For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

eLeCtRoN's avatar
eLeCtRoN
Icon for Cirrus rankCirrus
Mar 28, 2017

F5 ASM Filter/Block Parameter without blocking page

Hello,   we want to config that the F5 ASM Policy block some paramters but the F5 shoult not display a blocking page because if we block at this way our web application goes out of pass an the ses...
application delivery
ASM Advanced WAF
security
WebSafe
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Mar 28, 2017

This is tricky and depends on your application. The whole idea of a blocking page is that ASM is letting know the genuine users that their request is illegal. If the user is an attacker then there is no point in helping that user any further. However it is also possible that the block was a false positive. A properly tuned ASM policy should minimize false positives.

 

The question is: if ASM Blocking page is causing your application to lose forms data then what kind of response will not do that? If you know the answer then you can create an iRule to tackle that situation and intercept the blocking page, drop the request or unblock the request (depending on your requirements)

 

Check out:

 

https://devcentral.f5.com/wiki/irules.asm__unblock.ashx