Forum Discussion

Chung_Yu's avatar
Chung_Yu
Icon for Nimbostratus rankNimbostratus
Dec 17, 2020

Basic ASM Policy for Attack Signatures Only - apply to multiple VIPS

Hi

 

I am wondering how to best manage ASM policy - most of the VIPS can use a basic policy that only checks for signatures. Now, if one of the VIPS using this policy has a false positive, how can I disable the signature for only that VIP and not for all the VIPS using this policy?

 

Thanks

 

C

ASM Advanced WAF
security
  • Samir's avatar
    Samir
    Icon for MVP rankMVP
    Dec 17, 2020

    Options 1. Create copy of existing asm policy and customise per requirement. Now assign new asm policy to particular vip.​

    ​

    Options 2. Use iRule and bypass certain signature id but not sure the feasibility.

     

  • Erik_Novak's avatar
    Erik_Novak
    Icon for Employee rankEmployee
    Dec 18, 2020

    You could create a Parent policy with attack signatures configured as optional. Use that parent policy as the basis for new policies. You can then disable the signature causing the FP, or leave it in staging, for that single policy only. The change will not affect the Parent policy or other policies based on the Parent.

  • Chung_Yu's avatar
    Chung_Yu
    Icon for Nimbostratus rankNimbostratus
    Dec 18, 2020

    Thanks guys, I have started to use a Parent policy as the base policy and build out the ASM on a per VIP basis.

     

    Great input and thanks for validating some ops procedures for me.

     

    REgards

     

    Chung