How to start with F5 BIG-IP ASM quickly?

when you what you described then you will see all the events the ASM has logged. for those events you then see the status in the status column. an event can have more then one status.

• Legal Request - a request the ASM decided is legal, so no issues with the request based on the policy you use.
• Illegal Request - a request the ASM decided is illegal, so issues with the request based on the policy you use, but not blocking, perhaps due to staging or other setting, see explanation of G. Scott Harris above.
• Blocked Request - a request the ASM decided to block, so issues with the request based on the policy you use.
• Truncated Request - a request which can be legal, illegal, blocked, unblocked but which was too long to fully log in the ASM
• Unblocked Request - a request which was unblocked after being blocked, this is new functionality search for the documentation for more info.

this screen tells you nothing about how to further act on these request, there are no hints on how to make things better / more secure. this is just a log of what the ASM has done on requests it has seen so far.

Thank Boneyard for detailed explanation and get me in the right track :)

Now my question is, Blocked request means blocked or it is just suggestion. (When Policy is in Block mode and Signature staging is disabled)

Second point: When Policy is in Block mode and Signature staging is enabled, then any Blocked request will come or not.

Kindly someone help me in this regard. I am too confused in events log. If someone understand my question then please help in this regard.

Policy = Blocking Mode Signature Staging = Disabled Then How we treat the Status from the event logs.

Thanks for the time. For your kind information I have studied five times the John chapters 1 -10 and its manual with LTM and other configuration also. I am in a production environment that's why asking the questions. I am only stuck in the events appear as logs. But your answers confuse me. Blocked request and Illegal request are two different status. In the above you mentioned that If signature is in staging state it will not block any request so it will not come in event logs. But Illegal request and truncated request messages can be seen even signature are in staging state.

I am very much clear that Policy in Blocking state and Signature staging must be disabled to block the requests implemented in the policy.

But your answers confuse me.

well your questions confuse me 🙂

But Illegal request and truncated request messages can be seen even signature are in staging state.

i don't believe this to be the case. if one signature is in staging then there will be NO events in the event log caused by that signature.

and even if it was the case (dont have the time to fully test this now), what does it matter exactly? truncated is just some information about the request being too large to fully log. illegal means the request isn't ok but won't be blocked due to the policy setting. what exactly do you want to know?

Illegal Request: It means policy violation. Will it effect the server or application ? Or we need to block it as per our need.

It has also two types depend on rating

1. False positive (Rating 1 or 2)
2. Critical (Rating 4 or 5)

Signature is in staging state and still generating the events.

ok, did my tests, used signature: Automated client access "curl" 200021075 

policy: Blocking
general attack signature setting: [x] Learn [x] Alarm [x] Block 
specific signature setting: Automated client access "curl" 200021075 [ ] Staging - so not staging

get a blocked event in Security  ››  Event Logs : Application : Requests

policy: Blocking
general attack signature setting: [x] Learn [x] Alarm [x] Block 
specific signature setting: Automated client access "curl" 200021075 [x] Staging

get no event in Security  ››  Event Logs : Application : Requests

policy: Blocking
general attack signature setting: [x] Learn [x] Alarm [ ] Block 
specific signature setting: Automated client access "curl" 200021075 [ ] Staging - so not staging

get an illegal event in Security  ››  Event Logs : Application : Requests

policy: Blocking
general attack signature setting: [x] Learn [x] Alarm [ ] Block 
specific signature setting: Automated client access "curl" 200021075 [x] Staging

get no event in Security  ››  Event Logs : Application : Requests

MSZ, would it be possible for you to provide which signature, show the signature setting, show your general attack signature blocking settings? in my opinion you either run into a bug or there is a configuration issue somewhere. you have applied the policy after making changes right?

Thanks for the all the people. Nathan has answered me on the different plat form that I am getting the RFC violations in events logs. I was confused b/w the RFC violation settings and signature settings. Both have impact on the policy configured on ASM.