Forum Discussion

puneet_mandyal_'s avatar
puneet_mandyal_
Icon for Nimbostratus rankNimbostratus
Mar 28, 2018

SFTP port 22 to be allowed on specfic IP addresses

Hi All,

 

We have SFTP allowed on f5 and we need to narrow down the access parameter to hit by specific IP address How We can create rule for SFTP allow on specific IP addresses

 

BIG-IP
LTM
security
  • HarshaPotharaju's avatar
    HarshaPotharaju
    Icon for Nimbostratus rankNimbostratus
    Mar 28, 2018

    I guess this is what you are looking for. Test it and let me know how this is working.

    when CLIENT_ACCEPTED {

if { [IP::client_addr] equals "x.x.x.x" } {
    pool your_pool_name
    log local0. "Request for service at port [TCP::local_port] from [IP::client_addr]"}
else {
    reject
    }
}
  • oguzy's avatar
    oguzy
    Icon for Cirrostratus rankCirrostratus
    Mar 28, 2018

    Hi,

    You can use Data Groups within an irule.

    For instance;

    when CLIENT_ACCEPTED {
    Comparing source IP to a list of entries in a LTM data-group.
   if { not ( [class match [IP::remote_addr] equals data_SourceIps ] ) } {
      reject;
   }

}