Altostratus
Dear All,
we are using BIG-IP v14.1.0.3
when I go to Security -> Event Logs there I see a window "Malicious Source IP Addresses" with several IP addresses.
Is there a way to block them for a certain time automatically ?
Kind regards
Hans
Altostratus
Hello Lidev,
Many thanks for your answer but actually it's not that what I am looking for. I know of this possibility to block individual IP's there. My question is more if BIGIP can do it automatically. In this list of "Malicious Source IP Addresses" are obviously only those IP's which were seen several times. So to say the really bad guys. Why not block them automatically ?
// Hans
MVPMaybe because F5 provides an add-on license with IP Intelligence\Reputation Services ;-)
https://support.f5.com/csp/article/K13875
https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-6-ip-address-intelligence-and-whitelisting
MVPHello Hans,
I am not using version 14.x but in v13.x there is this possibility, go to Security ›› Application Security : IP Addresses : IP Address Exceptions and set new Addresses Exceptions to be blocked.
Altostratus
Hello Lidev,
Yes, we have the IP Intelligence license. But those which are listed in "Malicious Source IP Addresses" are typically not listed in IP Intelligence DB.
// Hans