For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

smalex's avatar
smalex
Icon for Altostratus rankAltostratus
Jun 11, 2019

ASM- Bad HTTP version

We have implemented ASM last day and many requests are blocked stating: Bad HTTP version. Version is 1.1 but still its blocked. What might be the reason. Please Guide.
application delivery
ASM Advanced WAF
security
smalex's avatar
smalex
Icon for Altostratus rankAltostratus
Jun 11, 2019

Thank you for the reply. But Without ASM in place these were working. Shouldn't it have been blocked?

Kevin_Davies's avatar
Kevin_Davies
Icon for Nacreous rankNacreous
Jun 11, 2019

What is there to block it? Firewalls never see the URL in a SSL session, only the application sees the final request and it will either accept it or it won't. The request is definitely outside the spec for HTTP. ASM will never pass this kind of request as it fails protocol compliance. One of the very reasons Application Security Manager was designed to address.