Forum Discussion
Sinistrad_29710
Nimbostratus
NimbostratusASM blocking a legitimate flow, how to proceed
Hello F5 experts,
While trying to access to a specific share, I have an error provided by the ASM which is blocking me because it detects this attack type: Detection Evasion. This is a normal URL and should be working for everyone, ine the requested URL I saw in the logs: /index.php maybe the F5 does not accept this. could you please advise how to proceed ? I cannot whitelist the URL because it changes following the sharing server, and I cannot whitelist the source IP because it changes also.
Please advise, Thanks, Khadija
samstepCirrocumulus
you need to investigate the request in the ASM logs and see what exactly is causing the violation - can be a number of factors.
Here is the F5 knowledgebase article to help:
K7929: Working with Evasion technique detected violations
https://support.f5.com/csp/article/K7929