For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nclarke's avatar
nclarke
Icon for Nimbostratus rankNimbostratus
Jan 25, 2024

Help excluding URLs from HTTP Protocol violations in ASM

I am having a problem where a network health ping /checkhealth is hitting several sites multiple times a second creating 100,000s of events a week.  It is getting blocked because it has an IP address...
security
Mohamed_Salah_'s avatar
Mohamed_Salah_
Icon for MVP rankMVP
Jan 25, 2024

Hello,

 

I'm not getting exactly your requets, but from my understanding there is kind of health check from several IPs towards the F5 VIP, and the policy assigned to this VIP is blocking those health check requests because of the host header contains an IP address, am I right?

 

if yes, you can check those options.

  1. You can add a white list that contains a list of IPs using IP address exception, and select "never Block this IP Address".
  2. Disable ASM when matching with data group that contain list of IPs

https://clouddocs.f5.com/api/irules/ASM__disable.html

 

Thanks, 

Mohamed Salah

nclarke's avatar
nclarke
Icon for Nimbostratus rankNimbostratus
Apr 03, 2024

Hello, sorry for the late reply (I guess my email alerts are disabled haha). There is a very wide range of IP addresses from the external network health checks. So there is no easy way to create a IP whitelist. The only thing similar is the /healthcheck123 URI, but there doesn't seem to be an easy way to just ignore that URL. Any ideas are appreciated.