For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jason_40733's avatar
Jason_40733
Icon for Cirrocumulus rankCirrocumulus
Jan 17, 2014

Yes. Something like this might work. Haven't tested it, but the theory is workable I believe.

 

Data group of allowed DNS hosts used to verify web address. ltm data-group internal /Common/ALLOWEDDNS { records { www.mycompany.com { } www.mycompany.net { } www.mycompany.org { } } type string }

 

iRule ltm rule /Common/RULE_NOIPS { when HTTP_REQUEST { if {[matchclass [HTTP::host] equals $::ALLOWEDDNS]} { pool MYWEBPOOL } else { reject } } }

 

JRahm_128324's avatar
JRahm_128324
Historic F5 Account
Jan 17, 2014
logic is sound, but unless the original requestor is on v9, you should avoid matchclass and instead use the class command.