F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP LTM
  4. BIG-IP Local Traffic Manager: Implementations
  5. Enabling IP Address Intelligence
Manual Chapter : Enabling IP Address Intelligence

Applies To:

Show Versions Show Versions

BIG-IP LTM

  • 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

Enabling IP Address Intelligence

Overview: Enabling IP address intelligence

An IP intelligence database is a list of IP addresses with questionable reputations. IP addresses gain a questionable reputation and are added to the database as a result of having performed exploits or attacks, or these addresses might represent proxy servers, scanners, or systems that have been infected. You can prevent system attacks by excluding traffic from malicious IP addresses. The IP Intelligence database is maintained online by a third party.

The BIG-IP® system can connect to an IP intelligence database, download the contents, and automatically keep the database up to date. You use iRules® to instruct the system on how to use IP address intelligence information. For example, iRules can instruct the system to verify the reputation of and log the originating IP address of all requests.

You can also use the IP address intelligence information within security policies in the Application Security Manager™ to log or block requests from IP addresses with questionable reputations.

Task Summary

Downloading the IP address intelligence database

The requirements for using IP address intelligence are:
  • The system must have an IP Intelligence license.
  • The system must have an Internet connection either directly or through an HTTP proxy server.
  • The system must have DNS configured (go to System > Configuration > Device > DNS ).
Important: IP address intelligence is enabled by default if you have a license for it. You only need to enable it if it was previously disabled.
To enable IP address intelligence on the BIG-IP® system, you enable auto-update to download the IP intelligence database to the system.
  1. Log in to the command line for the system.
  2. To determine whether IP intelligence auto-update is enabled, type the following command: tmsh list sys db iprep.autoupdate
    If the value of the iprep.autoupdate variable is disable, IP intelligence is not enabled. If it is enable, your task is complete. No further steps are necessary.
  3. If disabled, at the prompt, type tmsh modify sys db iprep.autoupdate value enable
    The system downloads the IP intelligence database and stores it in the binary file, /var/IpRep/F5IpRep.dat. It is updated every 5 minutes.
  4. If the BIG-IP system is behind a firewall, make sure that the BIG-IP system has external access to vector.brightcloud.com using port 443.
    That is the IP Intelligence server from which the system gets IP Intelligence information.
  5. Optional: If the BIG-IP system connects to the Internet using a forward proxy server, set these system database variables.
    1. Type tmsh modify sys db proxy.host value hostname to specify the host name of the proxy server.
    2. Type tmsh modify sys db proxy.port value port_number to specify the port number of the proxy server.
    3. Type tmsh modify sys db proxy.username value username to specify the user name to log in to the proxy server.
    4. Type tmsh modify sys db proxy.password value password to specify the password to log in to the proxy server.
The IP address intelligence feature remains enabled unless you disable it with the command tmsh modify sys db iprep.autoupdate value disable.

Creating an iRule to log IP address intelligence information

Before you can create an iRule to log IP address intelligence information, your system must have IP address intelligence enabled.
You use iRules® to log IP address intelligence categories to the file /var/log/ltm. This is an example of the type of iRule you can write.
  1. On the Main tab, click Local Traffic > iRules .
    The iRule List screen opens, displaying any existing iRules.
  2. Click Create.
    The New iRule screen opens.
  3. In the Name field, type a name, such as my_irule.
    The full path name of the iRule cannot exceed 255 characters.
  4. In the Definition field, type the iRule using Tool Command Language (Tcl) syntax.
    For example, to log all IP addresses and any associated IP address intelligence categories, type the following iRule:
    when CLIENT_ACCEPTED {
             log local0. "IP Address Intelligence for IP address [IP::client_addr]: 
             [IP::reputation [IP::client_addr]]"
           }
    Tip: For complete and detailed information on iRules syntax, see the F5 Networks DevCentral web site (http://devcentral.f5.com).
  5. Click Finished.
    The new iRule appears in the list of iRules on the system.
When traffic is received from an IP address with a questionable reputation and that is included in the IP intelligence database, the system prints the IP address intelligence information in the /var/log/ltm log.
For complete and detailed information about iRules syntax, see the F5 Networks DevCentral web site, http://devcentral.f5.com.

