Hi, Using ASM antivirus scan could cause application slow down issues. Has anyone experienced the issues? If using default AV, which is Mcafee AV, do we need any licenses? Any good documentations about implementating it would be appreciated.

if you mean the icap connection, yes it allways slow down the application (a part of it). There are severall stations, which create a delay. ASM collect the complete fileASM send to AVAV scan the file - bigger files need more time to scan (4.) AV send the file back, although it should send only a response code But every AV method creates a delay, depending on the file size. Because of this, you only scan a request with file upload and not every request. So, not the application has a slow down issue, only the file upload process (which isn't an issue). anything wrong? I don't think so.

I agree with Torti, there will be a slight slow down but only for the file uploads not the entire application. I am currently using this feature in one of our applications and there was full performance testing done with no complaints from the developers or business owners. If you or the business owners are that concerned about performance impacts of this feature there is an option when configuring the AV setting on ASM for "Guarantee Enforcement". If you uncheck the box (disable this option) the documentation says that the system will perform only if it does not slow down the application. I am unsure how it calculates this and honestly would not recommend disabling this, but the option is there and you would still get some protection. However it would make bypassing the scan pretty simple if someone wanted to. A couple other things to note about AV scanning. There is a max request size for ASM, or long_request_buffer_size which is defaulted to 10mb. So if the request exceeds 10mb (which would include the file upload) then the ASM will not send the request to the ICAP server. Here is the SOL on this. https://support.f5.com/kb/en-us/solutions/public/12000/900/sol12984.html?sr=26859617 If the ICAP server you are sending the files to for scanning goes down for any reason and the ASM is unable to get a response it will block the request. The initial log entry show a Virus detected but when you look at the details of that block you will see it says unable to contact ICAP server. So I would recommend making sure the ICAP servers you are sending are high avaialability in some way. We just have our two servers behind an LTM and send traffic to the Virtual IP. Overall this feature has worked well for us and we have not had any service interruptions or performance issues reported that have been related to it.

Add: the most performance impact will result of the AV scan. So, look at the performance stats of your AV system.if you have trouble with the file size (files bigger than 20mb are not supported with ICAP!), you need a AV proxy or use the strange new method of 11.4 instead of ICAP

antivirus protection using ASM

21 Replies

Torti
Cirrus
Dec 30, 2013
if you mean the icap connection, yes it allways slow down the application (a part of it). There are severall stations, which create a delay.

ASM collect the complete file
ASM send to AV
AV scan the file - bigger files need more time to scan (4.) AV send the file back, although it should send only a response code

But every AV method creates a delay, depending on the file size. Because of this, you only scan a request with file upload and not every request. So, not the application has a slow down issue, only the file upload process (which isn't an issue).

anything wrong? I don't think so.
Mike__Maher_108
Nimbostratus
Dec 30, 2013
I agree with Torti, there will be a slight slow down but only for the file uploads not the entire application. I am currently using this feature in one of our applications and there was full performance testing done with no complaints from the developers or business owners. If you or the business owners are that concerned about performance impacts of this feature there is an option when configuring the AV setting on ASM for "Guarantee Enforcement". If you uncheck the box (disable this option) the documentation says that the system will perform only if it does not slow down the application. I am unsure how it calculates this and honestly would not recommend disabling this, but the option is there and you would still get some protection. However it would make bypassing the scan pretty simple if someone wanted to.

A couple other things to note about AV scanning.

There is a max request size for ASM, or long_request_buffer_size which is defaulted to 10mb. So if the request exceeds 10mb (which would include the file upload) then the ASM will not send the request to the ICAP server. Here is the SOL on this.

https://support.f5.com/kb/en-us/solutions/public/12000/900/sol12984.html?sr=26859617

If the ICAP server you are sending the files to for scanning goes down for any reason and the ASM is unable to get a response it will block the request. The initial log entry show a Virus detected but when you look at the details of that block you will see it says unable to contact ICAP server. So I would recommend making sure the ICAP servers you are sending are high avaialability in some way. We just have our two servers behind an LTM and send traffic to the Virtual IP.

