For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mm_pen_242283's avatar
mm_pen_242283
Icon for Nimbostratus rankNimbostratus
Sep 19, 2016

F5 ASM - DoS protection and local traffic policies

Hi experts.   I successfully managed to segregate ASM policies for different FQDNs that coexist on the same VIP (using Local Traffic Policies and "Host Header" as a classifier). The default rule w...
ASM Advanced WAF
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Sep 23, 2016

Having a separate granular profile for each hostname is a good practice because (I assume) they are different applications with different URLs, users and usage. If one app is high-usage and another one is low you don't want to block IP addresses connecting to your low-usage application because of statistics gathered for high-usage app.

 

Re: VIP-wide DOS profile. Do you really need one? Who is going to connect to your VIP if they don't have a valid hostname? If this VIP is only supposed to serve your 3 hostnames you might as well just drop all other traffic.