For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Feb 08, 2013

ASM buffer sizes

I am running 11.2.0 HF1 on a 3900, and I have an application that does file transfers. Right now all the files are fairly small maybe a couple MB. However there is a new use case that might have people downloading and uploading files that are anywhere from 100mb - 1GB.

 

In looking at the ASM I seen that in the advanced parameters there is the request_buffer_size, which is set to 10mb by default and it appears has a max limit of 20mb. There is the ResponseBufferSize which looks to be set to about 130mb by default and I have not found a max limit for that yet.

 

So my question is does this mean that ASM can't support a file upload of more than 20mb? It would appear so by what I am seeing but maybe I am misunderstanding something. Also does anyone know if there is an upward limit for the Response. Lastly does anyone have a case where you are moving larger files through an ASM, I am somewhat concerned about performance and if anyone has any experiece with this or has recommendation on max file sizes to allow through ASM I would appreciate it.

 

 

Mike

 

app sec
BIG-IP Access Policy Manager (APM)
security

4 Replies

  • Torti's avatar
    Torti
    Icon for Cirrus rankCirrus
    Feb 08, 2013
    For Requests:

     

    If you want to upload files bigger than 20mb, you have to disable "Request length exceeds defined buffer size" for the policy.

     

    For Response:

     

    ???

     

     

    Adds:

     

    Is it a web service? Attention with the value of "total_xml_memory"

     

    ICAP doesn't work with bigger files than 20mb.

     

    I've never tried such big uploads ;-)

     

    You should test it --> following the systems memory allocation while uploading.

     

     

    regards
  • Mike_Maher's avatar
    Mike_Maher
    Icon for Nimbostratus rankNimbostratus
    Feb 08, 2013
    Torti,

     

    Thanks for the quick response.

     

     

    So if I disable the ASM block but the buffer is still set to 20mb will ASM just ignore that buffer setting and load the whole message into memory for inspection or do I loose inspection of larger request entirely?

     

     

    It is not a web service it is an HTTPS page that allows for file uploads and downloads.

     

    I am not planning on using ICAP here as the application has measures to ensure file integrity

     

    I plan on testing system resourecs in my lab
  • Sergio_Magra's avatar
    Sergio_Magra
    Icon for Nimbostratus rankNimbostratus
    Feb 21, 2013
    Hi,

     

    I don't know if it applies also to 11.2, but this is a KB that maybe will be useful to this case.

     

     

    http://support.f5.com/kb/en-us/solutions/public/8000/200/sol8292.html?sr=27061998

     

     

    Best regards

     

     

  • Torti's avatar
    Torti
    Icon for Cirrus rankCirrus
    Jul 25, 2013
    update:

     

    If anyone is planning to scan file uploads bigger than 20mb with ASM --> use a AV proxy behind the f5.

     

    There is no really useful option to do this with the ASM, although they actually did bind ICAP to LTM.

     

    But this is a bad design.

     

    Using an AV proxy is much easier.

     

     

    regards