ASM exclude geolocation from traffic learning

[Marvin]

It would be an awesome feature if it were possible to exclude geolocation countries from the ASM traffic learning, for example only allowing to learn from specific countries. Likewise preventing traffic learning entries to be spoiled with foreign countries.

Is there any upcoming release where it would be possible to configure geographic location exclusions in the IP address exclusion section and/or inside the traffic learning settings of ASM?

[SanjayP]

This isn't available with ASM, but can be achieved using iRule, where you can drop from blacklisted countries or allow traffic f​rom whitelisted one. So that ASM learning would be only from allowed geo locations

[Marvin]

Yes i understand but I would still allow it but not learn from it that would be very helpful and improve the product

[Daniel_Wolf]

Hi Marvin,

Maybe with LTM Traffic Policy? Like this requests from US would come unfiltered to the backend.

Other alternative would be to use different policies for different country codes. Maybe for the "bad" country codes you use only a policy with Attack Signatures and Threat Campaings, but not Entity Learning.

No offense, DE and US were the country codes I know by heart. 🙂

KR

Daniel

Edit: same can be achieved with iRules.