For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Check1t_282465's avatar
Check1t_282465
Icon for Nimbostratus rankNimbostratus
Jul 24, 2017

Utilize iRule to minimize APM usage

I have an Access Profile which is invoked for an application in which a) Checks source IP. If whitelisted subnet, allowed to pass through. Otherwise b) Checks URI. if specificied URI requested, c) F...
BIG-IP Access Policy Manager (APM)
security
Jad_Tabbara__J1's avatar
Jad_Tabbara__J1
Icon for Cirrostratus rankCirrostratus
Jul 24, 2017

Hello Check1t,

Yes you can reduce the number of session consumed by the APM by writing an irule.

The irule can take many forms but the important is to use "Access::disable" "Access::enable".

If you don't have many subnets to whitelist you can do it like this : 

when HTTP_REQUEST {

ACCESS::disable

if { ([HTTP::uri] starts_with "/admin") && ! ([IP::addr [IP::client_addr] equals 192.168.1.0/24]) && ! ([IP::addr [IP::client_addr] equals 192.168.2.0/24]) } {
   Only client IP that are not in subnets 192.168.1.0/24 and 192.168.2.0/24 and requesting /admin will use APM  

   ACCESS::enable
}
}

If you have more subnets, you can use datagroup for clarity.

Regards