For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

member123_60341's avatar
member123_60341
Icon for Nimbostratus rankNimbostratus
Jan 14, 2010

ASM - pool to be defined in http class or in VIP ?

Hi ,     We are having two LTMs running ASM. There are two virtual servers created one for 'http' and one for 'https' (for SSL offload).     1. When we are enabling ASM, do we ne...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jan 14, 2010
Hi Joe,

 

 

There are a few considerations. Are you using the same pool for both the HTTP and HTTPS VIP?

 

 

Are you ever going to use multiple HTTP classes on the same VIP with any filters set?

 

 

In a simple VIP, one ASM-enabled class and one pool scenario it shouldn't make any difference whether the pool is configured on the class or the VIP (or both). I'd say it's easier to configure the pool on the VIP so the VIP status is updated based on the pool availability. If you add the pool to the class and don't have a default pool on the VIP, the VIP status shows unknown.

 

 

If you are going to use multiple classes with filters set, you should always add a catch-all class with no filters set and ASM enabled. This ensures that any request which doesn't match any prior class will always hit the catch-all class and go to ASM for validation.

 

 

Aaron