Forum Discussion

dyobbs_25515's avatar
dyobbs_25515
Icon for Nimbostratus rankNimbostratus
Jul 18, 2012

IP Intelligence iRule

Hi,

 

 

I found this iRule for IP intelligence on the link below. However, when put it on F5, it's giving me an error.

 

 

http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-2-0/13.print.html

 

 

IRULE:

 

 

when HTTP_REQUEST { set ip_reputation_categories [IP::reputation [IP::client_addr]] set is_reject 0

 

if {($ip_reputation_categories contains "Windows Exploits")} { set is_reject 1 } if {($ip_reputation_categories contains "Web Attacks")} { set is_reject 1 }

 

if {($is_reject)} { log local0. "Attempted access from malicious IP address [IP::client_addr] ($ip_reputation_categories), request was rejected" HTTP::respond 200 content "Rejected Request The request was rejected.

 

Attempted access from malicious IP address" } }

 

 

Here's the error message:

 

 

01070151:3: Rule [/Common/rej_rule] error:

 

line 1: [wrong args] [set ip_reputation_categories [IP::reputation [IP::client_addr]] set is_reject 0 if {($ip_reputation_categories contains "Windows Exploits")} { set is_reject 1 } if {($ip_reputation_categories contains "Web Attacks")} { set is_reject 1 } if {($is_reject)} { log local0. "Attempted access from malicious IP address [IP::client_addr] ($ip_reputation_categories), request was rejected" HTTP::respond 200 content "Rejected Request The request was rejected.

 

Attempted access from malicious IP address" } ]

 

 

where's the issue? Many thanks!

 

 

  • try this
    when HTTP_REQUEST {
    
       use [HTTP::header values "X-Forwarded-For"] in replacement of [IP::client_addr] if using the x forwarded for testing 
    set ip_reputation_categories [IP::reputation [IP::client_addr]]
            set is_reject 0
            if {($ip_reputation_categories contains "Windows Exploits")} {
       set is_reject 1 
    } 
            if {($ip_reputation_categories contains "Web Attacks")} {  
    set is_reject 1 
    } 
    if {($ip_reputation_categories contains "Scanners")}{  
    set is_reject 1 
    } 
    if {($ip_reputation_categories contains "Proxy")}{  
    set is_reject 1 
    } 
    
        if {($is_reject)} {
            log local0. "Attempted access from malicious IP address 
    [IP::client_addr]($ip_reputation_categories), request was rejected"
    
            HTTP::respond 200 content "
    
    
    Rejected Request
    
    The request was rejected. 
    Attempted access from malicious IP address
    "
        }
    }