BIG-IP WAF Causes WSS Connections to Stall

Question

Hey all!We've been using BIG-IP in our company as a gateway to the entire network, and we have multiple inner hosts that are proxyed by it.All connections using HTTPS/WSS are passed through a WAF policy that has most of the signatures enabled, but we've recognized a problem with WebSocket connections:Any WebSocket connection created from a browser (Chrome) that goes through the WAF policy is stalled, with the status showing as "Pending" indefinitely. It doesn't look like BIGIP outright blocks the connection, since there is no event log for it, but if the connection is setup to bypass the WAF policy (by disabling ASM in an iRule), it works well.I'd appreciate any help in troubleshooting the problem, if anyone has faced it before. We are using BIGIP 15.1.5.1.

mohamed_ahmed_kansoh · Answer

Hi&nbsp;AceHunter1965&nbsp;,&nbsp;I recommend to add an explicit Web socket URI Entities , to Let Bigip AWAF parse and deal with it properly.&nbsp;So identify your Websocket URIs and add them explicitly , use the below Article&nbsp; :&nbsp;https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-12-1-0/28.htmlBut you need to enable your event Log to see traffic behavior after adding these entities.&nbsp;

juergen_mang · Answer

When this problem occurs there is usually no websocket profile attached to the virtual server.
Reference: https://my.f5.com/manage/s/article/K35603146

leslie_hubertus · Answer

Hey&nbsp;AceHunter1965&nbsp; - did either of the suggestions above help you troubleshoot? If yes, could you pleae click "Accept as Solution" on the one that worked for you, or let us know if you still need assistance?&nbsp;

acehunter1965 · Answer

Hey,Seems like adding the websocket URI has no visible effect on the problem

acehunter1965 · Answer

Hey,We've added a websocket profile before encountering the error, and it persists even after trying all websocket masking options.

Forum Discussion

BIG-IP WAF Causes WSS Connections to Stall

6 Replies

Recent Discussions

TELEGRAMA @CANNAUNION DINERO FALSO 💸✔💸

Handling IP Geolocation Conflicts with AWAF for Internal LAN Addresses

F5 AWAF with HTTP/2, MRF and Websocket profiles

What parameter sections can be checked to find out the cause of slow GUI access?

Issue with worker_connections limits in Nginx+

Related Content

BIG-IP v13 native RDP - VDI connection failure

xmlns="" is causing rejection on BIG-IP ASM

F5 Big-IP VE on azure

Big-IP DNS - Zone Transfers

BIG-IQ collecting BIG-IP iRule logs