Forum Discussion

sunny123's avatar
sunny123
Icon for Nimbostratus rankNimbostratus
Mar 28, 2023

F5 LTM/ASM , I-rule to ignore query string to prevent DDOS attack.

Hello guys, My environment : F5 ltm, ASM learning mode. Webapp: Public facing site with many pages with  few search pages and filtering pages. I see many people are hitting the site with unknow qu...
application delivery
KeesvandenBos's avatar
KeesvandenBos
Icon for MVP rankMVP
Mar 28, 2023

Hi Juna,
You could use this irule:

when HTTP_REQUEST {
 if {!([string tolower [HTTP::query]] contains "utm" || [string tolower [HTTP::query]] contains "gclid")} {
  HTTP::respond 302 Location "http://www.domain.org"
}