Forum Discussion
Bayan_El_Ameen1
Oct 04, 2011Nimbostratus
Redirection iRule on ASM Blocking
Hello,
I need an iRule to redirect to home page when the ASM blocks a request.
I know that this can be achieved by selecting a redirect url for the response page instead of using the default response page but I need something more general for I have multiple applications and I want to manage that in an iRule.
I have tried the following iRule but it's not working:
when ASM_REQUEST_BLOCKING {
HTTP::redirect https://[HTTP::host]/
}
Thanks,
Bayan El Ameen
- nitassEmployeethis is another way round.
- Jim_Sellers_106NimbostratusWhat version of ASM are you running ? I currently do this all the time with the URL redirect option in the blocking response tab under the policy option.
- Bayan_El_Ameen1NimbostratusI'm running 10.2
- John_Alam_45640Historic F5 AccountHTTP Redirect is a "server-side" command. At the REQUEST_BLOCKING stage, the request has not reached the server and therefore there is no server response and no "server-side" events.
- Bayan_El_Ameen1NimbostratusThanks for the clarification John. I think the HTTP_CLASS_SELECTED would solve this issue
- nitassEmployeethis is mine.
[root@tulip:Active] config b version|grep -iA 1 version BIG-IP Version 10.2.0 1707.0 Final Edition [root@tulip:Active] config b virtual bar list virtual bar { snat automap pool foo destination 172.28.17.66:http ip protocol tcp rules myrule httpclass asmclass profiles { http {} tcp {} } } [root@tulip:Active] config b profile asmclass list profile httpclass asmclass { defaults from httpclass asm enable } [root@tulip:Active] config b rule myrule list rule myrule { when ASM_REQUEST_BLOCKING { HTTP::redirect "http://www.google.com" } } [root@tulip:Active] config curl -i http://172.28.17.66 HTTP/1.0 302 Found Location: http://www.google.com Server: BigIP Connection: Keep-Alive Content-Length: 0 [root@tulip:Active] config cat /var/log/asm Oct 24 20:48:15 local/tulip err dcc[11586]: 01310033:3: [SECEV] Request blocked, violations: Attack signature detected. HTTP protocol compliance sub violations: N/A. Evasion techniques sub violations: N/A. Web services security sub violations: N/A. Support id: 9922188796739190794, source ip: 172.28.17.60, xff ip: N/A, source port: 49258, destination ip: 172.28.17.66, destination port: 80, HTTP classifier: asmclass, scheme HTTP, geographic location: , request:
- TortiAltostratusHi,
when ASM_REQUEST_BLOCKING { HTTP::redirect "http://www.google.com" }
- nitassEmployeeis this either relevant?
- TortiAltostratussol8240
- Torti, what is your TMOS version?
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects