-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathf5_sample.txt
7110 lines (7105 loc) · 206 KB
/
f5_sample.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
apm apm-avr-config apm-avr-config { }
apm epsec epsec-package epsec-1.0.0-679.0.iso {
checksum SHA1:73635840:359c8fbc9de65fbb4ea48075071b4b7abd8f0b47
create-time 2018-08-10:15:53:36
last-update-time 2018-03-28:22:11:42
mode 33188
oesis-version 4.2.1439.0
revision 1
size 73635840
updated-by root
version 1.0.0-679.0
}
apm report default-report {
report-name sessionReports/sessionSummary
user admin
}
asm policy RHWeb_Base_ASM_Policy {
active
encoding utf-8
}
asm policy wordpress_template {
encoding utf-8
}
asm predefined-policy POLICY_TEMPLATE_ACTIVESYNC_V1_0_V2_0_HTTP { }
asm predefined-policy POLICY_TEMPLATE_ACTIVESYNC_V1_0_V2_0_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_LOTUSDOMINO_6_5_HTTP { }
asm predefined-policy POLICY_TEMPLATE_LOTUSDOMINO_6_5_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_ORACLE_10G_PORTAL_HTTP { }
asm predefined-policy POLICY_TEMPLATE_ORACLE_10G_PORTAL_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_ORACLE_APPLICATIONS_11I_HTTP { }
asm predefined-policy POLICY_TEMPLATE_ORACLE_APPLICATIONS_11I_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2003_HTTP { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2003_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2003_WITH_ACTIVESYNC_HTTP { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2003_WITH_ACTIVESYNC_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2007_HTTP { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2007_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2007_WITH_ACTIVESYNC_HTTP { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2007_WITH_ACTIVESYNC_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2010_HTTP { }
asm predefined-policy POLICY_TEMPLATE_OWA_EXCHANGE_2010_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_PEOPLESOFT_PORTAL_9_HTTP { }
asm predefined-policy POLICY_TEMPLATE_PEOPLESOFT_PORTAL_9_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_RAPID_DEPLOYMENT { }
asm predefined-policy POLICY_TEMPLATE_SAP_NETWEAVER_7_HTTP { }
asm predefined-policy POLICY_TEMPLATE_SAP_NETWEAVER_7_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2003_HTTP { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2003_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2007_HTTP { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2007_HTTPS { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2010_HTTP { }
asm predefined-policy POLICY_TEMPLATE_SHAREPOINT_2010_HTTPS { }
auth ldap system-auth {
bind-dn "CN=MASKed, CN=Users, DC=us, DC=mask, DC=com"
bind-pw $M$W5$UkmQNu0F38ezLTSpfCSB6w==
check-roles-group enabled
login-attribute samaccountname
search-base-dn "DC=us, DC=mask, DC=com"
servers { xx.0.0.1 }
}
auth password-policy { }
auth remote-role {
role-info {
F5-Administrator {
attribute memberOf=CN=F5-MASKed,CN=Users,DC=us,DC=mask,DC=com
console tmsh
line-order 1000
role administrator
user-partition All
}
F5-Guest {
attribute memberOf=CN=F5-MASKed-too,CN=Users,DC=us,DC=mask,DC=com
line-order 1001
role auditor
user-partition All
}
}
}
auth remote-user { }
auth source {
type active-directory
}
auth user admin {
description "Admin User"
encrypted-password $xxxxxMASKXXX.
