Forum Discussion

Najm's avatar
Najm
Icon for Cirrus rankCirrus
Jul 29, 2023
Solved

Block traffic

How to know the traffic it block through F5

  • Najm This depends on how you are blocking traffic. If you have it logging then you would typically see this in your LTM logs.

  • Hi Najm , 

    > Review Event logs , if you provision AWAF Module >>> you will be able to see the blocked requests clearly.

    > if a specific user complains , run tcpdump for this user IP only to see what happen to him and his traffic flow behavior. 

    > Review the Packet filteres , if you configure it. 

    > if much users complian and your service almost down or huge delay in your network : 
    disable ( L7 profille such as http profile ) and ( use performance L4 virtual server type ) consider any existing irules or LTM policies or AWAF policy attached to this virtual server >>> you will need to disable them too just in the time of troubleshooting and attach them back upon finishing. 


2 Replies

  • Najm This depends on how you are blocking traffic. If you have it logging then you would typically see this in your LTM logs.

  • Hi Najm , 

    > Review Event logs , if you provision AWAF Module >>> you will be able to see the blocked requests clearly.

    > if a specific user complains , run tcpdump for this user IP only to see what happen to him and his traffic flow behavior. 

    > Review the Packet filteres , if you configure it. 

    > if much users complian and your service almost down or huge delay in your network : 
    disable ( L7 profille such as http profile ) and ( use performance L4 virtual server type ) consider any existing irules or LTM policies or AWAF policy attached to this virtual server >>> you will need to disable them too just in the time of troubleshooting and attach them back upon finishing.