For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

crowe's avatar
crowe
Icon for Cirrus rankCirrus
Jun 23, 2020
Solved

ASM IP Exceptions

We are new to having ASM implemented on our main virtual servers, over the past couple months I keep having to add IP exceptions for for valid customer IP's that get blocked as "malicious". I assume ...
application delivery
ASM Advanced WAF
exception
malicious
valid
  • Ivan_Chernenkii's avatar
    Ivan_Chernenkii
    Jul 02, 2020

    You need to leave Alarm enabled for malicious IP - in such case you will have ability to monitor how it works and detect (but not prevent) possible attack

crowe's avatar
crowe
Icon for Cirrus rankCirrus
Jun 30, 2020

 

  • Hello, the category that seems to be blocking the valid traffic is "Botnets", you would still recommend removing that category? or would I make adjustments on the policy learning section?

 

crowe's avatar
crowe
Icon for Cirrus rankCirrus
Jul 01, 2020

It is strange indeed as it is always different public IP addresses being blocked, that is why we have ended up with three pages of /32 addresses in the IP exceptions list. Yesterday was the first day in two weeks since I have received a block, I'll give it more time to see if they are consistently the same category. Thank you.

The image was just the details of what I'm seeing in ASM logs regarding the latest block.