Forum Discussion
Ilian_Ivanov
Nimbostratus
NimbostratusCustom Attack Signature for blocking XFF IPs
Hello,
Could you help me with writing a regular expression for custom attack signature that will check the XFF header for specific IP address and if there is a match block it.
Thank you in ...
Daniel_Varela
Employee
EmployeeWhat version are you using? In version 13.x you can block IP addresses. First you need to trust the X-Forwarded-For header as the origin of you IP address in your security policy. Then in the IP Address section of you policy add the IP you need to block and set Always Block this IP.
Other option is an irule, there is a bunch of ASM commands to extend ASM functionalities, this is better in my opinion that a custom signature. You will probably will need to add more IPs to the blocking, datagroups will help you with that much more easy than a signature.
