Forum Discussion
NimbostratusPolicy buiding for multiple VS's
Hi All,
I created a security policy to be automatically built with enforcement readiness period 7 days. I applied the policy to a VS. The policy is still building.
My question is that after the policy is built and starts blocking for the VS, later if I apply the same policy to a second different VS, will the learning/staging process start again for the new VS ? or will it just start blocking without the learning for the new VS?
In my situation, the first VS could be a test site and the second VS be the production site of same application, also could be the second VS is a completely different application. Would that make any difference.
Thank you in advance.
Frank
2 Replies
Erik_NovakEmployee
The blocking action will only occur on those violations which are enforced after the enforcement readiness period expires. Think attack signatures, and any specific entity learning (parameters, file types, etc.) for which learning is enabled. During the enforcement readiness period, attack signatures are in staging. They won't be enforced until the period expires and no violations have been seen. Those violations are related to the application. If you export that policy to a new virtual server, but the application is different, then all of the learning done by that policy is meaningless because the app is different. In the case of a new/different application, start with a new policy. If the app is the same, then the policy would pick up where it left off in terms of learning. But do not forget that the automatic policy is in blocking mode by default. This means that enforcement of attack signatures and/or other entities can result in false positives if anything changes on the application. Make sense?
- Erik_Novak
Yes. The policy rules still apply. The only danger is that the app has changed in the interim, or there are other settings (profiles, iRules, etc.) on the new VS which would make the interaction between clients and the VS different. What you are describing however is actually a recommended approach to automatic policy building: Start with safe traffic, from a trusted IP address--meaning a source that you know, which does not and will not send bad traffic. If ASM builds the policy using known, good traffic, and you know the application is stable, then that "good" policy can be placed into production.