partition Common
partition-access {
all-partitions {
role admin
}
}
shell none
}
cli global-settings { }
cli preference {
alias-path { /Common }
prompt { host user status current-folder config-sync-status }
}
cm cert dtca-bundle.crt {
certificate-key-size 2048
checksum SHA1:3426:21860a1ff2615bf634815779b23071c04dce1223
create-time 2018-06-21:15:16:45
created-by root
expiration-date 1844968605
expiration-string "Jun 18 19:16:45 2028 GMT"
issuer CN=da5aa61f-52fb-4a48-8d3f0023e94bdc12
key-type rsa-public
last-update-time 2018-08-10:15:53:53
mode 33188
revision 4
serial-number 496846
size 3426
subject CN=da5aa61f-52fb-4a48-8d3f0023e94bdc12
updated-by %devmgmtd
version 3
}
cm cert dtca.crt {
certificate-key-size 2048
checksum SHA1:1326:13ea2fc8ef3be7e3768cb112a5cf41bd59da049c
create-time 2018-06-21:15:16:45
created-by root
expiration-date 1844968605
expiration-string "Jun 18 19:16:45 2028 GMT"
issuer CN=da5aa61f-52fb-4a48-8d3f0023e94bdc12
key-type rsa-public
last-update-time 2018-06-21:15:16:45
mode 33188
revision 3
serial-number 496846
size 1326
subject CN=da5aa61f-52fb-4a48-8d3f0023e94bdc12
updated-by root
version 3
}
cm cert dtdi.crt {
certificate-key-size 2048
checksum SHA1:1322:5f491fab1941fac7f8b50ed58c8cd5390e0dd64f
create-time 2018-08-03:15:23:53
created-by root
expiration-date 1848684233
expiration-string "Jul 31 19:23:53 2028 GMT"
issuer CN=da5aa61f-52fb-4a48-8d3f0023e94bdc12
key-type rsa-public
last-update-time 2018-08-03:15:23:53
mode 33188
revision 5
serial-number 112002
size 1322
subject CN=xx-rhwebdev1.us.mask.com
updated-by root
version 3
}
cm device xx-rhwebdev1.us.mask.com {
active-modules { "ASM, Unlimited, VIPRION|LNKNSTP-CCQHFRH" "Best Bundle, C2200 / C2400 Platforms|OGCXKCC-KJDWXRX|SDN Services|Acceleration Manager, C2400|DNS (Unlimited), VIPRION|APM, Base, C2400|AFM, C2400|ASM, Unlimited, VIPRION|Anti-Virus Checks|Base Endpoint Security Checks|Firewall Checks|Network Access|Secure Virtual Keyboard|APM, Web Application|Machine Certificate Checks|Protected Workspace|Compression, Unlimited|Remote Desktop|App Tunnel|GTM Licensed Objects, Unlimited|DNS Rate Fallback, Unlimited|DNS Licensed Objects, Unlimited|GTM Rate Fallback, (UNLIMITED)|DNS Rate Limit, Unlimited QPS|GTM Rate, Unlimited|SSL, Unlimited, C2400/C4400/C4480|CGN, VIPRION, AFM ONLY|Routing Bundle|PSM|Acceleration Manager, Ltd to Full Upgrade" "GTM|IBQBYMQ-QBUEQYD|STP|GTM, DNS LB|GTM Licensed Objects, Unlimited|DNS Rate Fallback, Unlimited|DNS Licensed Objects, Unlimited|GTM Rate Fallback, (UNLIMITED)|DNS Rate Limit, Unlimited QPS|GTM Rate, Unlimited" "LTM, Base, C2400|DFEKXAY-UQWVMGS|IPV6 Gateway|Rate Shaping|Ram Cache|50 MBPS COMPRESSION|APM, Limited, Viprion|SSL, 500 TPS Per Core|Cluster Multi-Processing|Anti-Virus Checks|Base Endpoint Security Checks|Firewall Checks|Network Access|Secure Virtual Keyboard|APM, Web Application|Machine Certificate Checks|Protected Workspace|Compression, Unlimited|Remote Desktop|App Tunnel|SSL, Unlimited, C2400/C4400/C4480|CGN, VIPRION, AFM ONLY|Routing Bundle|PSM|DNS Rate Fallback, Unlimited|DNS Licensed Objects, Unlimited|DNS Rate Limit, Unlimited QPS|Acceleration Manager, Ltd to Full Upgrade|SSL, C2200/C2400|AAM, Core" "VCMP Enabled, C2400|QICMGYG-QWVRHRT" }
base-mac 00:23:e9:4b:db:49
build 0.0.3
cert dtdi.crt
chassis-id chs403255s
chassis-type viprion
contact ITSecurity@maskmask.com
description "Web Development F5"
edition "Point Release 6"
failover-state active
hostname xx-rhwebdev1.us.mask.com
key dtdi.key
location "New York, NY"
management-ip xx.xx.xx.1
marketing-name "BIG-IP vCMP Guest"
