For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Abraham_126135's avatar
Abraham_126135
Icon for Nimbostratus rankNimbostratus
Nov 13, 2014

iRule to block\reject connections from Lync client

We have a VIP intended to for Sharepoint but would like to reject connections that are coming from MS Lync clients. It's causing our Lync clients to re-authenticate over and over due to 2FA that's setup on this VIP. Hoping to reach out on Dev central experts for iRule to get this done.

 

5 Replies

  • If Lync has a User-Agent that identifies it as Lync, you can write an iRule to drop the incoming connection. You may want to look at the HTTP_REQUEST or SERVER_CONNECTED events

    when HTTP_REQUEST {
            if {[string tolower[HTTP::header "User-Agent"]] eq "lync user agent" } {
                    drop
            }
    }
    
  • Thank you for the response Cthulhucalling. I forgot to include that we are trying to reject connection from both Lync and Exchange clients. What do you think of this iRule below?

     

    when HTTP_REQUEST { log local0.debug "Client IP:[IP::client_addr] attempt with user agent :[HTTP::header User-Agent]" if { [ string tolower [HTTP::header User-Agent]] contains "microsoft lync"} { drop log local0.info "Client IP:[IP::client_addr] has been blocked with user agent :[HTTP::header User-Agent]" } elseif { [ string tolower [HTTP::header User-Agent]] contains "microsoft outlook"} { drop log local0.info "Client IP:[IP::client_addr] has been blocked with user agent :[HTTP::header User-Agent]" } else { log local0.debug "Client IP:[IP::client_addr] attempt with user agent :[HTTP::header User-Agent] successful" } }

     

  • That way will work. The switch statement may make things simpler and faster.

    when HTTP_REQUEST {
            switch -glob  [string tolower [HTTP::header "User-Agent"]]
            "microsoft lync*" -
            "microsoft outlook*" {
                    log local0.info "Client IP:[IP::client_addr] has been blocked with user agent :[HTTP::header User-Agent]
                    drop
            }
            default {
                    log local0.debug "Client IP:[IP::client_addr] attempt with user agent :[HTTP::header User-Agent] successful"
            }
    }
    
  • I received an error

     

    01070151:3: Rule [ExternalSP_rule_drop_lync_exchange] error: line 2: [wrong args] [switch -glob [string tolower [HTTP::header "User-Agent"]]] line 3: [undefined procedure: microsoft lync] ["microsoft lync" -] line 4: [undefined procedure: microsoft outlook] ["microsoft outlook" { log local0.info "Client IP:[IP::client_addr] has been blocked with user agent :[HTTP::header User-Agent] drop }] line 8: [undefined procedure: default] [default { log local0.debug "Client IP:[IP::client_addr] attempt with user agent :[HTTP::header User-Agent] successful" }]

     

  • when HTTP_REQUEST {
            switch -glob  [string tolower [HTTP::header "User-Agent"]] {
                    "microsoft lync" -
                    "microsoft outlook*" {
                            log local0.info "Client IP:[IP::client_addr] has been blocked with user agent :[HTTP::header User-Agent]"
                            drop
                    }
                    default {
                            log local0.debug "Client IP:[IP::client_addr] attempt with user agent :[HTTP::header User-Agent] successful"
                    }
            }
    }