For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AliCanS's avatar
AliCanS
Icon for Nimbostratus rankNimbostratus
Aug 08, 2023

iRule newbie - Whitelisting IP address for Spesific URL and Attack Pattern

Hello community, One of our third party applications have false-positive blocks for spesific attack pattern, which we want to whitelist, but as our f5 support explained that it cannot be done to ...
asm
irule
security
whitelist
AubreyKingF5's avatar
AubreyKingF5
Icon for Moderator rankModerator
Aug 08, 2023

I think it can be done, but not w/ an ASM irule. I can't write this now, as I'm sick and on quick, but the idea is to take the asm policy off the vip, then use an irule like this:

  1. when http_request, check URI.
  2. if uri matches [list of disallowed uris], exit the irule.
  3. else, if no match, apply ASM policy.

I am going to tell you, though.. depending on traffic levels, this could get computationally expensive.