Block IP Addresses With Data Group And Log Requests On ASM Event Log

Problem this snippet solves:

This is Irule which will block IP Addresses that are not allowed in your organization. instead of adding each IP Address in Security ›› Application Security : IP Addresses : IP Address Exceptions you can create a data group and use a simple IRULE to block hundreds of Addressess. Also,createing a unique signature to specify the request of the illigile IP Address.

First, You will need to create Data Group under Local Traffic ›› iRules : Data Group List and add your illigile IP Addresses to the list. If you have hundreds of IP's that you want to block, you can to it in TMSH using this command: TMSH/modify ltm data-group internal <Data-Group-Name> { records add {IP-ADDRESS} }

Now, We are ready to create the IRULE under Local Traffic ›› iRules : iRule List

Last, Create violation list under Security ›› Options : Application Security : Advanced Configuration : Violations List Create -> Name:Illegal_IP_Address -> Type:Access Violation -> Severity:Critical -> Update

Don't forgat to enable trigger ASM IRULE events with "Normal Mode"

How to use this snippet:

Code :

  set reqBlock 0
  if { [class match [IP::remote_addr] equals ] } {
  set reqBlock 1
 # log local0. "HTTP_REQUEST [IP::client_addr]"

  if { $reqBlock == 1} {
    ASM::raise "Illegal_IP_Address"
  #    log local0. "ASM_REQUEST_DONE [IP::client_addr]"

Tested this on version:

Published Feb 17, 2019
Version 1.0

Was this article helpful?


  • It's missing this step: Security>>Application Security: Policy Building:Learning and Blocking Settings

    search for Custom Violations section and enable Alarm and Block settings for the just created violation Illegal_IP_Address.

    Tested on version 16.1.4.x

      • renaranj2024's avatar
        Icon for Nimbostratus rankNimbostratus

        Use this procedure and add the two steps I wrote. 

        The Code works fine. Use you datagroup name and custom violation name.

  • 1982's avatar
    Icon for Nimbostratus rankNimbostratus

    Thanks for sharing, but I can't understand them very well the code, you hide some parts, why?