This message was deleted.

Hi, You could use a little nix voodo, depending on how the format in the file is.. if it's a little different subnets, instead of /32 it might be too annoying. but something like: cat iplist |grep 255.255.255.255| tr ";" " " | awk '{print "add ns acl " $1 " ALLOW -td 0 -srcIP" " = "$2" -destIP = "$4"" }'

Otherwise, you can use a listenpolicy (patternset + expression) to restrict access to lb vserver. Here is my example: add policy patset PatSet_SourceIPsForSMTP_Relay bind policy patset PatSet_SourceIPsForSMTP_Relay 1.2.3.4 bind policy patset PatSet_SourceIPsForSMTP_Relay 1.2.3.5 add policy expression AdvExp_SourceIPsForSMTP_Relay "CLIENT.IP.SRC.TYPECAST_TEXT_T.EQUALS_ANY(\"PatSet_SourceIPsForSMTP_Relay\")" set lb vserver LB_SMTP_Relay_Restricted -Listenpolicy "AdvExp_SourceIPsForSMTP_Relay" -Listenpriority 10

Patsets and Listen Policy is my favorite approach. If you don’t want to maintain patsets on the ADC (Dynamic Change) you could work with HTTP Callouts as well.

It's also easy enough to create a powershell that could edit the patset from a local file using a schedule job, it's just about finding what works for them.

@Daniel Weppeler @Julian Mooren do you need to also have a responder policy bound to the vserver to go with the commands above or should the listen policy handle it?

Just the listen policy

when i bind the listen policy to the vserver it seems to block everything. where did i go wrong?

Here is a config example: add policy patset patset_smtp_allow bind policy patset patset_smtp_allow 10.14.211.217 -index 1 bind policy patset patset_smtp_allow 10.14.211.218 -index 2 bind policy patset patset_smtp_allow 10.14.211.219 -index 3 bind policy patset patset_smtp_allow "172.16.10.0/24" -index 4 bind policy patset patset_smtp_allow "192.168.1.0/24" -index 5 add policy expression PE_SMTP_Allow "(CLIENT.IP.SRC+\"/32\").EQUALS_ANY(\"patset_smtp_allow\" ) || (CLIENT.IP.SRC.SUBNET(24)+\"/24\").EQUALS_ANY(\"patset_smtp_allow\") || (CLIENT.IP.SRC.SUBNET(16)+\"/16\").EQUALS_ANY(\"patset_smtp_allow\")"xample:

even with just that basic expression in the listen policy and no patset it goes from allowed to blocked from the ip i specify. Do i have it backwards? i want to allow traffic from that ip😂