Creating an iRule to reject requests with questionable IP addresses

Before you can create an iRule to reject requests based on an IP address reputation, your system must have IP address intelligence enabled.
You can use iRules® to reject requests from IP addresses that have questionable reputations and are listed in the IP intelligence database. This is an example of the type of iRule you can write.
  1. On the Main tab, click Local Traffic > iRules .
    The iRule List screen opens, displaying any existing iRules.
  2. Click Create.
    The New iRule screen opens.
  3. In the Name field, type a name, such as my_irule.
    The full path name of the iRule cannot exceed 255 characters.
  4. In the Definition field, type the iRule using Tool Command Language (Tcl) syntax.
    For example, to reject requests from IP addresses listed in the IP intelligence database because they could be Windows Exploits or Web Attacks, type the following iRule:
    when HTTP_REQUEST { 
    set ip_reputation_categories [IP::reputation [IP::client_addr]]
    set is_reject 0
    if {($ip_reputation_categories contains "Windows Exploits")} {
       set is_reject 1
    } 
    if {($ip_reputation_categories contains "Web Attacks")} {
       set is_reject 1
    } 
    if {($is_reject)} {
        log local0. "Attempted access from malicious IP address [IP::client_addr]
        ($ip_reputation_categories), request was rejected"
        HTTP::respond 200 content 
        "<HTML><HEAD><TITLE>Rejected Request</TITLE>
        </HEAD><BODY>The request was rejected. <BR> 
        Attempted access from malicious IP address</BODY></HTML>"
    }
}
    Tip: For complete and detailed information about iRules syntax, see the F5 Networks DevCentral web site (http://devcentral.f5.com).
  5. Click Finished.
    The new iRule appears in the list of iRules on the system.
When the system receives traffic from an IP address that is included in the IP intelligence database, the system prints the IP address intelligence information in the /var/log/ltm log.

Checking the reputation of an IP address

Before you can verify the reputation of an IP address, your system must have IP address intelligence enabled.
You can verify the reputation of a specific IP address.
  1. Log in to the command line for the system.
  2. At the prompt, type iprep_lookup IP_address
    where IP_address is the address whose reputation you want to verify. For example, to verify 1.1.1.1:
    iprep_lookup 1.1.1.1
                      opening database in /var/IpRep/F5IpRep.dat
                      size of IP reputation database = 41693298
                      iprep threats list for ip = 1.1.1.1 is:
                             bit 4 - Scanners
                             bit 5 - Denial of Service
    The system looks up the IP address, and if it is in the database, the command output displays the IP address intelligence categories that show the reason. In this case, 1.1.1.1 is a source of potential port or network scans and DoS attacks. If the IP address is not found in the IP intelligence database, the system returns the message iprep_lookup not found for ip = <ip_address> .

Checking the status of the IP intelligence database

You can display the status of the IP Intelligence database to learn when it was last updated and the number of questionable IP addresses it contains.
  1. Log in to the command line for the system.
  2. To display IP intelligence database status, type tmsh show sys iprep-status.
    The system displays the status. For example:
    -----------------------------------------------------------------------
Sys::IP Reputation Database Status
-----------------------------------------------------------------------
Last time the server was contacted for updates      04/21/2012 09:33:31
Last time an update was received                    04/21/2012 09:33:31
Total number of IP Addresses in the database                    5516336
Number of IP Addresses received in the last update                  136

IP address intelligence categories

Along with the IP address, the IP intelligence database stores the category that explains the reason that the IP address is considered untrustworthy.

Category Name Description
Botnets IP addresses of computers that are infected with malicious software (Botnet Command and Control channels, and infected zombie machines) and are controlled as a group by a Bot master, and are now part of a botnet. Hackers can exploit botnets to send spam messages, launch various attacks, or cause target systems to behave in other unpredictable ways.
  IP addresses and networks that belong to cloud providers, which offer services hosted on their servers via the Internet.
Denial-of-Service IP addresses that have launched denial-of-service (DoS) attacks, distributed denial-of-service (DDoS) attacks, anomalous SYN flood attacks, or anomalous traffic detection. These attacks are usually requests for legitimate services, but occur at such a fast rate that targeted systems cannot respond quickly enough and become bogged down or unable to service legitimate clients.
Illegal Websites IP addresses that contain criminally obscene or potentially criminal internet copyright and intellectual property violations.
Infected Sources Active IP addresses that issue HTTP requests with a low reputation index score, or that are known malicious web sites offering or distributing malware, shell code, rootkits, worms, or viruses.
Phishing Proxies IP addresses that host phishing sites, and other kinds of fraud activities, such as ad click fraud or gaming fraud.
Scanners IP addresses that are involved in reconnaissance, such as probes, host scan, domain scan, and password brute force, typically to identify vulnerabilities for later exploits.
Web Attacks IP addresses involved in cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute force.
Windows Exploits Active IP addresses that have exercised various exploits against Windows resources by offering or distributing malware, shell code, rootkits, worms, or viruses using browsers, programs, downloaded files, scripts, or operating system vulnerabilities.
Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information