cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

ASM exclude geolocation from traffic learning

Marvin
Cirrostratus
Cirrostratus

It would be an awesome feature if it were possible to exclude geolocation countries from the ASM traffic learning, for example only allowing to learn from specific countries. Likewise preventing traffic learning entries to be spoiled with foreign countries.

 

Is there any upcoming release where it would be possible to configure geographic location exclusions in the IP address exclusion section and/or inside the traffic learning settings of ASM?

3 REPLIES 3

SanjayP
MVP
MVP

This isn't available with ASM, but can be achieved using iRule, where you can drop from blacklisted countries or allow traffic f​rom whitelisted one. So that ASM learning would be only from allowed geo locations

Yes i understand but I would still allow it but not learn from it that would be very helpful and improve the product

Hi Marvin,

 

Maybe with LTM Traffic Policy? Like this requests from US would come unfiltered to the backend.

Other alternative would be to use different policies for different country codes. Maybe for the "bad" country codes you use only a policy with Attack Signatures and Threat Campaings, but not Entity Learning.

0691T00000DzFIpQAN.pngNo offense, DE and US were the country codes I know by heart. 🙂

 

KR

Daniel

 

Edit: same can be achieved with iRules.