NimbostratusCurrently we utilize a web server to host a blocklist that some of our other security devices use to block IP addresses. It allows us to maintain 1 list for all devices. Can the F5 ASM or LTM utilize such a list...maybe through an iRule or iFile?
CirrusHi,
this list can be uploaded as an ifile. You can also do a lookup using sideband connections in irules
CirrusYou can create an ifile using the following command :
tmsh create sys file ifile blacklist source-path http://hostname.com/uriand then update it using the following command :
tmsh modify sys file ifile blacklist source-path http://hostname.com/uriThe filesize for a single iFile was raised to 32Mb in 12.1.0. Prior versions limited the size to 4Mb.
CirrusHere a nice article on sideband connection that can help you design a lookup using HTTP API :
Advanced iRules: Sideband Connections
CirrusHere a small Proof of Concept.
when HTTP_REQUEST {
set file [ifile get domains]
log local0. "$file"
set domain "amazon.co.uk.security-check.ga"
if { [string match "*$domain*" $file] } {
log local0. "succeeded"
HTTP::respond 200 content "ok"
} else {
log local0. "failed"
}
}
Note : should test performance impact, memory consumption and stuff like that before switching something in production
NacreousHi,
this list can be uploaded as an ifile. You can also do a lookup using sideband connections in irules
NacreousYou can create an ifile using the following command :
tmsh create sys file ifile blacklist source-path http://hostname.com/uriand then update it using the following command :
tmsh modify sys file ifile blacklist source-path http://hostname.com/uriThe filesize for a single iFile was raised to 32Mb in 12.1.0. Prior versions limited the size to 4Mb.
NacreousHere a nice article on sideband connection that can help you design a lookup using HTTP API :
Advanced iRules: Sideband Connections
NacreousHere a small Proof of Concept.
when HTTP_REQUEST {
set file [ifile get domains]
log local0. "$file"
set domain "amazon.co.uk.security-check.ga"
if { [string match "*$domain*" $file] } {
log local0. "succeeded"
HTTP::respond 200 content "ok"
} else {
log local0. "failed"
}
}
Note : should test performance impact, memory consumption and stuff like that before switching something in production