Forum Discussion
iRule to permit access on a specific URL from a source IP on the ASM
the specific violation is : " Illegal URL"
Can we write our Irule based on the attack type, like i have written in the below:
when ASM_REQUEST_VIOLATION { set x [ASM::violation_data]
for {set i 0} { $i < 7 } {incr i} { switch $i { 0 { log local0. "attack_type=[lindex $x $i]" } 1 { log local0. "violation=[lindex $x $i]" } 2 { log local0. "support_id=[lindex $x $i]" } 3 { log local0. "web_application=[lindex $x $i]" } 4 { log local0. "severity=[lindex $x $i]" } 5 { log local0. "source_ip=[lindex $x $i]" } 6 { log local0. "request_status=[lindex $x $i]" }
}}
if {([lindex $x 0] contains "ATTACK_TYPE_FORCEFUL_BROWSING") and ([whereis [IP::client_addr]] equals "1.2.3.4") }
pool test_pool member 10.11.12.13 443
}
Thanks!!
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com