Forum Discussion

PeterWaz's avatar
PeterWaz
Icon for Nimbostratus rankNimbostratus
May 22, 2020

Trying to block users from using Outlook mobile app

During our 365 migration, a few users have had issues with accounts locking out. We have F5 running as a load balancer and I can see bad sessions come in from the Outlook mobile app. Trying to delete the account off the user's mobile device does not fix the issue. I want to drop any sessions for the Outlook app for these users. I am very new to F5 and don't have much experience with the iRules. I created an iRule group with the usernames of these users called OutlookAppUsers and have the following iRule:

 

when HTTP_REQUEST {

if { [class match [HTTP::header "User-Agent"] contains "Outlook-iOS-Android"] and [class match [HTTP::username] contains OutlookAppUsers] } 

{

drop

}

}

 

Not surprised that it didn't work. Just looking for some guidance. Thank you.

application delivery
BIG-IP
iRules

1 Reply

Sort By
  • PeterWaz's avatar
    PeterWaz
    Icon for Nimbostratus rankNimbostratus
    May 26, 2020

    For future reference, I figured out my issues with this. First, I changed the first part of the IF statement to [class match [HTTP::header "User-Agent"] contains OutlokApp] and created a group with the possible iterations of the Outlook App header. I then also realized that I did not add the rule to a virtual server, so it was never running. Once I did both, the rule worked.