F5 BIG-IP integration guide.

Confirm the AFM feature and version

This procedure targets BIG-IP TMOS with Advanced Firewall Manager licensed and provisioned. F5's AFM IP Intelligence manual lists 17.1.x, 17.5.x and 21.0.0 among its applicable releases. Use a vendor-maintained, patched release and check its own manual and platform capacity. This is not an LTM-only, BIG-IP Next or generic WAF procedure.

AFM custom feeds do not require the separate BrightCloud subscription described in that manual. Verify the existing AFM entitlement before proceeding. Back up the configuration, preserve management access and check memory, available categories and all other loaded feeds. No universal indicator capacity is assumed.

Create two separate HTTPS feeds

Standard

112,177 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

121,738 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 26 Oct 2026, 21:31 UTC. Check live counts and SHA-256.

Data-Shield publishes one IPv4 address per line. F5 documents the address as the only required feed field; the list type and category can come from configured defaults. Use the complete files without adding CIDR ranges, comments or credentials. Verify that the exact installed parser loads every address before enforcement.

Under Security → Network Firewall → IP Intelligence, create two Blacklist Categories with Match Type Source, then two Feed Lists:

For each Feed URL, choose HTTPS, enter the corresponding URL above, explicitly choose Blacklist and its category, leave authentication empty, then Add and save. The feed-list reference documents these per-feed defaults. They matter because the files contain addresses only.

Configure 7200 seconds for each Poll Interval, equivalent to two hours. The F5 API reference defines this interval in seconds. If the GUI exposes different units, select the equivalent duration. No external cron job is needed.

Validate HTTPS retrieval

Configure working DNS and time synchronization. F5's feed configuration manual requires the appropriate certificate trust in the BIG-IP CA bundle and refers to K54041205 for third-party CA validation. Follow that procedure for your exact build and verify certificate and hostname checks before activation. Do not disable verification or assume that selecting HTTPS proves authentication.

Inspect actual successful imports, parsing errors and resource usage. A reachable URL or successful TLS handshake does not prove that the full list was installed. Native polling also does not establish equality with the current GitHub SHA-256; compare a complete downloaded file with the corresponding published generation when auditing freshness.

Apply a scoped IP Intelligence policy

Create a dedicated IP Intelligence policy referencing the two feed lists. Begin with Accept and reviewed logging for the two custom categories. This permits observation at this policy layer; other firewall rules still apply. After checking expected impact, set ds_standard and ds_critical explicitly to Drop, matching source addresses. Keep a default Accept action for other categories in this new policy.

The policy reference describes category actions and matching direction. Attach the reviewed policy to the intended virtual server first. If it already has an IP Intelligence policy, review and integrate the new feeds without replacing existing protection. Do not attach globally just to make a test pass.

Review existing whitelists, overlapping categories and policy contexts. When both profiles are enforced their effect is the union of their memberships. Logging identifies matching categories, not proof of successful exploitation. F5 documents release-specific hardware and global-policy issues; assess applicable fixes before broader deployment.

Check refreshes, removals and failover

tmsh list security ip-intelligence feed-list /Common/DS_STANDARD
tmsh list security ip-intelligence feed-list /Common/DS_CRITICAL

Configuration output proves settings, not loaded membership. Use the context-aware lookup below with an actual current member and your protected virtual server:

tmsh show security ip-intelligence info address IP_ADDRESS virtual-server /Common/YOUR_VIRTUAL_SERVER

Replace both placeholders. Confirm the expected category and action, then use a controlled connection from an address you own to check enforcement and logs. Compare each imported list with the full source, and confirm a removed IP disappears after a later successful poll unless another feed still lists it.

Monitor the last successful download, loaded counts and update errors for both feeds. An unavailable source can leave old membership in service; do not treat a running poller as evidence of freshness. On an HA pair, verify feed retrieval and effective membership on each unit and after failover rather than assuming configuration synchronization also proves live data freshness.

Rollback by returning only the new categories to their previous actions or restoring the previous policy assignment, then verify required traffic. Keep other feeds and policies intact. Commands and workflow were reviewed against official references; no physical appliance validation is claimed.