19-Jan-2023 18:44
I would like the ability to log the IPs that are dropped.
when FLOW_INIT {
set ipaddr [IP::client_addr]
set fromCountry [whereis $ipaddr country]
if { (not[class match $fromCountry equals AnyConnect_VPN_PermitCountryCode_DataGroup] )} {
set vsname [virtual]
# log local0.notice
drop
}
}
Solved! Go to Solution.
19-Jan-2023 22:20 - edited 19-Jan-2023 22:22
Have you tried something like this:
log local0.notice "Denied IP on VIP $vsname : $ipaddr"
19-Jan-2023 22:20 - edited 19-Jan-2023 22:22
Have you tried something like this:
log local0.notice "Denied IP on VIP $vsname : $ipaddr"
27-Jan-2023 05:29
thank you works great
27-Jan-2023 00:14
Thanks, I will try it.