For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Parveez_70209's avatar
Parveez_70209
Icon for Nimbostratus rankNimbostratus
Dec 29, 2014

To allow TCP Port Range

We need your suggestion here:   Here is the traffic flow of the customer accessing our web-based solution :   Customer IPSEC VPN > JDA IPSEC VPN > JDA F5:   Till now they got one service run...
Parveez_70209's avatar
Parveez_70209
Icon for Nimbostratus rankNimbostratus
Dec 30, 2014

Ok Great. Summarizing the points and the Irule, kindly cross-check whether I am correct here:

 

Keeping in mind that traffic is bi-directional, Client will reach us and fetch the data from the application-servers.

 

Planning the below:

 

  1. Disable HTTP and HTTPS Virtual-Server.
  2. Modify anyone of the existing Virtual-Server as Standard Type with Listening port 0.
  3. And also go back to Pool and modify the listening port of the application-member-server as 0.
  4. Incase point 3 is correct, kindly let us know what will be the correct monitor to set the same.
  5. Or else, if we don’t do point number 3 and keep the application-servers listening port as existing 8880 not 0, and instead if we need to disable "Port Translation" in the Virtual Server, will it be same ?
  6. If all the other points are valid, and if our intention is to allow ports 7000-7999,8880 which is currently running into the application-server, than I think the below Irule should work ?
  7. If the below Irule is good, but whether it will be CLIENT_ACCEPED or SERVER_ACCEPTED.

when CLIENT_ACCEPTED {

 

Check if requested port is outside 7000 - 7999, 8880 if { ([TCP::local_port] > 7000 and [TCP::local_port] < 8000) or [TCP::local_port] == 8880 or [TCP::local_port] == 1521 }{ Accept request } }

 

Thanks and Regards PZ