For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

lnxgeek's avatar
lnxgeek
Icon for MVP rankMVP
Mar 07, 2023

Bot Defense Deployment/Troubleshooting

Hi all I have started to push Botd more and more as a solution for fending off ddos attacks. However, I often end up with a lot of false positives or blocked or challenged requests which are ...
security
Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Mar 14, 2023

After some tests switching the Bot protection profiles with Local Traffic policies (for the web form login url the bot profile uses the javascript based browser verification ) it seems the feature browser verification does not work even when from the local traffic policy and the logs the URL is matching the Bot protection profile that has browser verification enabled. I tested switching with verify before and after access but it does not work on 15.1.8.1  😀

 

Do you also see the same issue lnxgeek  ?

lnxgeek's avatar
lnxgeek
Icon for MVP rankMVP
Mar 14, 2023

Nikoolayy1 I have bellow LTM policy on my VS:

for bw_botd I have these settings to accomodate the app:

and this to go more aggressively on the browser:

Btw I think enabling SPA does make it work more smoothly - thanks 🙂

I'm using 16.1.3.3.

 

  • Nikoolayy1's avatar
    Nikoolayy1
    Icon for MVP rankMVP
    Mar 14, 2023

    And you have tested that something like curl, browser where cookies are  or apache benchmark are blocked when accessing urls that are protected with bot profile that has "Verify After Access" and it is the javascript checks not the signatures that block them?

     

    This can be seen in the traffic logs for bot or just opening browser and blocking it to accept cookies and you will see if you are truly blocked and you will also see the javascript message.