For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

member123_60341's avatar
member123_60341
Icon for Nimbostratus rankNimbostratus
Jan 14, 2010

ASM - pool to be defined in http class or in VIP ?

Hi ,     We are having two LTMs running ASM. There are two virtual servers created one for 'http' and one for 'https' (for SSL offload).     1. When we are enabling ASM, do we ne...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jan 18, 2010
Hi Joe,

 

 

I missed your last reply. If you have one or more HTTP classes with filters set, it could be possible for a request to not match any HTTP class and go to the default pool. So I'd suggest using a catch-all HTTP class with no filters and ASM enabled. You could set up a block all policy on this catch-all class to send a blocking response to any request which hits this class. Due to a quirk in class handling, you need to specify a pool with at least one member on the block all class in order to get TMM to send the request to ASM for parsing.

 

 

Here is a solution which details the class matching logic with pools on the class(es) and/or VIP:

 

 

SOL8018: Overview of the BIG-IP HTTP class traffic flow

 

https://support.f5.com/kb/en-us/solutions/public/8000/000/sol8018.html

 

 

Aaron