For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jmanya_44531's avatar
jmanya_44531
Icon for Nimbostratus rankNimbostratus
Jun 24, 2014

iRule to block IPSEC outbound responses

Hello friends,   Due to I am having asymmetric traffic which does not allow a VPN IPSEC tunnel to be established, I need to to block IPSEC tunnel initiation by a peer VPN behind the BIG-IP. I thin...
application delivery
design
devops
iRules
LTM
The_Bhattman's avatar
The_Bhattman
Icon for Nimbostratus rankNimbostratus
Jun 29, 2014

Hi JM, Yes you could. There is a command called (IP::protocol) which returns the protocol value. This value can identify components in the VPN like ESP, AH along with UDP protocol port IKE

Thus you could have the following: 

when CLIENT_ACCEPTED  {
    if {[IP::protocol] == 50 || [IP::protocol] == 51 || [UDP::local_port] == 500}  {
         drop
       }
}

I hope this helps

-=Bhattman=-