Re: ASM IP Exceptions

Hello Ivan,

1. Yes, I have it set to autoupdate and it is staying current as you can see below:

Last time the server was contacted for updates   06/25/2020 14:05:08

Last time an update was received          06/25/2020 14:05:09

Total number of IP Addresses in the database          4473532

Number of IP Addresses received in the last update         37

2. I don't have any in the logs to look at the movement, I will make note as they come in regarding categories and take your advice on disabling it only one.

3. Thank you for pointing this out, I will start monitoring as valid blocks occur.

Hello Crowe,

1. Is your IP Intelligence database update periodically?
2. In what IP Intelligence category do you have false-positives? Only in one or in several? If in one, then may be you can just disable this category.
3. Learning works in any mode (Transparent or Blocking). You should see learning suggestions on "Security ›› Application Security : Policy Building : Traffic Learning" page.

Thanks, Ivan

Hi Youssef, thanks for the reply. We do have IP intelligence enabled, so I take it when this happens that is what is causing the request to be blocked. I came in after this was all implemented and it was done by a third party consulting firm. We were told they did it using the learning procedures and once we started having the weekly whitelisting taking place they slowly stopped responding to my emails of concern.

It sounds like things need to go back to a learning mode to get this fine tuned. My colleague that worked with them is no longer with us so I'm trying to get caught up and lined out so we are not getting these false positives.

Would allowing these request via the ASM Utility as they are blocked cause it to learn and possibly line out or should we take it back to transparent mode to do so?

Thanks in advance.

Hi,

the most important is when building your security policy. You can deploy your policy in staging mode (learning and automatic deployment when required). this will allow you to have an optimal security policy, because as soon as you have a false positive you can create an exception in an explicit way...

to summarize it is relatively important to deploy your security policy in an optimal way and indeed avoid whitelisting. if you have a blocking you must see if it is a false positive and if yes, make the necessary exception at the ASM level (explicitly so as not to make an opening too wide)...

Users are blocked by IP intelligence or by security policy?

regards