Multiple source address on virtual server

[Davethoonsen]

Hi,

How can I use multiple source addresses on a virtual server? The source is currently 0.0.0.0%15/0 and I have to enter certain /32 addresses in here and exclude the default permit. Also, I can imagine that the sources can exist from multiple route domains so how would I note that down?

I would think I could either implement the following in CLI or GUI: 1.1.1.1%15/32 , 2.2.2.2%13/32 and so on.

EDIT: separating prefixes by comma's won't work so I guess the only suitable way to fix this is by inserting an iRule. I do however don't want to over complex it for my colleagues so are there other ways to add multiple source addresses?

Would love to hear about this.

Kind regards,

Dave Thoonsen

[CP_Scott]

I think you can make separate VS instances for each separate 'source address' need, but that becomes brutal very quickly, and hard to maintain parity between configurations. If you're using this as a firewall configuration to enforce traffic rules, an irule is the free way, or purchasing the AFM module is the supported, easily understood way for long term support.

[Niels_van_Sluis · Accepted solution]

From version 14 you can make address lists and select these as source address.

Create an address list:

Add it to the virtual server:

Hope this answers your question.

[MaximP]

Unfortunately, an address list doesn't work if you have a virtual server with the same destination IP-port and source-range 0.0.0.0/0.

Here some more details about it https://support.f5.com/csp/article/K47569205 

Only way is creating VS with particular host IP

[Davethoonsen]

That seems like a very viable option Niels. I guess we have another reason to upgrade to version 14 as we currently reside on version 13.x

Thanks for the help!