st_325958's avatar
gh0st_325958
Icon for Nimbostratus rankNimbostratus
Jan 07, 2018

Block one type request

Dear All,

 

I would like to block one attack signature if it contains uniq request type on F5-ASM, without any traffic learning.

 

For example: I have a request from multi type IPs. I would like to block this when the request contains a uniq URL.

 

Is there any solutions for this problem?

 

ASM Advanced WAF
BIG-IP
security
  • kolom's avatar
    kolom
    Icon for Altostratus rankAltostratus
    Jan 07, 2018

    Try the below iRule , you can also change drop to return other response code if you want.

     

    when HTTP_REQUEST {
if { ([string tolower [HTTP::uri]] contains "/example" ) 
     && ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
drop
}
}
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 08, 2018

    You can define an ASM user defined violation and raise it if condition meet.

    when HTTP_REQUEST {
  set reqBlock 0
  if { ([string tolower [HTTP::uri]] contains "/example" ) 
     && ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
    set reqBlock 1
  }
}   
when ASM_REQUEST_DONE {
  if { $reqBlock == 1} {
    ASM::raise VIOLATION_FORBIDDEN_URL
  }
}