Forum Discussion

ghost-rider_124's avatar
ghost-rider_124
Icon for Nimbostratus rankNimbostratus
Jun 02, 2016

ASM and Web Service Security

Hello   I am planning to put web service (XML) on F5 for LTM/ASM. But web service security (encryption/hashing of XML payload) already implemented on server. So there is any benefit of ASM here bc...
application delivery
ASM Advanced WAF
BIG-IP
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Jun 02, 2016

    Hi,

     

    Is the full xml payload encrypted or just some parts ?

     

    If you import key used for enc on the ASM, you will be able to parse the payload and apply related security check with the use of xml profile.

     

    Otherwise, ASM will not be able to check content but only url, headers and method

     

Yann_Desmarest_'s avatar
Yann_Desmarest_
Icon for Nacreous rankNacreous

Hi,

 

Is the full xml payload encrypted or just some parts ?

 

If you import key used for enc on the ASM, you will be able to parse the payload and apply related security check with the use of xml profile.

 

Otherwise, ASM will not be able to check content but only url, headers and method

 

Yann_Desmarest_'s avatar
Yann_Desmarest_
Icon for Nacreous rankNacreous
Jun 02, 2016
It's up to you. But yes that's a possibility. F5 can be the endpoint that decrypt the xml content and forward it in clear text to the backend