Forum Discussion

Indeed's avatar
Indeed
Icon for Nimbostratus rankNimbostratus
Jun 27, 2021

F5 WAF use case for internal network

Hi

I’m using F5 products for couple of years, and always use F5 WAF for external users (Untrust zone)

 

now try to enable it for internal users to protect a web server (confluence (tomcat)).

 

after I enable F5 WAF we have lot performance and functional issue on Confluence,

 

FYI 1: F5 work on learning mode not blocking mode.

 

now one question come to my mind, is it logical to use F5 WAF protection for this web server?

FYI 2: this server has no internet connection. Not published on internet. Only internal users in LAN able to access this server.

 

FYI 3: I see lot’s of people have issue with confluence and F5.

 

 

Any idea?

Thanks

ASM Advanced WAF
confluence
devops
waf
  • Nikoolayy1's avatar
    Nikoolayy1
    Icon for MVP rankMVP
    Jun 27, 2021

    You mean that F5 ASM policy is in transperant mode and you still get performance and functional issues?

     

     

    Have you checked the F5 ASM CPU and Memory as the learning mode may cause high cpu if there is a lot to learn and I see that the confluence causes a lot of false postives (you may also upload a qkview to ihealth and check the CPU and memory and found bugsfor the ASM from the security tab in ihealth):

     

    https://support.f5.com/csp/article/K47045262

     

    https://support.f5.com/csp/article/K58571155

     

     

     

    Also do you add a lot of files on the Confluence as you may need to read:

     

     

    https://support.f5.com/csp/article/K01235989