Skip to main content

F5

The CrowdSec F5 integration connects CrowdSec's hosted blocklist endpoint to your F5 BIG-IP AFM.
F5 refers to this feature as External IP blocklist or Feed lists, which allow you to import external threat intelligence to block or allow traffic based on IP reputation.

Ensure your F5 BIG-IP AFM supports External IP blocklists or Feed lists.
The vendor documentation is available in the References section below.

Step 1 — Create the integration in the CrowdSec Console​

In the Integrations page, click Connect under the F5 card.

F5 Integration CardF5 Integration Card

Name the integration (must be unique to your account), then click Create.

F5 Integration Creation ScreenF5 Integration Creation Screen

The credentials shown next are displayed only once. Copy them before closing this screen.

F5 Integration Credentials ScreenF5 Integration Credentials Screen

You now have an HTTPS endpoint and Basic Auth credentials to configure on your F5 device.

Format example​

The CrowdSec blocklist is served in F5 format, with one entry per line:

192.168.38.187,32,BL,crowdsec-myf5Integration
192.168.38.188,32,BL,crowdsec-myf5Integration

Format: IP, Mask, WL/BL, Category

Manage integration size limits with pagination​

If you want to learn how to manage integration size limits with pagination, please refer to the Managing integrations size limits with pagination section.

References​

Next Steps​

Subscribe to blocklists in the Blocklist Catalog to populate your integration.