Forum Discussion

Twilleyj_94880's avatar
Twilleyj_94880
Icon for Nimbostratus rankNimbostratus
Sep 24, 2013

iRule to reject a specific activesync DeviceId

I'd like to add an iRule to block a specific Activesync DeviceId (SamsungXYZ123) Reason: This phone has been trying to auth approx 20,000 times per day for 11 months... (Ex-Employee)   Does this l...
active sync
application delivery
devops
iRules
What_Lies_Bene1's avatar
What_Lies_Bene1
Icon for Cirrostratus rankCirrostratus
Sep 24, 2013

Sure. You're very close. I don't see the need for the priority so I've dropped that. I've changed 'reject' to 'drop' so no TCP RST is sent, saving a few more CPU cycles and a tiny bit of memory. Just ensure the case of the header and it's value are correct (or alternatively use 'string tolower' to make everything lower case).

when HTTP_REQUEST {
 if { [HTTP::header value "DeviceId"] equals "SamsungXYZ123" } {
  drop } 
}