For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Adrien_Legros_1's avatar
Adrien_Legros_1
Icon for Altostratus rankAltostratus
Jun 05, 2009

Disabling ASM for clients coming from an internal network

We have a virtual server for a web application and we'd like to test the ASM only for the internal people. So I created 2 pools, one for the external users and one for the internal users. The ASM should only verify incoming requests from the internal network.

 

 

How can I (via an irule?) disable the ASM when i see external request and enabling it when i receive internal requests?

 

 

Thanks.
app sec
BIG-IP Access Policy Manager (APM)
security

3 Replies

  • Benjamin_9036's avatar
    Benjamin_9036
    Historic F5 Account
    Jun 05, 2009
    Hey Adrien,

     

     

    This depends, at least partially, on what version you are using. The methods to disable the ASM within iRules has changed a few times. If the internal and external clients will be from different networks, it should be fairly simple to define an iRule to do this. This has come up a time or two before, in fact. Have a look at the solutions we talked about in this post:

     

     

    http://devcentral.f5.com/Default.aspx?tabid=53&forumid=47&postid=34111&view=topic

     

     

    The best solution is probably a hybrid of these rules. This, to filter based on client IP address:

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/AccessControlBasedOnIP.html

     

     

    Then this to bypass ASM:

     

    https://support.f5.com/kb/en-us/solutions/public/7000/600/sol7616.html

     

     

     

    Cheers!

     

     

    // Ben
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 17, 2009
    There's been yet another change in how to disable ASM in v10.0.1 (covered in SOL10128, but not in SOL7616). Apparently there isn't a supported method for doing this at all in 10.0.0. See SOL10128 for details.

     

     

    SOL10128: The PLUGIN iRule commands do not function in BIG-IP version 10.0.0

     

    https://support.f5.com/kb/en-us/solutions/public/10000/100/sol10128.html (Click here)

     

     

    It would be ideal if the PLUGIN::, ASM:: and WAM:: commands could be documented in the Wiki at some point (nudge, nudge).

     

     

    Aaron