Forum Discussion

KF2's avatar
KF2
Icon for Nimbostratus rankNimbostratus
Oct 26, 2022

Modified domain cookie

Receive some blocked event about "modified domain cookie". After some research , a cookie "TSxxxxxxxx" is generated by F5 ASM and it used to hash the enforce cookie. When user got blocked, I found ...
security
KF2's avatar
KF2
Icon for Nimbostratus rankNimbostratus

The user is not internal. 

"This is a tricky one as maybe the user is comming from a jump host or there is a proxy device before the F5 that does something" <--  You mean the proxy device will modify or delete the cookie?

All the links you posts i have already read before I post this question in this forum.

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Oct 26, 2022

I admit that are all my suggestions as if the F5 is sending the cookie what happens on the client device, I can't tell 🙂

 

My final suggestion could be to also use One Connect profile as it helps with cookies and upstream proxy devices but outside of that I am out of ideas.

 

https://support.f5.com/csp/article/K7964