For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Romain_Vergnio1's avatar
Romain_Vergnio1
Icon for Nimbostratus rankNimbostratus
Jul 30, 2012

ASM : disabling attack signatures on a specific cookie

Hello,

 

 

I would like to disable some attack signatures on a specific server generated cookie on a LTM/ASM v10.2.4. This is pretty straightforward to do this for a parameter but it does not seem possible to configure ASM to do this for a specific cookie. The only workaround seems to disable globally the signature for all headers which is not a satifsying solution.

 

 

Is there anything I missed in the ASM configuration ?

 

 

Kind regards,

 

Romain

 

app sec
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Aug 01, 2012
    Hi Romain,

     

     

    In 11.x you can enforce specific cookies. You can disable an attack signature on a per-header name=value basis using Header-Based Content Profiles that are configured on a URL. In v10, I think you're stuck disabling the signature on all headers.

     

     

    Aaron