For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

heenakhanam0708's avatar
heenakhanam0708
Icon for Altocumulus rankAltocumulus
Jul 09, 2025

How to Block Source IP for 24 Hours After TPS Violation (F5 DoS / iRule / SSL Proxy Setup)

Hi everyone, We are currently working on a traffic management requirement and would appreciate your input. Requirement: We want to implement a mechanism that blocks a source IP for 24 hours once i...
application delivery
security
Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Jul 10, 2025

You may try to combine the irule with the dos profile for example IN_DOSL7_ATTACK event to ad the ip address to a subtable and then in the CLIENT_ACCEPTED event to check the table and if the IP address is present to trigger  reject or drop in the irule.

 

 

You may need to trigger the irule in the Dos profile as there "Trigger iRule" option in there and also attach it on the Virtual server.