NimbostratusHave a Virtual server which is hosting traffic from internet and is hosting service port SMTP & UDP 53 . As per the vulnerability check its been found that the VIP is open also on SNMP and cpuple of other ports . Can you restrict other ports access from outside through an Irule ? can anyone please advice on the same
Assuming you are talking about LTM Virtual Servers, it is useful to distinguish two concepts: a Virtual IP and a Virtual Server. A Virtual IP is just that: an IP addresses for which the BIG-IP may accept traffic. A Virtual Server is a Virtual IP, a port and a protocol. A BIG-IP will reject all traffic that matches a VIP but does not match a Virtual Server -- unless you change the global setting for this, but you have to go out of your way to do that. If, on the other hand, a wildcard VS (that is, a Virtual Server listening on all ports) is defined for a VIP, naturally, traffic for any port will be accepted. Finally, if a VIP matches a self-IP, the self-IP may accept local traffic. But you should avoid this type of configuration.
Ordinarily you should not need an iRule or something similar to prevent traffic.
Nimbostratus
EmployeeAssuming you are talking about LTM Virtual Servers, it is useful to distinguish two concepts: a Virtual IP and a Virtual Server. A Virtual IP is just that: an IP addresses for which the BIG-IP may accept traffic. A Virtual Server is a Virtual IP, a port and a protocol. A BIG-IP will reject all traffic that matches a VIP but does not match a Virtual Server -- unless you change the global setting for this, but you have to go out of your way to do that. If, on the other hand, a wildcard VS (that is, a Virtual Server listening on all ports) is defined for a VIP, naturally, traffic for any port will be accepted. Finally, if a VIP matches a self-IP, the self-IP may accept local traffic. But you should avoid this type of configuration.
Ordinarily you should not need an iRule or something similar to prevent traffic.
Nimbostratus
CirrusLTM will not accept the traffic unless you defined to accept (proxy thing). What do you see in the capture? is 'not defined' traffic getting dropped at VIP ?
CirrostratusThat behaviour certainly is unexpected. The BigIP itself should not answer those ports assuming that the virtuals are configured properly. I'm not sure whether this is even possible, but do you happen to have a bidirectional NAT in place for the same IP address the virtual is using? That NAT might be forwarding traffic not accounted by the virtual to some server that will answer requests itself, for example SNMP (161/udp). Just an idea...
HTH
Martin
