For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jmanya_44531's avatar
jmanya_44531
Icon for Nimbostratus rankNimbostratus
Jun 24, 2014

iRule to block IPSEC outbound responses

Hello friends,

 

Due to I am having asymmetric traffic which does not allow a VPN IPSEC tunnel to be established, I need to to block IPSEC tunnel initiation by a peer VPN behind the BIG-IP. I think that the easiest way would be an irule triggered in CLIENT_ACCEPTED to drop the connections.

 

Anyone could recommend me any way to design such irule?

 

Thanks in advance.

 

Regards

 

JM

 

application delivery
design
devops
iRules
LTM

1 Reply

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Jun 29, 2014

    Hi JM, Yes you could. There is a command called (IP::protocol) which returns the protocol value. This value can identify components in the VPN like ESP, AH along with UDP protocol port IKE

    Thus you could have the following: 

    when CLIENT_ACCEPTED  {
    if {[IP::protocol] == 50 || [IP::protocol] == 51 || [UDP::local_port] == 500}  {
         drop
       }
}

    I hope this helps

    -=Bhattman=-