For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ashish_205344's avatar
Ashish_205344
Icon for Nimbostratus rankNimbostratus
Aug 17, 2017

Does F5 supports absolute URL's in Allowed URL for ASM Policies.

Hi Experts, Does F5 supports absolute URL's in Allowed URL for ASM Policies.

 

Scenario: The client sends a request to VS https://test.business.com/service/JIT/v2_12/CAU , Irule applied to VS changes the URI to /lno/2_12/CAU and this URI "/lno/2_12/CAU" is mentioned in Allowed URL's with a attached XML P1 in ASM policy. this request is served by Pool 1. Everything works as expected.

 

Problem: When client sends another request https://test.business.com/service/PIT/v2_12/CAU, IRULE changes the URI to and and Allowed URL is webdev:9081/lno/2_12/CAU with a XML profile as P2 but the request is blocked by ASM saying the "Illegal URL lno/2_12/CAU "

 

We cant allow wild card URL as we need to have a xml profile associated to it.

 

Does F5 supports the Absolute URL's functionality in Allowed URL..??

 

application delivery
ASM Advanced WAF
security

1 Reply

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Aug 17, 2017

    Hi,

     

    1. URI may not contain full URL but only
    2. Hostname is included in Host header of HTTP request. if you want to change both URI and Host, change both values.
    3. ASM URL is not full URL( like in browser), LTM URI (including query string) but Path part of the URI.