For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

hightower_m's avatar
hightower_m
Icon for Nimbostratus rankNimbostratus
Oct 05, 2016

Managing ASM policy after it's in blocking mode

So I'm fairly new to using ASM but have learned quite a bit. I need a little clarity on managing a policy in blocking mode. So my situation is that I have a policy (Real time builder enabled) that ...
application delivery
ASM Advanced WAF
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Oct 16, 2016

The answer to your questions is "yes". The benefit of the the Real Time/Automated builder constantly running is that it will Track the Site changes(provided this setting is on), so when your application changes the policy will learn the changes (makes sure you configure your Trusted IPs for that!). If your application is not changing (e.g. it is something like Web Outlook) then there is no need to learn - there will be nothing new.

 

Once you understand ASM good enough you will be able to build your policies manually and switch off the RealTraffic builder. As an ASM consultant I always build all policies manually.