For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Eblakely_225577's avatar
Eblakely_225577
Icon for Nimbostratus rankNimbostratus
Sep 30, 2016

iRule for rate limiting.

We are experiencing an odd issue where an iRule works in our staging environment and only works intermittently in production. The iRule (see below) filters based on the URI and sets a max rate limit ...
iRules
security
Eblakely_225577's avatar
Eblakely_225577
Icon for Nimbostratus rankNimbostratus
Sep 30, 2016

Correction, it is not 30 requests per second. It is 120 requests per second.

 

I've done further testing and I noticed in the logs the following behaviour when the iRule does not trigger:

 

Sep 30 08:47:21 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:21 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:21 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.67 pool_v3 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.67: methodCount=9 Sep 30 08:47:22 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : Adding entry for 172.20.0.67

 

The methodCount=9 sticks at 9 on and on until the script times out (it is set to send 10000 connections).

 

When the rate limiting is triggered I see this in the logs:

 

Sep 30 08:51:23 bigip01-game-stg info tmm[12864]: Rule /Common/v20-api-redirect : 172.20.0.69 pool_v3 Sep 30 08:51:23 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.69: methodCount=30 Sep 30 08:51:23 bigip01-game-stg info tmm[12864]: Rule /Common/v20-pollingapi-ratelimit : 172.20.0.69 exceeded max HTTP requests per second

 

(I have our staging environment set to 30 requests per second for testing).