Forum Discussion

tminfw2's avatar
tminfw2
Icon for Nimbostratus rankNimbostratus
Jan 29, 2015

Bare byte decoding and French characters

Currently, our ASM policies are configured with bare byte decoding check activated. However, this poses problems, as some of our legitimate French pages are flagged with this error. Specifically, it ...
ASM Advanced WAF
management
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Jan 29, 2015

Not sure how granular you can be with Evasion Techniques, not very I believe.

 

Do you get learning suggestions? Is it triggered on a parameter value? I wonder if you can create an explicit parameter and uncheck "check characters on this parameter value"?

 

Other option (more complicated I know) is do traffic classification (via http class or local traffic policy dependant on your TMOS version) and divert the french pages, say /france, to a different security policy configured as Western European.

 

Not sure if you want to allow the violation on the specific entity/page or just stop it from being logged? Not sure if you can stop it being logged.

 

Hope this is some help,

 

N