Forum Discussion

Nimbostratus

Aug 06, 2015

Solved

Blocking Traffic from Single IP with block page on ASM

Hi Everyone, I would like to have the experts input on a point, I have ASM running where I want to block the requests from a particular source IP address and the violation page with id should be...

unblock

Vsevolod_Petrov
Aug 06, 2015
The following extensions I hope will make the rule more efficient:

when ASM_REQUEST_DONE { if { [ASM::violation count] > 0 } { if { not([class match[IP::client_addr] == "black-list-data-group"]) } { ASM::unblock } } }

You can check sources against the data group.
Apply ASM::unblock action only if there were violations.

Hope this helps.

And do not forget to enable "Trigger ASM iRule Events" option in your policy.

Vsevolod_Petrov

Cirrostratus

Aug 06, 2015

The following extensions I hope will make the rule more efficient:

when ASM_REQUEST_DONE {
  if { [ASM::violation count] > 0 } {
    if { not([class match[IP::client_addr] == "black-list-data-group"]) } {
      ASM::unblock
    }
  }
}