Forum Discussion
Atul_kumar_1994
Nimbostratus
May 11, 2015irule is unable to block all of the unwanted UDP syslog messages which is not there in the string filter
Please see the below irule
when CLIENT_ACCEPTED {
UDP::payload replace 0 0 [binary format ssssa256 255 255 255 255 [string repeat "~" 256]]
if { [class match [UDP::payload] contains syslog_strings] } {
binary scan [UDP::payload] ssssa256a* a b c d e data
UDP::payload replace 0 [UDP::payload length] $data
pool pool1
} else { discard } }
This irule is configured to only allow the UDP messages in the asa_syslog_strings to forward to the pool pool1
Please help ASAP
1 Reply
- Max_Q_factor
Cirrocumulus
It sounds like the F5 may treat multiple messages as a single UDP connection. Have you created a specific UDP profile for the syslog servers and changed the timeout value to immediate?
SOL7535: Overview of the UDP profile
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
