For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mulham_171271's avatar
Mulham_171271
Icon for Nimbostratus rankNimbostratus
Nov 28, 2016

ASM: changing hostname for whitelisted URL's

Hi,

 

We have ASM policy already in place for site-X.mycompany.com, we have site-Y that hosts the same application but with a different hostname site-Y.mycompany.com

 

Is there a way to export the ASM policy of site x and change the hostname for the URL's and apply it on site-Y, or I need to build a new policy ?

 

If this is doable, anything else I need to modify besides URL's hostname ?

 

application delivery
ASM Advanced WAF

4 Replies

  • Hannes_Rapp_162's avatar
    Hannes_Rapp_162
    Icon for Nacreous rankNacreous
    Nov 28, 2016

    You can export, and re-use

    The reason for that is if you take a closer look at the meaning of "URL", in BigIP ASM it's really an equivalent to HTTP Path. This means your allowed/disallowed URL definitions are guaranteed to continue working after a DNS update.

    • From the perspective of 'Illegal URL' violation, it doesn't make any slight difference if you update DNS from 
      foo.bar.com
      to 
      bar.foo.com
      .

    Here's another example:

    • True URL: 
      https://devcentral.f5.com/questions
    • BigIP ASM URL: 
      /questions
    • Hannes_Rapp_162's avatar
      Hannes_Rapp_162
      Icon for Nacreous rankNacreous
      Nov 28, 2016

      Assuming your case weren't so simple, you could always export the policy as XML, and do a 'search & replace all' on the file. Once done, you just import the modified XML as a new policy. Good luck!

       

  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2016

    You can export, and re-use

    The reason for that is if you take a closer look at the meaning of "URL", in BigIP ASM it's really an equivalent to HTTP Path. This means your allowed/disallowed URL definitions are guaranteed to continue working after a DNS update.

    • From the perspective of 'Illegal URL' violation, it doesn't make any slight difference if you update DNS from 
      foo.bar.com
      to 
      bar.foo.com
      .

    Here's another example:

    • True URL: 
      https://devcentral.f5.com/questions
    • BigIP ASM URL: 
      /questions
    • Hannes_Rapp's avatar
      Hannes_Rapp
      Icon for Nimbostratus rankNimbostratus
      Nov 28, 2016

      Assuming your case weren't so simple, you could always export the policy as XML, and do a 'search & replace all' on the file. Once done, you just import the modified XML as a new policy. Good luck!