Forum Discussion

Cirrus

Mar 04, 2025

Solved

Local Traffic Policy rule or irule to bypass the BIG-IP ASM

Hi , I need to bypass ASM for specific url request . Can any one help for this. LTM rule or irule can be feasible. Example url for asm bypass: /fed/uat/pm. I have referred KB22021244, But i...

application delivery

devops

security

P_Kueppers
Mar 05, 2025
You can go by this:

So first I select every Host that does not need ASM and any other Host gets ASM enabled.
But you can do something like this also:

And for those two conditions I have selected "skip this condition if its missing from request"

P_Kueppers

MVP

Mar 04, 2025

Hi,

you can choose what ever suits your case. I did it this way:
LTM Policy for activating ASM. This policy is on every virtual server with one rule
"Activate ASM" but with two other conditions

IF NOT HOST XYZ.com
or
IF NOT URI Full String /abc/123.html

CHRISTY_THOMAS
Cirrus
Mar 05, 2025
Hi,
Can you share a sample LTM rule or irule for the above requirement.
- P_Kueppers
  MVP
  Mar 05, 2025
  You can go by this:
  
  So first I select every Host that does not need ASM and any other Host gets ASM enabled.
  But you can do something like this also:
  
  And for those two conditions I have selected "skip this condition if its missing from request"
  - CHRISTY_THOMAS
    Cirrus
    Mar 10, 2025
    Hi,
    Thank you ,
    I have created the LTM rule that you have shared. and also i have created a iRule also: The irule worked.
    Is there any possibility of fine-tuning the following iRule with a header name condition in addition to the URL? Can you help me with this?
    
    when HTTP_REQUEST {
    if {[HTTP::uri] contains "/sxx/xxx/cron"} {
    ASM::disable
    log local0. "ASM disabled"
    } else {
    ASM::enable /Common/SEC_Policy
    log local0. " ASM ENABLED. Current ASM policy is [ASM::policy]"
    }
    }