For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Edher_Espinosa1's avatar
Edher_Espinosa1
Icon for Nimbostratus rankNimbostratus
Aug 26, 2015

iRule with custom SNMP TRAP evertytime it matches, NOT every minute

The idea here is to log a malicious IP, i've created an SNMP TRAP for everytime this IPs get connected, I've created an iRules as well with a DataGroup "dg_mx" and works fine!   Heres the iRule: ...
application delivery
design
LTM
monitor
performance
security
Amit_Karnik_269's avatar
Amit_Karnik_269
Icon for Nimbostratus rankNimbostratus
Sep 01, 2015

Does not seem like a trivial solution. The alertd has a 1 minute frequency of looking up new logs and then sending out SNMP alerts based on log content.

 

The 1 option I would pursue is creating the SNMP packet directly in hex and sending the content out using SIDEBAND::send. Since SNMP is UDP and fairly defined protocol, you should be able to construct the packet but I would not typically go down this option unless it is really really required.

 

To warn you I had something similar requested to be alarmed as SNMP alerts and 2 weeks in Production and they were complaining about "too many events". Thats when we implemented the 5 minutes consolidated event.

 

https://devcentral.f5.com/wiki/iRules.send.ashx

 

cheers.