optional-modules { "Acceleration Manager, C2400" "ADC, Security Bundle, C2400" "Advanced Protocols" "AFM, C2400" "APM, Base, C2400" "APM, Max Access Sessions, C2400" "APM, Max CCU, C2400" "App Mode (TMSH Only, No Root/Bash)" "ASM, Bundle, VIPRION" "ASM, PSM to ASM Upgrade" "Better Bundle, C2200 / C2400 Platforms" "Better to Best Bundle, C2200 / C2400 Platforms" "BPEM, C2X00" "CGN, Viprion" "Client Authentication" "Compression, Unlimited" "Concurrent Users" "DNS (Unlimited), VIPRION" "DNS and GTM (1K QPS), VIPRION" "DNS Services, VPR" DNSSEC "Dynamic Policy Provisioning, C2X00" "External Interface and Network HSM" "FIPS 140-2 Compliant Mode, C2X00" "FIX Low Latency" "IP Intelligence, 1Yr, C2400" "IP Intelligence, 3Yr, C2200" "IP Intelligence, 3Yr, C2400" "MSM, Unlimited Mailboxes" "PEM URL Filtering, 1Yr, C2400" "PEM URL Filtering, 3Yr, C2400" "PEM, C2400" "PEM, Quota Management, C2X00" "Performance Extreme, VPR" "PSM, Base" "Routing Bundle" "SDN Services" "Secure Web Gateway, 1Yr, C2200/C2400" "Secure Web Gateway, 1Yr, C2X00, 60K URL Sessions" "Secure Web Gateway, 3Yr, C2200/C2400" "Secure Web Gateway, 3Yr, C2X00, 60K URL Sessions" "SSL, Forward Proxy" "SSL, Unlimited, C2400/C4400/C4480" "Subscriber Discovery, C2X00" "Traffic Classification, C2X00" "URL Filtering, 1Yr, C2200/C2400" "URL Filtering, 1Yr, C2X00, 60K URL Sessions" "URL Filtering, 3Yr, C2200/C2400" "URL Filtering, 3Yr, C2X00, 60K URL Sessions" "VIPRION, Multicast Routing" "WBA, Bundle, C2400" }
platform-id Z101
product BIG-IP
self-device true
time-limited-modules { "IP Intelligence, 1Yr, C2200|DBZUASV-ODCEMUR|20151007|20181020|SUBSCRIPTION" }
time-zone America/New_York
version 12.1.3.6
}
cm device-group datasync-device-xx-rhwebdev1.us.mask.com-dg {
auto-sync enabled
devices {
xx-rhwebdev1.us.mask.com { }
}
full-load-on-sync true
network-failover disabled
}
cm device-group datasync-global-dg {
devices {
xx-rhwebdev1.us.mask.com { }
}
full-load-on-sync true
network-failover disabled
}
cm device-group device-group-failover {
description "HA Group for Application Failover"
devices {
xx-rhwebdev1.us.mask.com { }
}
network-failover disabled
type sync-failover
}
cm device-group device_trust_group {
auto-sync enabled
devices {
xx-rhwebdev1.us.mask.com { }
}
network-failover disabled
}
cm device-group gtm {
devices {
xx-rhwebdev1.us.mask.com { }
}
network-failover disabled
}
cm key dtca.key {
checksum SHA1:1704:663f6f8370f5ed8e7b017c223b515ea1c49b5da9
create-time 2018-06-21:15:16:45
created-by root
key-size 2048
last-update-time 2018-06-21:15:16:45
mode 33184
revision 3
size 1704
updated-by root
}
cm key dtdi.key {
checksum SHA1:1704:291e6c53084e4a18c7d8221785497d562c82c911
create-time 2018-08-03:15:23:53
created-by root
key-size 2048
last-update-time 2018-08-03:15:23:53
mode 33184
revision 5
size 1704
updated-by root
}
cm traffic-group traffic-group-1 {
unit-id 1
}
cm traffic-group traffic-group-local-only {
is-floating false
}
cm trust-domain Root {
ca-cert dtca.crt
ca-cert-bundle dtca-bundle.crt
ca-devices { /Common/xx-rhwebdev1.us.mask.com }
ca-key dtca.key
status standalone
trust-group device_trust_group
}
ltm classification signature-definition { }
ltm classification signature-update-schedule { }
ltm classification signature-version { }
ltm default-node-monitor {
rule none
}
ltm dns analytics global-settings { }
ltm dns cache global-settings { }
ltm global-settings connection { }
ltm global-settings general { }
ltm global-settings traffic-control { }
ltm node masksyslog-new {
address xx.104.82.130
}
ltm node sam-1 {
address xx.xx.224.50
}
ltm node sam-2 {
address xx.xx.224.51
}
ltm node wmsyslog {
address xx.104.82.171
}
ltm persistence global-settings { }
ltm policy asm_auto_l7_policy__virt-svr-sam1 {
controls { asm }
last-modified 2018-08-08:18:26:55
requires { http }
rules {
default {
actions {
1 {
asm
enable
policy /Common/RHWeb_Base_ASM_Policy
}
}
ordinal 1
}
}
status published
strategy first-match
}
ltm pool prsyslog-dos {
members {
masksyslog-new:5445 {
address xx.104.82.130
}
}
}
ltm pool sam-pool-1 {
members {
sam-1:http {
address xx.xx.224.50
session monitor-enabled
state down
}
sam-2:http {
address xx.xx.224.51
session monitor-enabled
state down
}
}
monitor tcp
}
ltm pool sam-pool-3 {
members {
sam-1:https {
address xx.xx.224.50
}
sam-2:https {
address xx.xx.224.51
}
}
}
ltm pool splunk-logs {
description "Splunk Logs"
