For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Evergrim's avatar
Evergrim
Icon for Altocumulus rankAltocumulus
Nov 27, 2023

ASM DoS Profile blacklist duration

Hi, We had to create a DoS profile for a virtual server at the weekend due to a DoS attack. I have activated three vectors in the profile - Behavioral Anomalous Bad Actors - Stress-based High-Vol...
security
Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Nov 27, 2023

Hi Daniel_Wolf , 

He has both AWAF and AFM licenses provisioned , so he don't see the legacy view of AWAF DoS , but he see the Dos Protection as a multiple vectors distributed between ( Network , SIP , DNS and HTTP ). 

So If he need to configure the Behavioral Dos For HTTP , He can select the Behavioral Vector for HTTP and he can proceed. 

The Snap shot you have shared here is identical to the Behavioral HTTP , Just F5 merged AFM DoS with AWAF DoS shown as a number of Vectors if you have both license provisioned.

So in the recent versions or releases he will not able to switch to legacy view and obtain like your snapshot. 

Correct me If I am wrong 

Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Nov 27, 2023

Hi Mohamed_Ahmed_Kansoh,

the screenshot is from my AWAF with v16.1. Today I was looking at a customer environment with AWAF+AFM (v17.1) provisioned and there I had the possibility to switch between AFM view and legacy view. If legacy view is in 17.1, I'm pretty sure it's also in 16.1.

KR
Daniel

  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Icon for MVP rankMVP
    Nov 27, 2023

    Hi Daniel_Wolf , 

    Great ! 

    Maybe this not supported in VEs because I treid to switch multiple times but without luck.

    But any way , I think he can't set a duration in AWAF Behavioral Bad actor. 


    • Evergrim's avatar
      Evergrim
      Icon for Altocumulus rankAltocumulus
      Nov 27, 2023

      Hey you two,

      Thank you very much for your answers. They've already helped me to skim through. I'll have a closer look later today.

      Yes, I should have started with that. We have both AWAF and AFM provisioned. And of course I was talking about AWAF. I didn't realize that the article was talking about AFM, of course. Sorry for the confusion.