For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Torti_93733's avatar
Torti_93733
Icon for Nimbostratus rankNimbostratus
Dec 16, 2013

how can your tomcat crash by requests with an IP outside the US, if you block all traffic from ouside the US? It should be blocked by the ASM.

 

Comment: Are you sure, that all your business partner use server in the US?

 

greetings from germany ;-)

 

  • Dianna_129659's avatar
    Dianna_129659
    Icon for Nimbostratus rankNimbostratus
    Dec 16, 2013
    Hi Torti. Thank you for your greeting from Germany. Yes, all of our trading partners are located in and use servers in the US. We are unable to ship huge products outside of US. I ask the same question you did - how could this happen when we are blocking? I wondered if I was missing something. When I look at the HTTP Request details, it appears that the user was trying to inject script into forms on out site. Yes, they were blocked, but our site actually went down at that time, so it seems that the the attack caused the site to go down. So, we stopped and restarted TomCat, and the problem was resolved. Maybe there is no connection, but it seems quite possible.
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Dec 17, 2013
    you say: "Yes, they were blocked, but our site actually went down at that time, so it seems that the the attack caused the site to go down." i would focus on that, is there any logging on the tomcat that shows which IPs reached it?