ABOUT DEVCENTRAL

DevCentral News Technical Forum Technical Articles Technical CrowdSRC Community Guidelines DevCentral EULA Get a Developer Lab License Become a DevCentral MVP

RESOURCES

Product Documentation White Papers Glossary Customer Stories Webinars Free Online Courses F5 Certification LearnF5 Training

SUPPORT

Manage Subscriptions Professional Services Professional Services Create a Service Request Software Downloads Support Portal

PARTNERS

Find a Reseller Partner Technology Alliances Become an F5 Partner Login to Partner Central

---

©2024 F5, Inc. All rights reserved.

Problem this snippet solves:

This is Irule which will block IP Addresses that are not allowed in your organization.\ninstead of adding each IP Address in Security ›› Application Security : IP Addresses : IP Address Exceptions you can create a data group and use a simple IRULE to block hundreds of Addressess.\nAlso,createing a unique signature to specify the request of the illigile IP Address.

First, You will need to create Data Group under Local Traffic ›› iRules : Data Group List and add your illigile IP Addresses to the list.\nIf you have hundreds of IP's that you want to block, you can to it in TMSH using this command: TMSH/modify ltm data-group internal <Data-Group-Name> { records add {IP-ADDRESS} }

Now, We are ready to create the IRULE under Local Traffic ›› iRules : iRule List

Last, Create violation list under Security ›› Options : Application Security : Advanced Configuration : Violations List\nCreate -> Name:Illegal_IP_Address -> Type:Access Violation -> Severity:Critical -> Update

Don't forgat to enable trigger ASM IRULE events with \"Normal Mode\"

How to use this snippet:

Code :

when HTTP_REQUEST {\n  set reqBlock 0\n  if { [class match [IP::remote_addr] equals ] } {\n  set reqBlock 1\n # log local0. \"HTTP_REQUEST [IP::client_addr]\"\n  }\n}\n\nwhen ASM_REQUEST_DONE {\n  if { $reqBlock == 1} {\n    ASM::raise \"Illegal_IP_Address\"\n  #    log local0. \"ASM_REQUEST_DONE [IP::client_addr]\"\n  }\n}

Tested this on version:

Problem this snippet solves:

This is Irule which will block IP Addresses that are not allowed in your organization.\ninstead of adding each IP Address in Security ›› Application Security : IP Addresses : IP Address Exceptions you can create a data group and use a simple IRULE to block hundreds of Addressess.\nAlso,createing a unique signature to specify the request of the illigile IP Address.

First, You will need to create Data Group under Local Traffic ›› iRules : Data Group List and add your illigile IP Addresses to the list.\nIf you have hundreds of IP's that you want to block, you can to it in TMSH using this command: TMSH/modify ltm data-group internal <Data-Group-Name> { records add {IP-ADDRESS} }

Now, We are ready to create the IRULE under Local Traffic ›› iRules : iRule List

Last, Create violation list under Security ›› Options : Application Security : Advanced Configuration : Violations List\nCreate -> Name:Illegal_IP_Address -> Type:Access Violation -> Severity:Critical -> Update

Don't forgat to enable trigger ASM IRULE events with \"Normal Mode\"

How to use this snippet:

Code :

when HTTP_REQUEST {\n  set reqBlock 0\n  if { [class match [IP::remote_addr] equals ] } {\n  set reqBlock 1\n # log local0. \"HTTP_REQUEST [IP::client_addr]\"\n  }\n}\n\nwhen ASM_REQUEST_DONE {\n  if { $reqBlock == 1} {\n    ASM::raise \"Illegal_IP_Address\"\n  #    log local0. \"ASM_REQUEST_DONE [IP::client_addr]\"\n  }\n}

Tested this on version:

It's missing this step: Security>>Application Security: Policy Building:Learning and Blocking Settings

search for Custom Violations section and enable Alarm and Block settings for the just created violation Illegal_IP_Address.

Tested on version 16.1.4.x

It's missing this step: Security>>Application Security: Policy Building:Learning and Blocking Settings

search for Custom Violations section and enable Alarm and Block settings for the just created violation Illegal_IP_Address.

Tested on version 16.1.4.x

renaranj2024 is possible to create a new how-to using your version?

Use this procedure and add the two steps I wrote. 

The Code works fine. Use you datagroup name and custom violation name.

Ok, I'll try to use it, the same code from the example, my concern is blocking everything, not just the Black_list IPs, but all sources.