How to tell ASM that a POST is valid?

The Expected Request Length value is the length of the entire request, headers, request line and POST data included. The POST data length is just the payload of the request, so it should be slightly smaller.

You basically have two choices: monitor the length of requests and risk that valid requests will be blocked if they are out of range, or stop qualifying requests on the basis of length, and risk buffer overflow attacks.

You can enable learning on the Illegal POST Data Length and Illegal Request Length violations, examine requests that trigger these violations and then decide if there really is a case for relaxing the length restrictions, but you might block valid requests as part of the learning process.

Hope that helps.