NimbostratusDear All,
I would like to block one attack signature if it contains uniq request type on F5-ASM, without any traffic learning.
For example: I have a request from multi type IPs. I would like to block this when the request contains a uniq URL.
Is there any solutions for this problem?
AltostratusTry the below iRule , you can also change drop to return other response code if you want.
when HTTP_REQUEST {
if { ([string tolower [HTTP::uri]] contains "/example" )
&& ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
drop
}
}Thanks for your help :)
AltostratusURW Szrusko :)
CumulonimbusYou can define an ASM user defined violation and raise it if condition meet.
when HTTP_REQUEST {
set reqBlock 0
if { ([string tolower [HTTP::uri]] contains "/example" )
&& ( [IP::addr [IP::client_addr] equals x.x.x.0/24] ) } {
set reqBlock 1
}
}
when ASM_REQUEST_DONE {
if { $reqBlock == 1} {
ASM::raise VIOLATION_FORBIDDEN_URL
}
}