For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sys-team_172267's avatar
sys-team_172267
Icon for Nimbostratus rankNimbostratus
Jun 27, 2016

ASM disable and log requests

Hello,   After i disabled ASM by iRule (ASM::disable) i still should see requests under "Event Logs-->Application-->Requests? i build iRule that recognized specific URL path and disabled ASM for t...
ASM Advanced WAF
devops
LTM
security
AaronJB's avatar
AaronJB
Ret. Employee
Jun 27, 2016

I just tested this on 12.0 with a fairly basic configuration; HTTP VS, Log All Requests logging profile attached, ASM policy set to block for the 'curl' user agent and a test request.

 

Once I added the iRule my request was no longer blocked and I no longer saw a log entry in the logging profile.

 

Your test implies the request is, indeed, being processed via the ASM module. What iRule event are you using ASM::disable in? I tested with HTTP_REQUEST.

 

sys-team_172267's avatar
sys-team_172267
Icon for Nimbostratus rankNimbostratus
Jun 28, 2016
Thank you guys for you help, this is my iRule: when ASM_REQUEST_DONE { set x [ASM::violation_data] if {([lindex $x 0] contains "VIOLATION_CHAR_CONV")&&([HTTP::path] equals "/request")} { log local0. "VIOLATION_CHAR_CONV detected" ASM::disable } } Unfortunately, I still see the requests log. I am sure that the iRule works because I also get log in "log local0. "VIOLATION_CHAR_CONV detected" Thank you.