Forum Discussion
Hans_Mayer
Altostratus
AltostratusMalicious Source IP Addresses
Dear All,
we are using BIG-IP v14.1.0.3
when I go to Security -> Event Logs there I see a window "Malicious Source IP Addresses" with several IP addresses.
Is there a way to block them for a certain time automatically ?
Kind regards
Hans
Hans_MayerHello Lidev,
Many thanks for your answer but actually it's not that what I am looking for. I know of this possibility to block individual IP's there. My question is more if BIGIP can do it automatically. In this list of "Malicious Source IP Addresses" are obviously only those IP's which were seen several times. So to say the really bad guys. Why not block them automatically ?
// Hans
- Lidev
MVP
Maybe because F5 provides an add-on license with IP Intelligence\Reputation Services ;-)
https://support.f5.com/csp/article/K13875
https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-6-ip-address-intelligence-and-whitelisting
- Lidev
Hello Hans,
I am not using version 14.x but in v13.x there is this possibility, go to Security ›› Application Security : IP Addresses : IP Address Exceptions and set new Addresses Exceptions to be blocked.
- Hans_Mayer
Hello Lidev,
Yes, we have the IP Intelligence license. But those which are listed in "Malicious Source IP Addresses" are typically not listed in IP Intelligence DB.
// Hans
