For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MaxMedov's avatar
MaxMedov
Icon for Cirrostratus rankCirrostratus
Apr 18, 2023

Block specific Client IP if request contains XYZ

Hi, I need help creating the fastest solution (LTM Policy / iRule / other) to do this: If client IP = X.X.X.X and request contains = XYZ Drop the client / or block by WAF message Thank you! ...
security
MaxMedov's avatar
MaxMedov
Icon for Cirrostratus rankCirrostratus
Apr 18, 2023

So what is better?

Michael_Saleem's avatar
Michael_Saleem
Icon for MVP rankMVP
Apr 18, 2023

If you are using a mixture of upper and lowercase letters in your URI and you need an exact match on this, then remove the [string tolower]

when HTTP_REQUEST {
    if { ( ( [IP::addr [IP::client_addr] equals X.X.X.X] ) && ( [HTTP::uri] contains "XYZ" ) ) } {
        drop
    }
}