Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Sep 12, 2017

GTM / DNS Delivery - Set an exception group of local ports to avoid - Reselect if port matched

This is a unique issue and this solution will not be a permanent one but we have a security agent that is erroneously flagging GTM traffic being balanced to our MS DNS servers. When certain ports are used as the local port by GTM, the security agent on the DCs analyzes this traffic as related to an exploit and locks up DNS. The correct action would be to configure an exception in the agent, but as these agents are not managed by us, this will take some time to coordination. In the interim, I need to create an iRule that leverages a data group contained a list of port numbers that GTM cannot use. If GTM allocates one of these ports as the local port, the irule match should cause GTM to perform a reselect.

 

My pseudo code kind of looks like this:

 

when LB_SELECTED if GTM local port matches data group DATAGROUP reselect

 

Can this be done with GTM? Is there a better way to do this?

 

application delivery
BIG-IP DNS

1 Reply

Sort By
  • eric_haupt1's avatar
    eric_haupt1
    Icon for Nimbostratus rankNimbostratus
    Sep 14, 2017

    Currently testing a data group of integers that contain the ports to avoid. Then parsing against the group with this code:

     

    when LB_SELECTED {
       if { [class match [UDP::local_port] equals hbss-port-exception] } {
       LB::reselect
  }
}