CrowdSRC - DevCentral

Web UI Tweaks

Problem this snippet solves:This snippet adds UI tweaks to v12 (for v13 and v14 devices, use the BETA). It's been tested by me, but use it at your own risk. :) Here's a list of what it does: Pool improvementsPool list member statuses When the pools ...

Block IP after a number of ASM Blocks

Problem this snippet solves:There is no reason to let Attacker hand over all information at once.How to use this snippet:Add the iRule to the virtual Server and activate iRule after ASM Block in the ASM Profile.Please let me know if you need help wit...

FQDN nodes in non-default route domains

Problem this snippet solves:Currently there is no support for FQDN nodes in non-default route domains as per Article. With recent increase in cloud deployment, most of the time there is a requirement from F5 to load balance to servers or ELB in the ...

Dynamic IP update of Azure IP Ranges and store them in data-groups

Problem this snippet solves:This script fetches the Azure IP Ranges (IPv4 and/or IPv6) JSON file from Microsoft's Azure IP Ranges and Service Tags page and dynamically creates and updates IPv4 and IPv6 data groups. These datagroups can be used to all...

Export GTM/DNS Configuration in CSV - tmsh cli script

Problem this snippet solves:This is a simple cli script used to collect all the WideIP, LB Method, Status, State, Pool Name, Pool LB, Pool Members, Pool Fall back, Last Resort pool info in CSV format.A sample output would be like below,One can custom...

Force BotDefense Captcha on Specified URL

Problem this snippet solves:This iRule will force BotDefense to (if it hasn't already) throw up a captcha for a specified URL. This can be helpful when mitigating an attack or for general spam protection purposes.How to use this snippet:The iRule can...

CVE-2021 Checker iApp

Problem this snippet solves:OverviewThis iApp shows you at a glance the vulnerability status of your BIG-IP against the March 2021 CVEs. This is based on the software version mainly and the modules provisioned, appliance mode etc, it does not look at...

Example NGINX App Protect deployed on Kubernetes Ingress Controller

Problem this snippet solves:This code offers a couple of examples of deploying NGINX App Protect on Kubernetes Ingress Controller, showing one instance protecting traditional Web applications and one protecting API applications.How to use this snippe...

Example OWASP Top 10-compliant declarative WAF policy

Problem this snippet solves:This is an example of a basic declarative BIG-IP WAF policy that is OWASP Top 10-compliant. This policy can be used as a starting point for a production-ready version. A companion Dev Central article discussing this polic...

Managing Subsets of Data-Group Records with BIGREST

Problem this snippet solves:This script uses iControl REST with the options query parameter to pass records data to the tmsh command for data-groups so individual records can be added/modified/removed since the records themselves are not a subcollect...

Creating a tmsh script with iControl REST and using it to restart HTTPD

Problem this snippet solves:TMSH has the ability to create tcl scripts that can be used to run multiple commands and transactions. It is rare that you will want to create on with TMSH but there are a few cases where this may be desirable. One of thes...

Capture Virtual Server Clientssl Profile & Ciphers Mapping - Bash

Problem this snippet solves:The code will help you capture all client ssl profiles present on the bigip. For every client ssl profile that's there, it will pull its ciphers suite & if the client-ssl profile is referenced in any of the virtuals that's...

DNS over HTTP iApp

Problem this snippet solves:DNS over HTTP is a way of resolving DNS over an encrypted HTTPS stream meaning that service providers can't intercept and modify the responses.This iApp creates an iRule which performs resolution of DNS over HTTPS (DoH) tr...

Using a BIG-IP EAV external monitor to monitor HTTP/2 h2c servers

Problem this snippet solves:IntroductionBeginning in BIG-IP 14.1.0, F5 provides full proxy (client and server side) support for the HTTP/2 protocol. HTTP/2 connections can run over HTTP without TLS in plaintext or HTTPS with TLS encryption. h2 is the...

iRule Event Order Flowchart

Problem this snippet solves:The original contributions are from https://devcentral.f5.com/s/articles/http-event-order-access-policy-managerI have updated this code example to use draw.io so that anyone can update diagram for required changes.Attempt ...

Do you know how to prevent horizontal privilege escalation using F5?

Problem this snippet solves:Do you know how to prevent horizontal privilege escalation using F5?that's what we already did for one of our customers, F5 WAF can protect the web application from unauthenticated attacks or even vertical privilege escala...

20 Lines or Less

Problem this snippet solves:This codeshare entry links to the irules-toolbox repo on Github, where all the iRules samples shared in the old 20 Lines or Less articles are now homed.How to use this snippet:Tested this on version:No Version Found

Create or edit "Charge back Tab" in ELA license

Problem this snippet solves:You are using BiG-IQ or BIGIQ License manager to look after your ELA licenses.The Charge back tag is visible on the customer usage reports, and can be useful if you bill across multiple departments within the account.When ...

Code to create unreachable ELA license files from BIG-IQ

Problem this snippet solves:BIG-IQ traditionally expects to be able to reach any BIG-IP devices it is going to license.This code helps create a license file from the ELA SKU offerings which can be applied on an Unreachable BIG-IP.How to use this snip...

CheckMk F5 Certificate Expiration using SNMP

Problem this snippet solves:The default checks provided by CheckMK do not monitor for the traffic certificate expiration. I wrote a custom check to allow them to be discovered and monitored. The default values of 30 days for warning and 10 days for c...