For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

NetworkTeam_178's avatar
NetworkTeam_178
Icon for Nimbostratus rankNimbostratus
Nov 04, 2016

Logging for iRule isn't working?

Hello,   I want to output rejections for this iRule to a syslog server. My syntax is   when HTTP_REQUEST { if { !(([HTTP::host] starts_with "website.co.uk") or ([HTTP::host] starts_with ";) o...
application delivery
iRules
LTM
security
someguy_126006's avatar
someguy_126006
Icon for Nimbostratus rankNimbostratus
Nov 04, 2016

Have you tried, the below, where User-Agent is without quotes and has value?

when HTTP_REQUEST {
    if { !(([HTTP::host] starts_with "website.co.uk") or ([HTTP::host] starts_with "www.website.co.uk";) or ([HTTP::host] starts_with "backup.mywebsite.co.uk") or ([HTTP::host] starts_with "www.backup.mywebsite.co.uk";)) } { 
        log local0. "blocked [HTTP::header value User-Agent] requesting [HTTP::host][HTTP::uri]" 
        discard 
    } 
}
  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Nov 04, 2016

    So, the "log" command out of "if" statement, will register log even that is not blocked, am I wrong?

     

    Respectfully.

     

  • someguy_126006's avatar
    someguy_126006
    Icon for Nimbostratus rankNimbostratus
    Nov 04, 2016

    Was a copy paste from the rule above, but yes, that is correct. I moved it up in though.

     

  • NetworkTeam_178's avatar
    NetworkTeam_178
    Icon for Nimbostratus rankNimbostratus
    Nov 17, 2016

    Thanks for your help guys