For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

quangtran's avatar
quangtran
Icon for Cirrus rankCirrus
Jul 30, 2024

Big-IP ASM automatically removes my hostname

, but I don't see the violation reaching the threshold of 100. Hello everyone, Recently, my service has encountered an issue. In the evening, while everything was running normally, I received a b...
asm
boneyard's avatar
boneyard
Icon for MVP rankMVP
Aug 03, 2024

Did it happen again or was it a one time occurrence?

 

Can you involve F5 support? They can actually look at your configuration and perhaps logs which makes things way easier.

 

What was your enforcement mode set to?

  • quangtran's avatar
    quangtran
    Icon for Cirrus rankCirrus
    Aug 05, 2024

    Hi boneyard 
    I switched the Policy building learning mode to manual, and this issue no longer occurs. I have always set the mode to blocking from the beginning. I want to investigate the cause of the problem, which is why I brought up this topic. This issue occurs on many of my F5 servers, from devtest to prod.

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      Aug 05, 2024

      Certainly if it can be reproduced I would involve F5 support.

       

      I gave it quick try myself, not sure how I would trigger the hostname removal now. You don't do anything just keep getting traffic to it?

      • quangtran's avatar
        quangtran
        Icon for Cirrus rankCirrus
        Aug 06, 2024

        I have tried to create a TAC case for F5, but there are some issues occurring. For the environments, we have a SIEM system, so we can know exactly when traffic blocking happens