Forum Discussion

Nazaktabar_3358's avatar
Nazaktabar_3358
Icon for Nimbostratus rankNimbostratus
Oct 08, 2017

ASM; Change of "Ignore Value" param with event description: Fallback to default parameter type

Hello everybody!

 

I have encountered a problem and need help! I have created a policy and activated its "real traffic learning". Through trusted traffic, it recognized some parameters of "Ignore Value" type and some of other types. After 8 days (1 day more than "enforcement readiness period") and before deactivating "real traffic learning" (I had to do that), I edited some of other parameter, and I observed that the policy builder changed all of "Ignore values" parameters to "user input with length of 10" one by one. Description of these events are logged as "Parameter Type was set to User input value. Fallback to default parameter type".

 

could any one help me with:

 

1- Firstly, why some of parameters got type of "Ignore value"?

 

2- Why "Ignore values" parameters should be changed in this scenario? And why these changes are made one day after "enforcement readiness period"? How this scenario could be explained? Generally, does policy builder change parameters after "enforcement readiness period"?

 

3- And, the event description says "... Fallback to default parameter type", Where the type "user input with length of 10" is defined as default? Can I edit this setting of default value?

 

thanks a lot!

 

ASM Advanced WAF
devops
policy builder
security

2 Replies

Sort By
  • Romani_2788's avatar
    Romani_2788
    Historic F5 Account
    Oct 27, 2017

    Very likely, these Parameters are created with Ignore value because Policy builder is set to identify Content Profiles and it automatically detects advanced protocols, and will be taken out of this status once the type is identified, which is why you saw it change to 'user input' after it has detected the input type. The length of 10 simply indicates that Policy Builder never found an input of more than 10 characters (or maybe slightly less), and therefore doesn't deem it necessary to give this parameter more than that size input in securing it.

     

    • Nazaktabar_3358's avatar
      Nazaktabar_3358
      Icon for Nimbostratus rankNimbostratus
      Nov 01, 2017

      Hi! Thanks a lot dear Romani of your response. I am sorry it is still obscure for me...

       

      The senario was: I could not have traffic in my trusted zone any more and my parameter was not detected enough accurate. So, Before {enforcing and disabling Policy builder and sending the policy to operation}, I started to editing some of "user input" parameters one day after "enforcement readiness period", and then I saw that Policy builder have started to changing of "ignore value" parameters.

       

      Having no traffic, how Policy builder could identify the type of "ignore value"s?