Forum Discussion

ghost-rider_124's avatar
ghost-rider_124
Icon for Nimbostratus rankNimbostratus
May 03, 2015

Automatic Policy Building and Support ID

Hello Expert

 

I enabled automatic policy building with basic mode and when policy was stable, I disabled the automatic policy building.

 

Now users are getting some support ID and block page from F5. What should I do?

 

1- There is no learning suggestion. So I need to manually look in to illegal request in logs? What I do next? 2- OR I can enable the automatic learning again for few more days, while keeping the previous learns

 

Regards,

 

GR

 

ASM Advanced WAF
deployment
security

4 Replies

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    May 04, 2015

    1. That's one option.

       

    2. For the violations u are interested in go to Blocking - Settings and ensure the Learn check box is selected. That way any violations will be in the Manual Traffic Learning section of the GUI.

       

    Hope this helps,

     

    N

     

  • ghost-rider_124's avatar
    ghost-rider_124
    Icon for Nimbostratus rankNimbostratus
    May 04, 2015

    Hi Nathan

     

    1- That's one option means I can again enable automatic learning for few more days? The previous learning will be there? Also users will not be blocked because again ASM is in learning mode?

     

    • nathe's avatar
      nathe
      Icon for Cirrocumulus rankCirrocumulus
      May 04, 2015
      I meant you can check the requests logs to see what was blocked. I probably wouldn't re-enable policy builder but add the Learn action to violation. Is your policy Transparent mode or Blocking mode?