For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ipman_1988_5418's avatar
ipman_1988_5418
Icon for Nimbostratus rankNimbostratus
Sep 25, 2013

GeoLocation iRule Client_Accepted missing some traffic

I have an iRule that fires on client_accepted applied to a virtual forwarder (0.0.0.0) that basically forwards all tcp and udp traffic (not destined to our GTM DNS virtual). The iRule does a whereis ...
application delivery
devops
iRules
ipman_1988_5418's avatar
ipman_1988_5418
Icon for Nimbostratus rankNimbostratus
Sep 25, 2013

The firewall is dropping because of it's drop any any rule. Has nothing to do with geolocation. I just use that as a way of seeing what is getting past the F5. The firewall is the next hop in. I simply applied a filter to the firewall log with several class A ranges from countries I know should be blocked at the F5 and I see traffic getting past the LTM. So I'm just trying to figure out why. Perhaps the client_accepted event isn't firing?

 

StephanManthey's avatar
StephanManthey
Icon for Nacreous rankNacreous
Sep 25, 2013
Especially in Europe it´s very unlikely to match a class A network to a single country. It´s really a moving target. I won´t even expect data to be consistent between i.e. MaxMind and Digital Envoy, Quova and other suppliers of GeoIP mappings.