Forum Discussion

Farid_Lahdiri_1's avatar
Farid_Lahdiri_1
Icon for Nimbostratus rankNimbostratus
Oct 19, 2005

Security hardening question

Hi all,

 

I need to implement the requirement below in both 4.5.11 and 9.1

 

Any help/clues to get started on this will be appreciated.

 

Thanks in advance.

 

/Farid

 

 

Req: Ingress (inbound) and egress (outbound) source routed packets SHALL be blocked by the load balancers.

 

 

 

application delivery
dev
devops
iRules
v4
  • Martin_Machacek's avatar
    Martin_Machacek
    Historic F5 Account
    Oct 31, 2005
    Farid,

     

     

    this cannot be done with iRules in 4.x.

     

     

    However, BIG-IP (for most practical purposes) drops source routed packets by default. The behavior is controlled with sysctl variable "net.inet.ip.forwsrcrt" which is set to 0 by default. It means that all connection initiating source routed packets (e.g. TCP packets with SYN bit set) and all packets addressed to local addresses (self-IPs) and SSL proxy addresses are refused. Source routed packets belonging to already established loadbalanced connections (i.e. connections to virtual addresses) and/or UDP flows are forwarded but any source routes are ignored.

     

     

    BIG-IP 4.x does not allow to configure any egress filtering.