For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

awan_m's avatar
awan_m
Icon for Cirrostratus rankCirrostratus
May 18, 2023

allow *.microsoft.com to connect to a virtual server

Hi, i have a VIP that should only be accessable by domain *.microsoft.com - i have AFM provisioned and a DNS resolver . but the Rule cannot take *.microsoft.com as source .  is there a way to achie...
application delivery
security
awan_m's avatar
awan_m
Icon for Cirrostratus rankCirrostratus
May 18, 2023

thanks for the reply - its a specific domain IPs to be able to connect to a VIP that presents an API . the problem with an ip address list is that i will change all the time . i need to resolve the requestors IP to a domain and if its *.XYZ.com the allow it to connect .

Michael__'s avatar
Michael__
Icon for Nimbostratus rankNimbostratus
May 19, 2023

Hi,

you could try that with an irule, something that way:

when CLIENT_ACCEPTED {

  set CLIENTIP [IP::client_addr]
  set PTR "[lindex [RESOLV::lookup @1.1.1.1 -ptr $CLIENTIP] 0]"
  set PTRreverse "[lindex [RESOLV::lookup @1.1.1.1 -a $PTR] 0]"

  if {($CLIENTIP eq $PTRreverse) && ($PTR ends_with ".microsoft.com")}{
     log local0. "OK - $CLIENTIP - $PTR - $PTRreverse -"

   } else {
     log local0. "FAIL - $CLIENTIP - $PTR - $PTRreverse -" 
       reject
  }
}