I need to block some IP subnets from using the LB web-proxy VIP/Service. How to do it using responder policy?

[Carmelo Jimenez]

I need to block some IP subnets from using the LB web-proxy VIP/Service.

Googling around found a similar logic and I tailored it.

Create these policies:

> add responder policy "Drop_VDI_to_Proxy" "CLIENT.IP.SRC.IN_SUBNET(10.255.0.0/24) || CLIENT.IP.SRC.IN_SUBNET(10.200.0.0/24)" DROP

> add responder policy "Allow-All-Other-IPs" TRUE NOOP

! bind both responders policies to "web-proxy" vserver(s)

! lower priority number for Drop_VDI_to_Proxy

! higher priority number for Allow-All-Other-IPs

Would this work?

[Aman Agrawal 2]

Yes, this config will work.

If you don't want to take any action on the other IPs, then you can remove the second policy "Allow-All-Other-IPs".

[Jens Beyer]

Second policy with TRUE is not needed at all. As long you are not on the subnet you are blocking it just gives you access. Not needed to configure that explicitly at the end.