For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

srinivas_nory_2's avatar
srinivas_nory_2
Icon for Nimbostratus rankNimbostratus
Jun 30, 2015

Hi Maneesh,

 

Thank you for the quick response, on the http header we are reading the host entry for mydomain.com or mydomian.in, usually this host entry is for the internet host of the resouce being requested.

 

so machine from the lan with domain mydomain.com / mydomain.in when sends out a request does the http header of host file will be machinename.mydomain.com / machinename.mydomain.in ? Any machine not being on these domain should be rejected.

 

Can you please let me know if the rule suffices the source based restirction ?

 

Thanks

 

  • TechT_163800's avatar
    TechT_163800
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2015
    The above irule will help only when you are trying to access mydomain.com/mydomain.in urls on your web browser. For your source based requirement, why dont we go with specific subnet instead of domain name ?
  • srinivas_nory_2's avatar
    srinivas_nory_2
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2015
    Manish, i am having a discussion the source based ip settings but the requirement of the client wanted it to be more with domain based as we have quite a number of domain and network segregation based. So is there a way we can do a source based restirction using domain ?
  • TechT_163800's avatar
    TechT_163800
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2015
    i wonder how LB can read source domain names(may be i am lacking here), if it was IP we could have match with "class match [IP::client_addr]"
  • srinivas_nory_2's avatar
    srinivas_nory_2
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2015
    I did try the opition to create a data group with strings matching the domain values and called it i rule but havent got the functionality up and running. so was wondering if there is any way to read a host name and filter the traffic.