Can I block by ASN?

Short answer

Yes. In the Source IP condition, Source IP Type = ASN is selected and the AS number is selected from a searchable list; the condition is bound to the Block action on an HTTP vService and to the TCP Connection Management action on an L7 TCP vService. A condition selects a single ASN; for more than one ASN, the conditions are combined with or in the Conditions field of the action. To target all the networks of large cloud and hosting providers with a single selection, the Network Type Group condition is used.

Problem: Traffic from a Specific Network Is Not Wanted

If abuse comes from the networks of a specific service provider or cloud platform, blocking over the autonomous system number (ASN) of that network instead of individual IP addresses is a more permanent solution: even if the provider uses a new address block, the ASN stays the same. TR7 finds the ASN of an address from the IP database on the device; the ASN of an address can be seen with IP Lookup.

Solution: Two Methods

Both methods set up the same rule; one of them is chosen. For vServices with Bot/DDoS protection turned on, the last row of the table is checked.

Your situation	Suitable method
Blocking one or a few specific ASNs	Method 1: Source IP (ASN) condition + action
From the command line	Method 2: WEB-CLI
Bot/DDoS protection is on for the vService; I want to put a limit or a block on provider networks	Network Type Group Control → How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?

Method 1: Source IP (ASN) Condition + Action Recommended

• How it works If the ASN to which the client IP belongs matches the number in the condition, the request is met with the action before it reaches the Backend Service.
• Where it is openedLoad Balancer → Conditions · Load Balancer → Actions · vService → Details → Actions
• Requirement There is no change on the Backend Service side
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

On the Load Balancer → Conditions screen, Add is clicked (how to add).

2

Adım 2 Select the ASN

Condition Name is entered; Criteria = Source IP and Source IP Type = ASN are selected. The ASN field is a searchable list; the options are in the (number) organization format and are searched by number or by organization name. The field takes a single ASN and its default value is 1; the target ASN must be selected.

All the networks of the provider

Instead of selecting multiple ASNs of a cloud or hosting provider one by one, Criteria = Network Type Group is selected and one or more providers (e.g. Amazon AWS, Hetzner) are checked in the list (cloud provider scenario). The remaining steps are the same.

3

Adım 3 Save the condition

Add is clicked. For more than one ASN, steps 1–3 are repeated for each ASN (Add & Repeat keeps the form open).

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

5

Adım 5 Select the action and the condition

Action Name is entered. For an HTTP vService, Action Type = Block; Execution Level = On request, Deny Type = Standard, Status Code default 403. For an L7 TCP vService, Action type = TCP connection management and Action = Reject or Silent drop. In the Conditions field, the ASN conditions are selected and, if there is more than one, they are combined with or in the same group. To monitor the effect, Hit Counter can be turned on.

6

Adım 6 Save the action

Add is clicked; the action is added to the list.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

8

Adım 8 Add the action to the vService

The action is selected in the Actions field under Details.

9

Adım 9 Save

Save is clicked; the rule is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1ASNTR7 side

The ASN of the address to be tested is seen in the IP lookup result card on the Settings → General Settings → IP Intelligence & Reputation screen.

ExpectedThe ASN in the condition

2BlockingClient side

A request is sent from an address that belongs to this ASN.

Command: curl -sI https://www.example.com/

ExpectedHTTP/1.1 403 Forbidden

If Hit counter is on, the counter of the action increases on the Action Hits tab of the vService Dashboard.

Method 2: WEB-CLI

• How it works The condition, action and binding in Method 1 are done with WEB-CLI commands.
• Where it is opened WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access
• vService type HTTP (example with the Block action)

Step-by-Step Configuration

1

Adım 1 Create the condition

The ASN number is written without the AS prefix (condition criteria):

lb condition add criteria src_ip srcIpType asn asn 64500 --name asn-engel

2

Adım 2 Get the condition ID

The --cond field takes the ID of the condition, not its name. The ID is read from the list:

lb condition list

3

Adım 3 Create the Block action

The ID from step 2 is written in place of <condition-id>; multiple ASN conditions are combined in the --cond '<id-1> or <id-2>' format:

lb action add type deny name asn-engeli --cond <condition-id>

4

Adım 4 See the existing actions of the vService

lb service show <vService>

The rules.0, rules.1 … lines in the output are the actions defined on the vService.

5

Adım 5 Add the action to the first empty position

--rules.N replaces the existing action at that position; the new action is written to the first empty position. If the vService has no actions, the position is 0; if it has two actions, --rules.2 is used:

lb service update id <vService> --rules.0 asn-engeli

Verification

1BindingTR7 side

The vService record is displayed again.

Command: lb service show <vService>

Expectedasn-engeli in the rules lines

Common Mistakes

• Not defining a Trusted proxy while TR7 is behind a CDN or a proxy. The condition evaluates the ASN of the proxy's address; on an HTTP vService, the real client IP is first resolved with Trusted Proxy.
• Leaving the default value of the ASN field. The default value of the field is 1; if the target ASN is not selected, the condition is applied to the wrong network.
• Targeting large providers with a single ASN. Cloud providers have more than one ASN; for the whole provider, the Network Type Group condition is used.
• Overlooking legitimate users. Corporate VPN exits, monitoring services and API clients can also come from data center networks; the effect of the rule is first monitored with Hit Counter.
• Writing the condition name in the --cond field or overwriting the existing action with --rules.0 in WEB-CLI. --cond expects the ID of the condition; for --rules.N, the first empty position is first found with lb service show.

How it is done in the documentation

• Source IP · ASN
• Source IP · Scenario 4: Cloud Provider Bot Detection (ASN-Based)
• Network Type Group · Network Type Group Name
• IP Intelligence & Reputation · IP Lookup

Related questions

• Can I block traffic from specific countries?
• How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?
• Can I route clients to a different backend based on their country / city?