Overall this feature has worked well for us and we have not had any service interruptions or performance issues reported that have been related to it.
- Focus_140526
  Nimbostratus
  Dec 30, 2013
  Mike, Thanks for your tips.
- Focus_140526
  Nimbostratus
  Jan 02, 2014
  Mike, http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-4-0/12.html This document says when you create request adopt profile, you could use Ignore for Service Down Action where BIG-IP system to ignore the error and send the unmodified HTTP request to an HTTP server in the HTTP server pool.
- Mike__Maher_108
  Nimbostratus
  Jan 03, 2014
  I think this implementation is only needed if you don't have ASM licensing. If you are licensed for ASM you can still just use the integrated AV service and perform the same functionality with a bit less configuration. Also this looks like it is going to send all requests to the ICAP pool not just the file uploads, which may desired but also may have larger performance impact on the application. With ASM licensed you can scan just the file uploads and since it is done at ASM you gain some flexibility of using L7 Policy and Rules to seperate out the traffic that is being scanned I am glad you posted this as I didn't realize this was possible with request adaptation, and this feature probably give you ways to implement broader security on traffic coming into a virtual without have ASM. However it looks a bit more complex to manage and probably will apply to more traffic that you want it to. In a pinch though it is an option and I do like having options to use :).
Mike_Maher
Nimbostratus
Dec 30, 2013
I agree with Torti, there will be a slight slow down but only for the file uploads not the entire application. I am currently using this feature in one of our applications and there was full performance testing done with no complaints from the developers or business owners. If you or the business owners are that concerned about performance impacts of this feature there is an option when configuring the AV setting on ASM for "Guarantee Enforcement". If you uncheck the box (disable this option) the documentation says that the system will perform only if it does not slow down the application. I am unsure how it calculates this and honestly would not recommend disabling this, but the option is there and you would still get some protection. However it would make bypassing the scan pretty simple if someone wanted to.

A couple other things to note about AV scanning.

There is a max request size for ASM, or long_request_buffer_size which is defaulted to 10mb. So if the request exceeds 10mb (which would include the file upload) then the ASM will not send the request to the ICAP server. Here is the SOL on this.

https://support.f5.com/kb/en-us/solutions/public/12000/900/sol12984.html?sr=26859617

If the ICAP server you are sending the files to for scanning goes down for any reason and the ASM is unable to get a response it will block the request. The initial log entry show a Virus detected but when you look at the details of that block you will see it says unable to contact ICAP server. So I would recommend making sure the ICAP servers you are sending are high avaialability in some way. We just have our two servers behind an LTM and send traffic to the Virtual IP.

Overall this feature has worked well for us and we have not had any service interruptions or performance issues reported that have been related to it.
- Focus_140526
  Nimbostratus
  Dec 30, 2013
  Mike, Thanks for your tips.
- Focus_140526
  Nimbostratus
  Jan 02, 2014
  Mike, http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-4-0/12.html This document says when you create request adopt profile, you could use Ignore for Service Down Action where BIG-IP system to ignore the error and send the unmodified HTTP request to an HTTP server in the HTTP server pool.
- Mike_Maher
  Nimbostratus
  Jan 03, 2014
  I think this implementation is only needed if you don't have ASM licensing. If you are licensed for ASM you can still just use the integrated AV service and perform the same functionality with a bit less configuration. Also this looks like it is going to send all requests to the ICAP pool not just the file uploads, which may desired but also may have larger performance impact on the application. With ASM licensed you can scan just the file uploads and since it is done at ASM you gain some flexibility of using L7 Policy and Rules to seperate out the traffic that is being scanned I am glad you posted this as I didn't realize this was possible with request adaptation, and this feature probably give you ways to implement broader security on traffic coming into a virtual without have ASM. However it looks a bit more complex to manage and probably will apply to more traffic that you want it to. In a pinch though it is an option and I do like having options to use :).
Torti
Cirrus
Dec 30, 2013
Add:

the most performance impact will result of the AV scan. So, look at the performance stats of your AV system.
if you have trouble with the file size (files bigger than 20mb are not supported with ICAP!), you need a AV proxy or use the strange new method of 11.4 instead of ICAP
- Mike_Maher
  Nimbostratus
  Dec 30, 2013
  What is the new method in 11.4?
- Focus_140526
  Nimbostratus
  Dec 30, 2013
  How does the AV proxy work? any documentations about it? Thanks.
- boneyard
  MVP
  Jan 10, 2014
  Torti you tease use with two possible options which we cant find anything about, could you explain?
Torti_93733
Nimbostratus
Dec 30, 2013
Add:

the most performance impact will result of the AV scan. So, look at the performance stats of your AV system.
if you have trouble with the file size (files bigger than 20mb are not supported with ICAP!), you need a AV proxy or use the strange new method of 11.4 instead of ICAP
- Mike_Maher
  Nimbostratus
  Dec 30, 2013
  What is the new method in 11.4?
- Focus_140526
  Nimbostratus
  Dec 30, 2013
  How does the AV proxy work? any documentations about it? Thanks.
- boneyard
  MVP
  Jan 10, 2014
  Torti you tease use with two possible options which we cant find anything about, could you explain?