Forum Discussion
CirrostratusASM bot detection
Folks
I have requirement to enable bot detection in F5 ASM policy for my application access via only mobile browsers or PC browsers not through mobile app, how i can avoid false positive here which detect by ASM. I understand that f5 inject java script in order to verify client integrity, what is the best practice here to achieve my goal.
any input appreciated.
dfff_314403Nimbostratus
ErkkiS, won't this defeat only primitive bots?
- samstep
Cirrocumulus
You need to have 2 separate ASM policies - one for browsers and a separate one for the smartphone app. The browser policy will have full bot detection features enabled and the smartphone app policy will have JavaScript-requiring options in bot/anomaly detection switched off and relying more on IP-based anomaly detection features of ASM.
I assume you already have a separate Virtual Server for the mobile app, but if not then you can easily route the incoming traffic to two different ASM policies depending on the User-Agent header using Local Traffic Policy.
Hope this helps,
Sam