F5 Firewall - drop traffic  from specific IP/Rangs of IPs

Posted on 2014-03-11
Last Modified: 2014-03-15
In case of a DDOS attack, is there way to drop traffic from certain IPs dynamically?
I mean I wish to have a rule in place on firewall to isolate traffic if requests/sec, response time jumps ahead of usual matrix.

Can you please detail me step-by-step how this could be achieved.

Question by:crazywolf2010
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

by:Martin Tarlink
ID: 39920517
HERE you can find good articlea bout it . Look under Firewall section

You did not specified what Firewall you use
To prevent DDoS on Cisco ASA  you could also add  IPS SSP module/license
LVL 25

Expert Comment

ID: 39922728
I suggest you contact F5 support their support is very good.
They will do the config you need and send you the details if you request.
LVL 27

Accepted Solution

skullnobrains earned 500 total points
ID: 39931373
it is feasible but mosrt likely useless : any properly crafted DOS attack will manage to saturate your internet link. blocking the packets on your firewall will not change that.

you'd need your ISP to do the blocking somewhere upstream

if you host services which are DOSed on a regular basis, some companies such as cloudflare provide dedicated antidos services by acting as reverse proxies between the wan and you. obviously if you're already under attack, you'd need to change ips or have your isp block traffic that do not come from the proxies

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Clarification about access via WAN 6 52
Can VBS count the number of items in an array 8 95
Connectivity drops 9 82
FTP through ASA 9.5 1 39
Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question