Forum Discussion

Koalan's avatar
Koalan
Icon for Cirrus rankCirrus
Jan 16, 2020

Disable HTTP OPTIONS method and Disable TCP Timestamp responses

Hi,

 

So we run a penetration testing and we found 2 of our VIPs affected by these:

 

a. Disable HTTP OPTIONS method

b. Disable TCP Timestamp responses

 

Is there a way to remediate this? I tried looking in the internet but:

 

a. Disable HTTP OPTIONS method - i only see to change it globally on the F5 (probably will affect other VIP), is there another way?

b. Disable TCP Timestamp responses - I can't seem to find a proper way to address this, is there a way?

 

Hoping for help. Thanks!

application delivery
iRules
LTM
operations
  • FF's avatar
    FF
    Icon for Employee rankEmployee
    Jan 17, 2020

    a. Like what iaine mentioned, you can use the known methods setting in the HTTP profile to reject/reset the connection. Alternatively you can use an iRule to either reject or return a HTTP 501 response. For more information, refer to https://support.f5.com/csp/article/K34769490. Also if you have ASM module licensed and provisioned, the ASM security policy would block OPTIONS method by default.

     

    b. There is a potential performance tradeoff when TCP Timestamp is disabled in either the TCP profile (Timestamps Extension for High Performance (RFC 1323) setting) or the FastL4 profile (TCP Timestamp Mode setting). You may want to consider randomising the TCP Timestamp instead by enabling this db key tm.tcpsendrandomtimestamp. For more details, you may want to take a look at https://support.f5.com/csp/article/K8072.

     

    • Hamza's avatar
      Hamza
      Icon for Cirrus rankCirrus
      Jan 19, 2023

      hello FF,

      please Could you tell me the correct choice to diable tcp timestamp in fastl4 profile because we have three choices:

      Thanks

  • iaine's avatar
    iaine
    Icon for Nacreous rankNacreous
    Jan 16, 2020

    Hi

     

    You can disable HTTP OPTIONS in the HTTP profile in the known methods section. If you want to only disable it for a single VIP then create a new HTTP profile, make the required change and then associate it to your VIP

     

    For TCP Timestamps. Again, if you want to disable, this is in the TCP Profile in the Congestion Control section. Create a new TCP profile, make your change and then associate it to your VIP