F5 Whitelisting/ Allowing a specific range of traffic to VS

Hello,

From version v11 on-wards, your Virtual Server has "Source" field. As value, you may specify a single /32 IP, or a bigger subnet.

You may create multiple identical Virtual Servers with different Source IP restrictions if your allowed addresses are in separate subnets. As the number of allowed Source IP addresses and subnets grow, at one point you will be better off going with an LTM iRule solution that checks LTM data-group for allowed source IP addresses. Or you can do whitelisting in AFM module. If you prefer one of the latter scenarios, let me know and I'll get you an example.

Rgds

We have multiple IP in different subnets and I guess it would be better for LTM iRule solution that checks LTM data-group for allowed source IP addresses.

Can you please assist me on the irule.

Create IP type LTM data-group. Define allowed IP/subnet values, and add optional descriptions. You can find data-group creation page at

Local Traffic - iRules - Data-group List

ltm data-group internal datagroup_allowed_ip {
  records {
    100.20.20.0/32 { }
    199.20.20.128/25 { }
  }
  type ip
}

Create an iRule that checks for matches against entries in datagroup_allowed_ip

when CLIENT_ACCEPTED {
  if { [class match [IP::client_addr] eq "datagroup_allowed_ip" ] }{
     Traffic is allowed. Client IP match found in datagroup_allowed_ip
    return
  } else {
     Traffic is dropped. Client IP match not found in datagroup_allowed_ip
    drop
  }
}

An alternative to using an iRule is to use AFM(Advanced Firewall Manager). AFM which is included in the Better bundle or standalone makes adding an ACL to your virtual server trivial.