For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Seeker's avatar
Seeker
Icon for Nimbostratus rankNimbostratus
May 30, 2017

F5 ASM and Antivirus

Hi,   I have noticed that when ASM sends files for scanning by AV, it sends the full HTTP request, (copy of what is received from the user at F5 ASM in a post format). Is there a way to send ONLY ...
ASM Advanced WAF
security
Jad_Tabbara__J1's avatar
Jad_Tabbara__J1
Icon for Cirrostratus rankCirrostratus
May 30, 2017

Hello,

 

Have you associated following profiles to your VS (that applies the ASM profile) :

 

  • A "HTTP Profile"
  • A "Request Adapt Profile" // if your ICAP server need to inspect client request
  • A "Response Adapte Profile" // if your ICAP server need to inspect backend servers responses

You will also need to create a second VS (type "Internal") that will load balance traffic forwarded by the first VS to your ICAP servers. For this internal VS you will need to assign an "ICAP" profile.

 

Following KB gives details about the implementation of ICAP

 

https://support.f5.com/csp/article/K15819

 

Regards