Forum Discussion
Nikoolayy1
MVP
MVPF5 WAF/ASM block users that trigger too many violations by source ip/device id using the correlation logs
Hello to All,
I was thinking of using the iRule tables command to write when a user ip/device id makes too many violations for a time perioud and to get blocked for some time but I see that the F5 ASM has correlation logs that trigger incidents but there is not a lot info if this can be used in iRules or to block user ip addresses / deviceid.
https://support.f5.com/csp/article/K92532922
To answer your question regarding the required license - yes, IP I is a subscription feature of AdvWAF. You need to spend money on that one.
For the table command, I don't have a lot experience. Hence I would also not make any suggestion how an iRule could look like.
Interesting question would be: If you block a client based on its source IP for 5 minutes, what will happen if that client makes a new violation after 4:50 minutes? Will the block be released after 5 minutes or after 4:50 + 5 more minutes?
This kind of "business logic" must be solved in all soltions - IP Intelligence feed, BIG-IQ and Ansible.
The_NirvanaAltocumulus
Hello Nikoolayy1 ,
Instead of using iRule to create this functionality, you can use the session tracking feature in the AWAF module to obtain the same feature.
Session Tracking requires you to define a violation detection period during which it will track the violations based on username, session, device ID and IP address. You can customize the thresholds for each category. Usually, for IP address, it is recommended to set the threshold higher because it can be a natted IP and a whole organisation may be using a single IP to access your services.
- Daniel_Wolf
What are you trying to achieve? A way to block a source IP that has caused n ASM violations in x seconds for a specific amount of time on Layer 3?
- Nikoolayy1
Yes but also first using the "ASM::fingerprint" if present as this is more granular and only if there is no Device ID then the source IP address. With the table command I should be able to do something like that but I was wondering if the F5 ASM correlation data and its Incidents can't be used in some way with or without irule for such tasks?
- Daniel_Wolf
I had a different train of thought. Use the Source IP from the logs (Splunk, ELK, similar) and create a dynamic IP Intelligence feed list from this data.
Not sure about the Device ID... That fact that there is Device ID+ and Shape Recognize makes me wonder if you should build a solution based on Device ID. It might be a feature that could be deprecated at a certain point in the future.
