Restrict FTP traffic on VIP to IP address or range

Hi,

 

I have big-ip version 10.2 with 2 partitions and I want to filter incoming web requests based on clients' IP addresses. I tried the following irule with datagroup IP lists, with no sucess.

 

Is the irule below valid for multiple partitions?

 

 

Here's the irule:

 

 

when CLIENT_ACCEPTED {

 

 

Check if client IP is not in the allowed_clients_datagroup

 

if { not [class match [IP::client_addr] equals allowed_clients_datagroup]}{

 

 

Disallowed client IP, send a tcp reset

 

reject

 

}

 

}

 

 

 

 

thanks.