For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

omar_padilla's avatar
omar_padilla
Icon for Altocumulus rankAltocumulus
Jan 22, 2020

help custom policy brute force attack asm!!

hello I have problems thinking about how to make a restriction for the search of a value, in a form I have a field called account number and a search button, you want to limit that search to only 3 a...
application delivery
ASM Advanced WAF
LTM
security
Dario_Garrido's avatar
Dario_Garrido
Icon for Noctilucent rankNoctilucent
Jan 22, 2020

Hello Omar.

 

You need to configure Brute Force Protection.

Depends on your release, you have this:

 

Another example of configuration

REF - https://clouddocs.f5.com/training/community/waf/html/class8/module2/lab2.html

 

In your approach, I would use "email" field as username and "account" as password (check your html tags)

Use the access validation to let the application knows when someone introduce one field just for testing (maybe one specific field in the server response).

 

Let me know if it helps.

 

KR,

Dario.