members {
wmsyslog:514 {
address xx.104.82.171
session monitor-enabled
state up
}
}
monitor udp
}
ltm pool splunk-logs-tcp {
members {
wmsyslog:514 {
address xx.104.82.171
session monitor-enabled
state up
}
}
monitor tcp
}
ltm profile client-ssl wildcard.dev.maskmask.com-clientssl {
app-service none
cert wildcard.dev.maskmask.com-clientssl.crt
cert-key-chain {
wildcard_wildcard {
cert wildcard.dev.maskmask.com-clientssl.crt
chain wildcard.dev.maskmask.com-clientssl.crt
key wildcard.dev.maskmask.com-clientssl.key
}
}
chain wildcard.dev.maskmask.com-clientssl.crt
defaults-from clientssl
destination-ip-blacklist none
destination-ip-whitelist none
hostname-blacklist none
hostname-whitelist none
inherit-certkeychain false
key wildcard.dev.maskmask.com-clientssl.key
passphrase none
source-ip-blacklist none
source-ip-whitelist none
}
ltm profile http http-x-forwarded-for {
app-service none
defaults-from http
enforcement {
unknown-method allow
}
insert-xforwarded-for enabled
proxy-type reverse
}
ltm profile server-ssl serverssl-insecure-compatible {
app-service none
ciphers !SSLv2:!EXPORT:!DH:RSA+RC4:RSA+AES:RSA+DES:RSA+3DES:ECDHE+AES:ECDHE+3DES:@SPEED
defaults-from serverssl
options { dont-insert-empty-fragments no-sslv3 }
renegotiation disabled
secure-renegotiation request
}
ltm rule niq-security-block {
when HTTP_REQUEST {
if {
([string tolower [HTTP::path]] contains "pom.xml") ||
([string tolower [HTTP::path]] contains "server-info") ||
([string tolower [HTTP::path]] contains "server-status") ||
([string tolower [HTTP::path]] contains ".git") ||
([string tolower [HTTP::path]] contains ".gitignore") ||
([string tolower [HTTP::path]] contains "test.php")
} then {
HTTP::respond 404 content "404 File Not Found" Mime-Type "text/html"
}
}
}
ltm snat-translation xx.171.221.250 {
address xx.171.221.250
inherited-traffic-group true
traffic-group traffic-group-1
}
ltm snatpool Default-Web-Sevrer-SNAT-Pool {
members {
xx.171.221.250
}
}
ltm tacdb licenseddb licensed-tacdb {
partition none
}
ltm virtual Outbound_FTP {
description "Allowed Outbound FTP based AFM. sam li"
destination 0.0.0.0:ftp
fw-enforced-policy Outbound_FTP
ip-protocol tcp
mask any
pool sam-pool-3
profiles {
tcp { }
}
security-log-profiles {
splunk-logging
}
source 0.0.0.0/0
source-address-translation {
pool Default-Web-Sevrer-SNAT-Pool
type snat
}
translate-address enabled
translate-port enabled
vs-index 2
}
ltm virtual virt-svr-sam1 {
description "test only"
destination xx.xx.220.50:http
ip-protocol tcp
mask 255.255.255.255
policies {
asm_auto_l7_policy__virt-svr-sam1 { }
}
pool sam-pool-1
profiles {
ASM_RHWeb_Base_ASM_Policy { }
http-x-forwarded-for { }
tcp { }
websecurity { }
}
source 0.0.0.0/0
translate-address enabled
translate-port enabled
vlans {
dev_int_vlan703
}
vlans-enabled
vs-index 3
}
ltm virtual virt-svr-sam3 {
description "sam li test"
destination xx.xx.220.50:https
ip-protocol tcp
mask 255.255.255.255
profiles {
http-x-forwarded-for { }
serverssl-insecure-compatible {
context serverside
}
tcp { }
wildcard.dev.maskmask.com-clientssl {
context clientside
}
}
rules {
niq-security-block
}
security-log-profiles {
splunk-logging
}
source 0.0.0.0/0
translate-address enabled
translate-port enabled
vlans {
Vlan422-WebSrvr-xx.xx.222.x
dev_int_vlan703
}
vlans-enabled
vs-index 4
}
net cos global-settings { }
net dag-globals { }
net fdb tunnel http-tunnel { }
net fdb tunnel socks-tunnel { }
net fdb vlan Ha_55 { }
net fdb vlan VLAN200-Public-xx.171.1.x { }
net fdb vlan VLAN420-WebSvcs-xx.xx.220.x { }
net fdb vlan VLAN424-WebSrvr-xx.xx.224.x { }
net fdb vlan VLAN426-AppSvcs-xx.xx.226.x { }
net fdb vlan VLAN428-XdmzSvcs-xx.xx.228.x { }
net fdb vlan VLAN430-XdmzSrvr-xx.xx.230.x { }
net fdb vlan VLAN437-XappSrvr-xx.xx.237.x { }
net fdb vlan VLAN702-Internal-xx.201.4.x { }
net fdb vlan Vlan422-WebSrvr-xx.xx.222.x { }
net fdb vlan dev_int_vlan703 { }
net interface 2/mgmt {
if-index 34
mac-address 00:23:e9:4b:db:49
media-active 100TX-FD
}
