For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Balasubramaniy2's avatar
Balasubramaniy2
Icon for Nimbostratus rankNimbostratus
Sep 02, 2018

DDoS config migration to F5

  1. stick-table type ip size 100k expire 30s store conn_rate(3s) Allow clean known IPs to bypass the filter
  2. tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst } Example Whitelist: 10.0.10.2/24,10.0.0.0/16,10.10.10.20 Shut the new connection as long as the client has already 10 opened
  3. tcp-request connection reject if { src_conn_rate ge 10 } tcp-request connection track-sc1 src

How to achieve the above setup in F5?