For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Sep 10, 2015

Irule to block users based on mac address

Hi Everyone,   I would like to know from experts that is there a way irule can be used to block the users access to the application based on their mac address. Will this be achievable using irule ...
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Sep 10, 2015

Hello,

You sure can do it using iRules. Use 

LINK::lasthop
to return the value of source MAC address. Once you have the value, you can then use a basic comparison against a list of entries in LTM data-group and decide theher the packet will be dropped, rejected or accepted. https://devcentral.f5.com/wiki/iRules.LINK__lasthop.ashx

Note: if your clients are not in the same VLAN, the value returned by LINK::lasthop command will always be the MAC address of your router interface (or another L3 device you're using to implement cross-VLAN routing).