For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Farid_Lahdiri_1's avatar
Farid_Lahdiri_1
Icon for Nimbostratus rankNimbostratus
Oct 19, 2005

Security hardening question

Hi all,   I need to implement the requirement below in both 4.5.11 and 9.1   Any help/clues to get started on this will be appreciated.   Thanks in advance.   /Farid     Req: Ingr...
application delivery
dev
devops
iRules
v4
Martin_Machacek's avatar
Martin_Machacek
Historic F5 Account
Oct 31, 2005
Farid,

 

 

this cannot be done with iRules in 4.x.

 

 

However, BIG-IP (for most practical purposes) drops source routed packets by default. The behavior is controlled with sysctl variable "net.inet.ip.forwsrcrt" which is set to 0 by default. It means that all connection initiating source routed packets (e.g. TCP packets with SYN bit set) and all packets addressed to local addresses (self-IPs) and SSL proxy addresses are refused. Source routed packets belonging to already established loadbalanced connections (i.e. connections to virtual addresses) and/or UDP flows are forwarded but any source routes are ignored.

 

 

BIG-IP 4.x does not allow to configure any egress filtering.