Forum Discussion

Deep_287674's avatar
Deep_287674
Icon for Nimbostratus rankNimbostratus
Oct 06, 2016

iRule for DNS Flood protection

Hi Team, We have implemented new F5 AFM/ASM DDOS boxes. We need to create iRule to protect DNS flood from some range of IP but we need to whitelistdnsdomain.   when DNS_REQUEST {set fqdn [DNS::que...
AFM
iRules
security
  • Migara_61430's avatar
    Migara_61430
    Oct 06, 2016

    You can apply a similar logic

     

    https://devcentral.f5.com/codeshare/http-request-throttle-version-101-and-above

     

Deep_287674's avatar
Deep_287674
Icon for Nimbostratus rankNimbostratus
Oct 06, 2016

Simon : You are seeing floods of queries, but not for your own domains? If it is malicious they'll switch to using your domains.

 

I think with this point I agree that's why we are whitelisting only our domains rather than blacklisting other domains.