net ipsec ike-daemon ikedaemon {
log-publisher default-ipsec-log-publisher
}
net lldp-globals { }
net multicast-globals { }
net packet-filter-trusted { }
net route-domain 0 {
id 0
vlans {
http-tunnel
socks-tunnel
Ha_55
VLAN420-WebSvcs-xx.xx.220.x
VLAN424-WebSrvr-xx.xx.224.x
VLAN426-AppSvcs-xx.xx.226.x
VLAN428-XdmzSvcs-xx.xx.228.x
VLAN430-XdmzSrvr-xx.xx.230.x
VLAN437-XappSrvr-xx.xx.237.x
VLAN702-Internal-xx.201.4.x
Vlan422-WebSrvr-xx.xx.222.x
dev_int_vlan703
}
}
net self-allow {
defaults {
igmp:any
ospf:any
pim:any
tcp:domain
tcp:f5-iquery
tcp:https
tcp:snmp
tcp:ssh
udp:520
udp:cap
udp:domain
udp:f5-iquery
udp:snmp
}
}
net stp-globals { }
net trunk Main-cross-switch-trunk {
cfg-mbr-count 2
distribution-hash src-dst-mac
interfaces {
1/1.1
2/1.1
}
mac-address 00:23:e9:4b:dd:21
stp disabled
type ha-only
working-mbr-count 1
}
net trunk external-trunk {
cfg-mbr-count 2
distribution-hash src-dst-mac
interfaces {
1/1.5
2/1.5
}
mac-address 00:23:e9:4b:dd:22
stp disabled
type ha-only
working-mbr-count 1
}
net tunnels tunnel http-tunnel {
description "Tunnel for http-explicit profile"
if-index 64
profile tcp-forward
}
net tunnels tunnel socks-tunnel {
description "Tunnel for socks profile"
if-index 80
profile tcp-forward
}
net vlan Ha_55 {
if-index 96
tag 55
}
net vlan VLAN200-Public-xx.171.1.x {
if-index 112
tag 200
}
net vlan VLAN420-WebSvcs-xx.xx.220.x {
if-index 128
tag 420
}
net vlan VLAN424-WebSrvr-xx.xx.224.x {
if-index 144
tag 424
}
net vlan VLAN426-AppSvcs-xx.xx.226.x {
if-index 160
tag 426
}
net vlan VLAN428-XdmzSvcs-xx.xx.228.x {
if-index 176
tag 428
}
net vlan VLAN430-XdmzSrvr-xx.xx.230.x {
if-index 192
tag 4094
}
net vlan VLAN437-XappSrvr-xx.xx.237.x {
if-index 208
tag 437
}
net vlan VLAN702-Internal-xx.201.4.x {
if-index 224
tag 702
}
net vlan Vlan422-WebSrvr-xx.xx.222.x {
if-index 240
tag 422
}
net vlan dev_int_vlan703 {
if-index 256
tag 703
}
security bot-defense asm-profile ASM_RHWeb_Base_ASM_Policy {
app-service none
flags 0
send-javascript-challenge disabled
send-javascript-efoxy disabled
send-javascript-fingerprint disabled
}
security device device-context { }
security dos bot-signature "8484 Boston Project" {
category "/Common/Spam Bot"
risk high
rule "headercontent:\"8484 Boston Project\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "ADmantX Platform Semantic Analyzer" {
category Crawler
risk low
rule "headercontent:\"ADmantX Platform Semantic Analyzer\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Alexa Archiver" {
category Crawler
risk low
rule "headercontent:\"ia_archive\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Apache Struts Dynamic Method Invocation" {
category "/Common/Exploit Tool"
rule "headercontent:\"method:\"; useragentonly; nocase; headercontent:\"#\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "AppScan URI" {
category "/Common/Vulnerability Scanner"
rule "uricontent:\"AppScan_fingerprint/MAC_ADDRESS\"; nocase;"
user-defined false
}
security dos bot-signature "Arachni Scanner" {
category "/Common/Vulnerability Scanner"
rule "headercontent:\"Arachni\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Are My Sites Up\?" {
category "/Common/Site Monitor"
risk low
rule "headercontent:\"AMSU\"; useragentonly; nocase; depth:4;"
user-defined false
}
security dos bot-signature "Atomic Reader" {
category "/Common/RSS Reader"
risk low
rule "headercontent:\"Atomic Reader\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Automattic Feed Fetcher" {
category "/Common/RSS Reader"
risk low
rule "headercontent:\"Automattic Feed Fetcher\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Avzhan DDoS Bot" {
category "/Common/DOS Tool"
rule "headercontent:\"Mozilla\"; useragentonly; nocase; headercontent:\"|3b| MyIE \"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Bash Shellshock" {
category "/Common/Exploit Tool"
rule "headercontent:\"() {\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Bichoo Spider" {
category "/Common/Web Spider"
risk high
