Forum Discussion
aelkosairy_1840
Nimbostratus
Dec 02, 2015redirect all the attack traffic to specific destination
Dears , I need someone help me in specific objective , I need IRule allow to F5 to redirect all the malicious traffics to specific destination instead of Block or Deny the traffic , so F5 only detec...
samstep
Cirrocumulus
Dec 02, 2015You can achieve this with a simple iRule.
First you need to set up a pool which has a pool member which is the destination (IP address and port) where you need to send the malicious traffic.
If you are not going to display a blocking page then you can keep your violations on "Alarm" instead of "Block". Then use an iRule like this one:
when ASM_REQUEST_DONE
{
if { [ASM::status] equals "alarmed" } {
log local0.debug "Request: [HTTP::method] [HTTP::uri] raised ASM violations and was sent to malicious traffic pool"
send traffic to malicious traffic pool
pool malicious_traffic_destination_pool
}
}
Hope this helps,
Sam
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
