What is an ASN; where do I see and use ASN information in TR7?

Short answer

An ASN (Autonomous System Number) is a number that represents the networks under a single administration in internet routing (an internet service provider, a cloud provider or a large organization) and that IANA distributes through the regional registries; the addresses in the same ASN belong to the same organization. TR7 finds the ASN of an address from the IP database on the device and shows the AS number, the AS organization and the AS network in the IP Lookup result. In TR7, ASN information is used in the following places: Source IP Type = ASN in Load Balancer conditions, the ASN filter and the ASN Org column in WAF Event Logs, the ASN (autonomous system) type in Bot/DDoS whitelist entries, the ASN scope in WAF and Bot/DDoS advanced notifications, the Required ASN Networks threshold in WAF Learning and the %ASN smart variable.

Where It Is Used in TR7

Where	Field / label	What for
Settings → General Settings → IP Intelligence & Reputation → IP Lookup	The ASN row in the result card	The AS number, the AS organization and the AS network of the address
Load Balancer → Conditions → Source IP	Source IP type = ASN	An action (blocking, routing…) on the traffic coming from an AS
WAF → Event Logs	ASN filter, ASN Org column	Filtering the attack records by provider
Bot/DDoS Management → L7 DDoS Protection / IP Reputation Protection / Bot Protection → Edit	Whitelist entry type ASN (autonomous system)	Exempting all the addresses of an AS from the protection
WAF and Bot/DDoS → Notifications	Scope = ASN	Counting the events per AS and generating notifications
WAF Management → Learning method	Required ASN Networks	The minimum number of distinct AS networks required for a value to be learned
Log profile and smart variable fields	%ASN	Writing the AS number of the client to the log or to another field

Common Misconceptions

• "An ASN indicates a country." An ASN indicates an organization or a provider; the same ASN of a large provider can cover addresses in many countries. For the country, Source IP Type = Country is used.
• "Blocking an ASN stops a single attacker." All the customers of that provider are affected; ASN-based blocking and exemption are kept narrow.
• "For all the networks of cloud providers, ASNs are entered one by one." For large cloud and hosting providers, the Network Type Group condition does the same job with a single selection.

Step-by-step description of blocking by ASN: Can I block by ASN?

How it is done in the documentation

• Source IP · ASN
• IP Intelligence & Reputation · IP Lookup
• WAF Event Logs · The Filterable Information

Related questions

• Can I block by ASN?
• How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?
• How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?