Forum Discussion

Mohanad's avatar
Mohanad
Icon for Cirrostratus rankCirrostratus
Dec 27, 2021

How to implement Device ID+ with BIG-IP ASM/AWAF

Hello Everyone,

 

I'm trying to test out Device ID+ with BIG-IP AWAF, I followed this: Click here for more information on comprehensive BIG-IP iApp deployment and configuration options.

 

i configured all required firewall rules to allow BIG-IP to connect to (us.gimp.zeronaught.com)

 

Note: i have ASM/AWAF lic only

 

 

 

 

I tired to access the website many times to check if the BIGIP will inject the JS and get the Device ID, before i allow the BIGIP to connect to (us.gimp.zeronaught.com) the script was failing, now status code is 200

 

 

 

 

This is ASM event log

 

 

 

Still Device ID field is N/A, Device ID+ configuration should reflect to Device ID field??

 

 

Anyone can help what's wrong?

I tired Online verification tool from F5

 

Thanks,

Mohanad

BIG-IP
F5 Device ID+
security
  • Mohanad's avatar
    Mohanad
    Icon for Cirrostratus rankCirrostratus
    Dec 29, 2021

    i'm able to log diA & diB using irule provided by Anulfo Hernandez

     

    when HTTP_REQUEST {
    if [HTTP::cookie exists _imp_apg_r_] {
        set deviceid [URI::decode [HTTP::cookie _imp_apg_r_]]
        log local0. "URL Decoded cookie is $deviceid"
        set deviceida [lindex [regexp -inline -- (?:"diA":")(.*?)(?:") $deviceid] 1]
        log local0. "diA = $deviceida"
        set deviceidb [lindex [regexp -inline -- (?:"diB":")(.*?)(?:") $deviceid] 1]
        log local0. "diB = $deviceidb"
        log local0. "IP is [IP::client_addr]"
        log local0. "Path os [HTTP::path]"
    } else {
    log local0. "No cookie"
    }
}

    now i want to use it with bot defense how to match on diA?

     when BOTDEFENSE_ACTION {
     if {[$diA equals {"[AYrQyWEAAAAACxF5RBPJyPdDICteKxbw"}]} {
         set res [BOTDEFENSE::action block]
		 log local0. "Mohanad is Blocked"
     }
 }

     

    • Daniel_Wolf's avatar
      Daniel_Wolf
      Icon for MVP rankMVP
      Dec 30, 2021

      How do you want to identify a bot by only looking at diA? You would need to have a list of known good identifiers (maybe all devices belonging to your company?) and then make an iRule action based on this list.

      Or you could store Device ID+ identifiers and build a custom solution that would, for example, rate limit this device, or block the device if it appears from different geolocations within unreasonable time (now in USA, 10 seconds later in Sweden or so).

       

      What I want to say is, that the device identifier from DID+ does not mean anything to Bot Defense. You will have to build a custom solution and "business logic" around it.

      • Daniel_Wolf's avatar
        Daniel_Wolf
        Icon for MVP rankMVP
        Jan 03, 2022

        You can follow along this video of Matthieu Dierick from F5:

        https://www.youtube.com/watch?v=PVYwh76nGVE&t=10s

        In his Github Repo (https://github.com/MattDierick/DeviceID-api-server) you can take a closer look at his solution.

        However he is using APM, not AdvWAF.

         

        He build an API to store information about the user and the diA and diB. You can either use his API or build a similiar one with https://loopback.io/.

        The big missing piece is how to store the diA and diB in this API with AdvWAF instead of APM. Be creative :)

         

         

    • Mohanad's avatar
      Mohanad
      Icon for Cirrostratus rankCirrostratus
      Dec 29, 2021

      Hello Daniel,

       

      Thank for your reply, i read your explanation while im learning about Device ID+ and it's really good...

       

      what i need for next step, to match this data diA & diB and do something with it, i want to use it for brute force protection, Bot defense Dos etc.. but i will keep search