For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brad_53264's avatar
Brad_53264
Icon for Nimbostratus rankNimbostratus
Nov 01, 2008

ASM custom blocking response & iRules

I am trying to write an iRule to do search and replace logic on the body of a custom blocking response.     When I add headers to the custom blocking response within ASM I do not see the...
app sec
BIG-IP Access Policy Manager (APM)
security
brad_11480's avatar
brad_11480
Icon for Nimbostratus rankNimbostratus
Feb 09, 2011
And Version 10 has added some Irule events that can be set.

 

ASM_REQUEST_BLOCKING

 

ASM_REQUEST_VIOLATION

 

ASM_RESPONSE_VIOLATION

 

 

So I'm looking at the information on these (wiki/default.aspxiRules.ASM) and finding that either I don't understand it or it isn't working as the examples show.

 

 

The example in http://devcentral.f5.com/wiki/default.aspx/iRules/ASM__violation_data.html

 

 

seems to indicate that you can redirect the URI. but trying to do this doesn't seem to change the fact that it issues the canned block page. I would MUCH prefer to handle the response pages by returning static pages from the various applications. The canned messages are plain text and (1) the business doesn't like the look, and (2) any changes to the information requires an update to the policy.. Let the business do this.

 

 

So I would like to replace the response page, basically cancel the canned response and either issue a redirect (which causes another error--011f0007:3: http_process_state_prepend - Invalid action EV_SINK_HEADER during ST_HTTP_PREPEND_HEADERS ) or a http::uri substitution (which doesn't seem to occur).

 

 

Looks like some progress. but information and examples are sketchy.... THANKS SO MUCH.