Forum Discussion
jsmith294_47458
Nimbostratus
Jun 03, 2010Pre-Logon Sequence
I have been trying to figure out how to add multiple IP address segment checks to a pre-logon sequence. I currently have a rule in place using "session.network.client.ip == "IP address here" but what if I have multiple IP ranges?
11 Replies
- jsmith294_47458
Nimbostratus
I tried your suggestion but now when you login and it identifies that you have the proper IP address it starts to perform the two original checks I was trying to get around. The outcome I would like to have would be to perform an IP check then file check for local users on specific segments but if the users are connecting remotely from home then they would have been checked for the IP address and discovered not in the accepted list and have to go through additional checks to validate them.
Any help you have would Mike would be appreciated.
Thanks - Don_Ryles_52501
Nimbostratus
Hi,
Are you trying do all of this through the pre-logon sequence or are you using session variables?
session variable definitions can be very flexible.
Kevin S. - jsmith294_47458
Nimbostratus
Hey Kevin,
I am trying to perform all this through the Pre-Logon sequence. - Mike_61719
Cirrus
So this is an option.
Create a sequence and name it "smith's IP check". The IP you will have is session.network.client.ip == "001.001.001.125". Once that is complete, add a new file check from the dropdown menu from the add new action section.
Now under the fallback section you add everyone else or in addition another IP check. - jsmith294_47458
Nimbostratus
Hello,
I did as you suggested but the login process resorts back to the fallback option. I verified that the following is in place.
session.network.client.ip == "xx.x.x0x.0/24"
OR
session.network.client.ip == "xx.xx.x0.0/24"
If the authenticated user is coming from one of these in theory it should present the login screen, however it resorts to the fallback sequence and proceeds to perform additional checks.
Does the service require to be restarted if you switch sequences.
Thanks - Mike_61719
Cirrus
Because xx.x.x0x.0/24 is not a valid variable from my understanding.
Add the listed below, you will have to manually place the IP ranges or use a three number system.
(session.network.client.ip >= "0XX.0XX.0XX.001"
AND
session.network.client.ip <= "0XX.0XX.0XX.009") - Mike_61719
Cirrus
Try this instead session.network.client.ip == "xxx.xxx.x0x.0/24" - Make sure to use the three number system - jsmith294_47458
Nimbostratus
Hello,
I attempted your suggestion and it still does not seem to work. I wonder if the services need to be restarted. The system has not been restated in about a year.
Thanks - Mike_61719
Cirrus
I doubt it, what is the IP address showing in the session variables? - Mike_61719
Cirrus
Can you post the exact rule you are using? Just hide the IP's with a X
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects