Forum Discussion
gowenfawr
Nimbostratus
Aug 14, 2012ASM - Traffic Learning seems to be one way?
The ASM spectrum of transparent/learning/staging/blocking has been very problematic for me. It seems as if there are many hoops to jump through before traffic will be blocked, and quite often it won'...
hoolio
Cirrostratus
Aug 16, 2012Hi Greg,
For some policy components (file types, URLs and flows), you can ignore individual learning suggestions:
ASM | Policy Building | Ignored Entities
This screen displays the number of ignored security policy entities for the current edited security policy selected.
You can create an ignored entity by deleting file types, URLs, or flows from the Learning tables. The system ignores these deleted items and does not generate learning suggestions for them.
You cannot currently disable learning for a specific attack signature. You should be able to disable learning suggestions for all signatures in a signature set though. If you wanted to tinker a bit, you could move the attack sig(s) you never want to get learning for into a separate attack sig set with learning disabled.
The ASM config guide goes over policy building using the Learning tool:
Manual Chapter: Refining the Security Policy Using Learning
https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-2-0/asm_learning.html
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
