Security::IPIntelligencePolicy¶

Introduced : BIG-IP_v11.5.0

The IPIntelligencePolicy interface enables you to manipulate an IP Intelligence policy. The IP Intelligence policy is a functionally enriched generalization of the IP Intelligence profile (the latter has been immediately deprecated in this release). As opposed to the deprecated profile, policy can be applied to route domains and globally in addition to virtual servers. When packet passes through the system first the global policy is applied, then route domain&aposs one and then virtual&aposs one provided the configured policies are applicable to the packet&aposs source IP. In addition to the predefined blacklist categories (see the IPIntelligenceBlacklistCategory interface) and 3rd party integrated IP reputation database coming with the system the IP Intelligence policy provides an ability to configure dynamic IP whitelists and blacklists downloaded from external web feeds (see IPIntelligenceFeedList interface). The IP Intelligence policy is comprised of three logical groups of settings: 1) List of feed lists create the union set of IP addresses/subnets with their blacklist/whitelist categorization. The policy is applied on the packet only if packet&aposs source IP is found in that set. 2. Enforcement and logging settings per blacklist category. If the policy applies to the packet and the packet&aposs source IP&aposs blacklist category is explicitly confgured in the policy, the configuration settings will be applied to that packet. When the packet&aposs source IP is categorized with more than one category the most restrictive action and logging settings will apply. 3. Default policy enforcement and logging settings are used when the packet to which the policy applied is categorized with the blacklist which isn&apost explicitly configured in this policy or it is configured and the corresponding setting is set with the option “use policy setting”.