For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Steph_282542's avatar
Steph_282542
Oct 05, 2017

ASM Policy in "Blocking" Mode switch to "Transparent" for some IP's

I have a policy that I need to switch to blocking but the business want to have a phased approach. Only the testing team should be in Blocking, while the rest of the business (a different IP range) ...
application delivery
ASM Advanced WAF
iRules
security
Chris_Grant's avatar
Chris_Grant
Icon for Employee rankEmployee
Oct 05, 2017

Are your users coming in from the global internet then, or are they coming from a specific intranet? You can still use the exclusions list, but it's more work.

 

Another option would be to duplicate your policy and have a transparent policy that is an exact match for your blocking policy, but is the default for the virtual server while the 10.10.10.0/24 network is sent to the blocking policy.

 

This would require you to be disciplined about changes, but would probably be the simplest way to handle this.