Details

The Configuration utility provides the graphical user interface to manage the BIG-IP system. Depending on your organizational security requirements, one method to secure access to the Configuration utility is to allow only trusted IP addresses or range of IP addresses.

By default, the current list allows all IP addresses to connect to the Configuration utility. If you are adding an IP address or range of IP addresses to the current list the first time, you should perform the Replacing the current allowed list with a new list procedure.

Solution

To add an IP address or range of IP addresses to the current list of hosts that are allowed to access the Configuration utility, perform the following procedure:
1. Log in to the TMOS Shell (tmsh) by typing the following command:
tmsh

2. To add an IP address or range of IP addresses to the current allowed list of hosts, type the following command:
modify /sys httpd allow add { }

For example, to add 172.28.31.140 and 172.28.65.150 to the current list, you would type the following command:

modify /sys httpd allow add { 172.28.31.140 172.28.65.150 }

3.To add the subnet 172.28.31.0/255.255.255.0 to the current list, you would type the following command:

modify /sys httpd allow add { 172.28.31.0/255.255.255.0 }

4. To list the IP addresses of the current allowed hosts, type the following command:
list /sys httpd allow

5. Save the change by typing the following command:
save /sys config

Supportive Information

The following resource is also helpful.

• https://support.f5.com/csp/article/K53108777#link_01

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system F5.

References

• 800-53|SC-5
• CAT|I
• CCI|CCI-002385
• Rule-ID|SV-74647r1_rule
• STIG-ID|F5BI-DM-000239
• Vuln-ID|V-60217

Source

• Tenable.com/audits