newbie case sensitive question

Greg,

 

 

it is perfectly fine to use BIG-IP for this purpose. I'm just not sure how your filtering criteria can distinguish an "authorized" script from a "forgotten/test/default simply un-authorized" one. What if the name of the "unauthorized" script is less than 30 characters, ends in ".asp" and contains only alphanumeric characters? I'd guess that most default or test scripts meet this criteria. Of course if you have a scrict (and enforced) policy that test scripts must not be named this way in place, then you are safe ... well and the filtering on the BIG-IP is not necessary. If you have a strict policy in place, it would be better to modify it and require that test scripts are put in a separate subtree. If you don't have any (enforced) policy in place and developers have access to the production server, then no amount of filtering on the BIG-IP is going to achieve the level of control you need.

 

 

Probably the best solution to your problem is to have separate development and production servers or at least a separate subtree for development at the production server. Access to objects on the development server or within the development subtree of the production server can be then easily controlled at the BIG-IP.

 

 

You may also be interested in our TrafficShield product Click here, which allows to control access to web applications with very fine grained granularity and it also allows to build the policy interactively based on observing behavior of applications.