iRule to reference data group for whitelisting IP

You can add whitelist ip in WAF/ASM under ip/subnet exception list. It will give more flexibility then iRule... Hope it will work.

​

Thanks​

I have about 450 IP addresses to allow. I already have the data group list on the box, just need an iRule to reference it. Thanks.

you can try something like this... Not tested yet. Please test in non prod device.

when CLIENT_ACCEPTED {
   if {[matchclass [IP::client_addr] equals bypass_asm_class]}{
      set disable_asm 1
      #log local0. "[IP::client_addr]:[TCP::client_port]: Client matched bypass_asm_class datagroup."
   } else {
      set disable_asm 0
      #log local0. "[IP::client_addr]:[TCP::client_port]: Client did not match bypass_asm_class datagroup."
   }
}
when HTTP_CLASS_SELECTED {
   if {[HTTP::class asm]==1}{
      if {$disable_asm==1}{
         log local0. "[IP::client_addr]:[TCP::client_port]: Disabling ASM for this request."
         ASM::disable
      } else {
         log local0. "[IP::client_addr]:[TCP::client_port]: Not disabling ASM for this request."
         ASM::enable
      }
   }
}

Set the log according to requirements and later disable it

I'll test this out, thanks!

The HTTP_CLASS_SELECTED event has been deprecated. Instead, you can use a local traffic policy to selectively enable and disable ASM, as Samir showed, using an IP address data group to make the comparisons. For example:

ltm policy disable_asm_for_select_IPs {
    controls { asm }
    last-modified 2020-12-03:10:38:38
    requires { http tcp }
    rules {
        disable_asm_for_select_IPs {
            actions {
                0 {
                    asm
                    disable
                }
            }
            conditions {
                0 {
                    tcp
                    address
                    matches
                    datagroup no_ASM_IPs
                }
            }
        }
        enable_asm_for_all_traffic {
            actions {
                0 {
                    asm
                    enable
                    policy /Common/lab_8_manual
                }
            }
            ordinal 1
        }
    }
    status published
    strategy first-match
}

It's important that the catch-all rule, enable_asm_for_all_traffic, be the second rule in the policy, and disable_asm_for_select_IPs be first. You would assign the local traffic policy to the appropriate virtual server, replacing the default one applied when you enable an application security policy on the virtual server.

Here is what my internal datagroup looks like. (You can use an external data group just as easily.):

ltm data-group internal no_ASM_IPs {
    records {
        10.10.10.30/32 { }
    }
    type ip
}

I tested this on BIG-IP ASM v15.1.0. 

Nice, I'll run this on my v16.0.1 lab. Thanks!

Works great on v16, unfortunately I can't log the unblocked requests. Guess that's the lesser of the two evils. Off to dev. Thanks again!

Too awesome, thanks again for your help!