For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

aboulleill_3013's avatar
aboulleill_3013
Icon for Nimbostratus rankNimbostratus
Dec 01, 2016

Dears,can you please correct the following irule

Dears,

the following Irule will block any attempt to access the url containing /admin directory from any source except 172.0.0.0/8 subnet.I'm getting the following error

01070151:3: Rule [/BM_IB/test1] error: /BM_IB/test1:6: error: [missing an expression][ ]

when HTTP_REQUEST {

     switch -glob [string tolower [HTTP::uri]] {
     "/admin*" 

    if { ( [IP::addr [IP::client_addr] equals 172.0.0.0/8] )  
       }

{ 

                                        reject }


                                                default { 
                                                    return 
                                                        }


                 }
                  }
application delivery
iRules
security

2 Replies

  • ekaleido's avatar
    ekaleido
    Icon for Cirrus rankCirrus
    Dec 01, 2016
    when HTTP_REQUEST {
  switch -glob [string tolower [HTTP::uri]] {
    "/admin*" {   
      if { ( [IP::addr [IP::client_addr] equals 172.0.0.0/8] ) } {  
        reject
      }
    }
    default { return }
  }
}
  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Dec 01, 2016

    Hello,

    You should really use an LTM Data-group (Local Traffic -> iRules -> Data-group List) for the purpose. Assuming you go for the iRule I posted, you should additionally create a data-group named 'dg_trusted_ip' (network type) and add the trusted IP-addresses and address ranges into that data group.

    The iRule itself below:

    when HTTP_REQUEST {

    if { ([string tolower [HTTP::path]] starts_with "/admin") && ([class match [IP::client_addr] ne "dg_trusted_ip"]) }{
        drop
    }
}