For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

thekoreanguy's avatar
thekoreanguy
Icon for Altostratus rankAltostratus
Sep 13, 2024

Question about WAF Enforced with has suggestion Signature

Hello, everyone

I have a question about the WAF signature.

 

Recently, I blocked the Ready to be enforced signatures.

 

A few days later, Some of these signatures are in an enforced state, and they have entered a has-suggestion state.(About 30 of them)

What is the state of being in an enforced state and at the same time has suggestion?

 

And some of the enforced&has-suggestion signatures are unblocked and there are also staged logs.

It's in enforced mode, is this a possible situation?

 

F5 WAF engineer with similar experience, please help me.

Thank you very much.

security
signature
waf

1 Reply

  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Icon for MVP rankMVP
    Sep 13, 2024

    Hi, 
    Make sure that your policy in blocking mode. 
    make sure that you haven't allowed these signatures under specific URLs for examples.

    Make sure inside this policy that these signatures are enforced,
    Note that ( you should still receive suggestions as long as learning is enabled even if your AWAF blocks those requests.

    ensure that you enable block check box under attack signature settings inside policy learning and blocking settings : 

    other than that, your policy should block any matched signature