Forum Discussion

raghav_rao_2526's avatar
raghav_rao_2526
Icon for Nimbostratus rankNimbostratus
May 17, 2016

Best practice value to have

Hi Folks!   We want to enforce session timeout and acceptable intensity rate in our WAF for couple of applications. Kindly let us know what are the best practice value which needs to be set for "S...
ASM Advanced WAF
security
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus

"Session idle timeout" - 15 mins is common for internet banking front-ends.

 

"Acceptable intensity rate" - I'm not sure what it is. Are you talking about ASM/L7 DOS protection profile configuration? Where did you find this 'acceptable intensity rate' setting?

 

Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
May 18, 2016
In F5 there are L7 DOS protection thresholds. I'd recommend working with the defaults at start. You can set the profile to Transparent operation mode initially so that you can evaluate if you need to fine-tune the settings at all. I do not know your environment but most likely, anything below 300% is going to be too low, anything above 600% too high.