F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Adnan_Mahmud_12's avatar
Adnan_Mahmud_12
Icon for Nimbostratus rankNimbostratus
Mar 01, 2018

Extract blocked IPs by ASM with tmsh or irule

Hi, is there way to extract the list of IPs that were blocked by ASM in last 24 hours with tmsh or irule. The idea is to put top abusers in a global block list. Highly appreciate your suggestions. Th...
ASM Advanced WAF
devops
LTM
security
rob_carr's avatar
rob_carr
Icon for Cirrocumulus rankCirrocumulus
Mar 06, 2018

A couple of ideas:

 

  • You could use an iRule to extract IP address information from each ASM_REQUEST_BLOCKING event, push that information into a datagroup and then make that datagroup available as the content for a feed, which can then be queried by the system creating the global block list.

     

  • You can configure the ASM to send email reports on a periodic basis, sending them to a recipient system which consumes the reports and populates the global block list.