Forum Discussion

Steph_282542's avatar
Steph_282542
Oct 05, 2017

ASM Policy in "Blocking" Mode switch to "Transparent" for some IP's

I have a policy that I need to switch to blocking but the business want to have a phased approach. Only the testing team should be in Blocking, while the rest of the business (a different IP range) remains in transparent.

 

I need to keep the same policy so that I can "proof" that everything is running fine.

 

Is there a method to do that ? Was thinking about an iRule but dont know how. I know how to disable ASM with an iRule but, that's something I don't want because I need to keep the learning suggestions.

 

Bye St.

 

application delivery
ASM Advanced WAF
iRules
security
  • Steph's avatar
    Steph
    Icon for Nimbostratus rankNimbostratus
    Oct 05, 2017

    Thank you,

     

    This would be exactly what I need... but the other way around. I need to block a specific range e.g. 10.10.10.0/24 but allow all the others.

     

    With the build-in solution, I can only "unblock" a specific range, I dont know how to unblock ALL but 10.10.10.0/24.

     

    • Cloudx's avatar
      Cloudx
      Icon for Nimbostratus rankNimbostratus
      May 09, 2024

      Hi Steph,

       

      Has you able to solve this ? Was it workable when you apply blocking mode for admin only but unblock for all? I am curious as well if this can be done.

  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Oct 05, 2017

    Are your users coming in from the global internet then, or are they coming from a specific intranet? You can still use the exclusions list, but it's more work.

     

    Another option would be to duplicate your policy and have a transparent policy that is an exact match for your blocking policy, but is the default for the virtual server while the 10.10.10.0/24 network is sent to the blocking policy.

     

    This would require you to be disciplined about changes, but would probably be the simplest way to handle this.

     

  • Steph's avatar
    Steph
    Icon for Nimbostratus rankNimbostratus
    Oct 06, 2017

    Hi Chris,

     

    I had the idea of duplicating the policy, the discipline about syncing both policy is not an issue ;) The tools on the F5 (Policy Diff) will help a lot. The concerns are more related to the business who want "One and Same" policy for both.

     

    You are correct, there will be the internal IP range which should be in blocking mode in the first place, and the rest of the world in transparent.

     

    There will be 2 VS pointing to the same policy : * one internal * one for the others

     

    Using exclusion list will make the story a bit complicated. An iRule to disable ASM would take not more than 3 lines of code... instead of a "disable ASM" I could use a command to set the policy to transparent... but I can't find anything about that.

     

  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Oct 06, 2017

    Truthfully I'm not sure this use case occurred to the team that developed the ASM. The ASM is designed to be used in transparent, then moved to blocking. Because the transparent/blocking setting is a setting that is global for the entire policy, it can't be easily toggled on and off per connection.

     

    ASM can be disable for certain flows very easily, as we simply pass the request to the back end servers without handing it off to bd (the ASM process). Setting ASM to transparent for certain IPs would be far less straightforward (and is likely why irules can't do it). You might be able to convince PD to whip something up to do this, but likely not without paying for the feature (an expensive proposition, but your Account team can help).

     

    Barring that, duplicate policies will be your best option.