Forum Discussion

Hans_Mayer's avatar
Hans_Mayer
Icon for Altostratus rankAltostratus
Jul 15, 2019

Malicious Source IP Addresses

 

Dear All,

 

we are using BIG-IP v14.1.0.3

when I go to Security -> Event Logs there I see a window "Malicious Source IP Addresses" with several IP addresses.

 

Is there a way to block them for a certain time automatically ?

 

Kind regards

Hans

 

 

 

4 Replies

  •  

    Hello Lidev,

     

    Many thanks for your answer but actually it's not that what I am looking for. I know of this possibility to block individual IP's there. My question is more if BIGIP can do it automatically. In this list of "Malicious Source IP Addresses" are obviously only those IP's which were seen several times. So to say the really bad guys. Why not block them automatically ?

     

    // Hans

     

     

    • Lidev's avatar
      Lidev
      Icon for MVP rankMVP

      Maybe because F5 provides an add-on license with IP Intelligence\Reputation Services ;-)

      https://support.f5.com/csp/article/K13875

      https://devcentral.f5.com/s/articles/the-big-ip-application-security-manager-part-6-ip-address-intelligence-and-whitelisting

  • Hello Hans,

     

    I am not using version 14.x but in v13.x there is this possibility, go to Security ›› Application Security : IP Addresses : IP Address Exceptions and set new Addresses Exceptions to be blocked.

  •  

    Hello Lidev,

     

    Yes, we have the IP Intelligence license. But those which are listed in "Malicious Source IP Addresses" are typically not listed in IP Intelligence DB.

     

    // Hans