For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BPO_11382's avatar
BPO_11382
Icon for Nimbostratus rankNimbostratus
Aug 06, 2014

irule to block

Hey folks,

 

Does anyone have an irule which can check if the user is accessing via a browser client + Check if the message type in traffic is AMF + Check for a specifica IP subnet range; if YES, then block ?

 

Thanks,

 

Brendan

 

application delivery
deployment
design
devops
iRules
LTM
security

1 Reply

  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Aug 14, 2014

    Try this;-

    when CLIENT_REQUEST {
   if { [IP::addr [IP::client_addr] equals 10.10.10.0/24] } {
      drop
   }
}
when HTTP_REQUEST {
    if {[HTTP::header User-Agent] eq "blah" && [HTTP::header Content-Type] contains "amf" } {
        HTTP ::respond 403
        return
    }
}