For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

gh0st_325958's avatar
gh0st_325958
Icon for Nimbostratus rankNimbostratus
Jan 07, 2018

Block one type request

Dear All,   I would like to block one attack signature if it contains uniq request type on F5-ASM, without any traffic learning.   For example: I have a request from multi type IPs. I would lik...
ASM Advanced WAF
BIG-IP
security
kolom's avatar
kolom
Icon for Altostratus rankAltostratus
Jan 07, 2018

Try the below iRule , you can also change drop to return other response code if you want.

 

when HTTP_REQUEST {
if { ([string tolower [HTTP::uri]] contains "/example" ) 
     && ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
drop
}
}