rule "headercontent:\"Bichoo Spider\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Binget PHP Library" {
category "/Common/HTTP Library"
risk low
rule "headercontent:\"Binget/\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Black Hole" {
category "/Common/Spam Bot"
risk high
rule "headercontent:\"Black Hole\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Bloomberg Financial Market bot" {
category "/Common/Web Spider"
risk high
rule "headercontent:\"BLP_bbot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "CISPA Vulnerability Notification" {
category "/Common/Vulnerability Scanner"
rule "headercontent:\"CISPA Vulnerability Notification\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "CSS Certificate Spider" {
category Crawler
risk low
rule "headercontent:\"CSS Certificate Spider\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Calculon Spider" {
category Crawler
risk low
rule "headercontent:\"calculon spider/\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Cenzic Hailstorm" {
category "/Common/Vulnerability Scanner"
risk high
rule "headercontent:\"CenzicHailstorm\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Check for Update" {
category Spyware
risk high
rule "headercontent:\"Check for Update\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "China Local Browse" {
category "/Common/Spam Bot"
rule "headercontent:\"China Local Browse\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Cisco Content Engine" {
category Crawler
risk low
rule "headercontent:\"CE-Preload\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Cisco Torch" {
category "/Common/Vulnerability Scanner"
rule "headercontent:\"Cisco-torch\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Citrix ICA Client" {
category "/Common/Service Agent"
risk low
rule "headercontent:\"\\Citrix\\ICA Client\\\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Cityreview Robot" {
category Crawler
risk low
rule "headercontent:\"Cityreview Robot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Clickagy Intelligence Bot" {
category "/Common/Web Spider"
risk high
rule "headercontent:\"Clickagy Intelligence Bot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Closure Compiler Service" {
category Crawler
domains { .googleusercontent.com }
risk low
rule "headercontent:\"closure-compiler-hrd\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Cloud mapping experiment" {
category Crawler
risk low
rule "headercontent:\"Cloud mapping experiment\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "CloudFlare AlwaysOnline" {
category "/Common/Site Monitor"
risk low
rule "headercontent:\"CloudFlare-AlwaysOnline\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Comodo SSL Checker" {
category "/Common/Site Monitor"
risk low
rule "headercontent:\"Comodo SSL Checker\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Comodo Spider" {
category "/Common/Search Bot"
risk low
rule "headercontent:\"Comodo Spider\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Conduit Toolbar COMMLAYER" {
category Spyware
rule "headercontent:\"COMMLAYER\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "ContextAd Bot" {
category "/Common/Spam Bot"
rule "headercontent:\"ContextAd Bot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "CopperEgg RevealUptime" {
category "/Common/Site Monitor"
risk low
rule "headercontent:\"CopperEgg/RevealUptime/\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Crescent Internet ToolPak" {
category "/Common/Spam Bot"
rule "headercontent:\"Crescent Internet ToolPak\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "D3DL0 G00D N1C3" {
category "/Common/DOS Tool"
rule "headercontent:\"{[D3DL0 G00D N1C3]}\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DNS-Tools Header-Analyzer" {
category Crawler
risk low
rule "headercontent:\"DNS-Tools Header-Analyzer\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DTS Agent" {
category "/Common/Exploit Tool"
risk high
