Forum Discussion
NimbostratusASM slows basic website
We have a pretty basic ASM policy applied in transparent mode against a standard https website. When we apply the ASM HTTP Class the website slows to a crawl to get to the home page. If we remove the ASM HTTP Class the site opens as expected less than a second. I know it doesn't make a difference whether the ASM policy is in transparent mode or blocking mode its still processing the request its just the final outcome that is different.
Does anyone have any suggestions on what to look for?
ASM Policy includes the following.
RFC – Evasion technique detected, HTTP protocol compliance failed
Access Violations - Access from malicious IP address, Illegal HTTP status in response, Illegal meta character in parameter name, Illegal method, Illegal URL, Request length exceeds defined buffer size
Length Violations - Illegal cookie length, Illegal header length
Input Violations - Disallowed file upload content detected, Illegal meta character in value
Cookie Violations - Modified ASM cookie
Negative Security Violations - Attack signature detected
3 Replies
Mike_MaherSo I run over 20 web applications behind ASM and I don't see what you are seeing here. So let me ask you a couple more questions.
What version are you running?
What does your resource provisioning look like?
What type of Virtual Server is this?
When you remove the HTTP Class do you keep or remove the http protocol profile on the Virtual Server?
Do you have a client SSL profile applied to the Virtual Server?
Are there any iRules attached to the Virtual Server?
From an ASM standpoint
Do you have IP Intelligence licensed and turned on in the policy?
Have you tried going in and disabling various protection you think may be the problem and retesting? I would do it one a at time
Mike
natheCirrocumulus
jokragly,
Just some thoughts, suggestions:
Anything in /var/log/asm or /var/log/ltm that might give some clues? Have you tried running httpfox/ httpwatch from a client? What about a tcpdump capturing both on the client and server side of the connection?
Are you terminating the SSL connection on the f5 and/or re-encrypting to the backend server?
Is this the only HTTP Class / ASM enabled VS? Do the others work ok?
What about if you run the "top" command whilst the HTTP Class is enabled? I think the "bd" process is the one to bear in mind with ASM.
Rgds
N
jokraglyI feel bad posting this as I should have known better to try this before hand but Mike, thanks for the suggestion.
The Illegal URL Violation was causing this issue. I had to accept the homepage as a trusted URL. The hit count was several hundred, I also cleared this.
We are running ASM on several other VIPs without any issues, this was just unique.
Thanks again!
