For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Moustafa's avatar
Moustafa
Icon for Nimbostratus rankNimbostratus
Jun 08, 2020

I Rule to log source_ip , time_stamp, public_ip

Hello ,

 

i need to develop i rule to log the accepted connections to the VS as following parameters .

 

wan_source_ip address , Geolocation , time stamp

 

Regards,

ASM Advanced WAF
BIG-IP
devops

2 Replies

  • Samir's avatar
    Samir
    Icon for MVP rankMVP
    Jun 09, 2020

    Make sure your BIGIP is having latest GeoDB then you will able to get correct details but it will be CPU intensive.

    Thanks

  • Moustafa's avatar
    Moustafa
    Icon for Nimbostratus rankNimbostratus
    Jun 09, 2020

    hi Samir ,

    thanks for information . i tried the below I rule i think its working .

     

    when CLIENT_ACCEPTED {

      log local0. "Source IP address and Port is [IP::client_addr]:[TCP::client_port]"

    log local0. "cloc [whereis [IP::client_addr] country]"

    log local0. "Geo Client ([IP::client_addr]) detected"

      }