ddos attack/gtm recommendations---help!

hi all,

 

 

I have a customer that is undergoing a ddos attack on their website, by url, and it has taken down the site and affected firewall performance. the dns record for the site is a bind entry on their gtm's. anyone have any ideas how we can stop this attack? (we've taken the site offline.)

 

 

ive thought about creating a new wide ip, moving the site to the wide ip, and either creating an irule to deny dns requests based on source ip (but the ip's keep jumping around....) or doing topology based load balancing.

 

 

can i configure it so gtm serves requests from north america and drops requests from asia? any suggestions?

 

 

Thanks,

 

Mike