rule "headercontent:\"DTS Agent\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Data Dog" {
category "/Common/Site Monitor"
risk low
rule "headercontent:\"DataDog\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Dataprovider Site Explorer" {
category Crawler
risk low
rule "headercontent:\"Dataprovider Site Explorer\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DavTest WebDav Vulnerability Scanner" {
category "/Common/Vulnerability Scanner"
rule "headercontent:\"dave/v\"; useragentonly; nocase; depth:6;"
user-defined false
}
security dos bot-signature "Delf Buzus Checkin" {
category Spyware
risk high
rule "headercontent:\"dwn\"; useragentonly; nocase; depth:3;"
user-defined false
}
security dos bot-signature "Demo Bot" {
category "/Common/Spam Bot"
rule "headercontent:\"Demo Bot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Digimarc WebReader" {
category "/Common/Web Spider"
rule "headercontent:\"Digimarc WebReader\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Domain Re-Animator Bot" {
category Crawler
risk low
rule "headercontent:\"Domain Re-Animator Bot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DomainsDB.net MetaCrawler" {
category Crawler
risk low
rule "headercontent:\"DomainsDB.net MetaCrawler\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Dot TK spider" {
category Crawler
risk low
rule "headercontent:\"Dot TK - spider\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DriveCleaner Updater" {
category Spyware
risk high
rule "headercontent:\"DriveCleaner Updater\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "DuckDuckGo Bot" {
category "/Common/Search Engine"
domains { .duckduckgo.com .ivegotafang.com static-72-94-249-35.phlapa.fios.verizon.net }
risk low
rule "headercontent:\"DuckDuckBot\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "EasyBib AutoCite" {
category Crawler
risk low
rule "headercontent:\"EasyBib AutoCite\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Educate Search VxB" {
category "/Common/Spam Bot"
rule "headercontent:\"Educate Search VxB\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Electron (Nightmare)" {
category "/Common/Headless Browser"
risk high
rule "headercontent:\"Electron/\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "ExactSeek Crawler" {
category "/Common/Search Bot"
risk low
rule "headercontent:\"ExactSeekCrawler\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "FAST Enterprise Crawler 6" {
category Crawler
risk low
rule "headercontent:\"Sensis Web Crawler\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Facebook External Hit" {
category "/Common/Social Media Agent"
risk low
rule "headercontent:\"facebookexternalhit\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Fake Internet Explorer" {
category "/Common/Spam Bot"
risk high
rule "headercontent:\"internet explorer\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Fake Microsoft Internet Explorer" {
category "/Common/Spam Bot"
risk high
rule "headercontent:\"Microsoft Internet Explorer\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Fake Opera 8.11" {
category Spyware
risk high
rule "headercontent:\"opera/8.11\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Fast HTTP Auth Scanner" {
category Crawler
risk low
rule "headercontent:\"Fast HTTP Auth Scanner\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "FeedWordPress Bot" {
category "/Common/RSS Reader"
risk low
rule "headercontent:\"FeedWordPress\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Fetch API Request" {
category "/Common/Spam Bot"
rule "headercontent:\"Fetch API Request\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Flamingo Search" {
category Crawler
risk low
rule "headercontent:\"flamingosearch\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "Flipopia Related Malware User Agent" {
category Spyware
risk high
rule "headercontent:\"Flipopia\"; useragentonly; nocase;"
user-defined false
}
security dos bot-signature "FollowSite Bot" {
category Crawler