Forum Discussion
Some help with irule to unblock ASM for URIs and matching signature
Hello Team F5!
I wish to create irules to disable based on 3 matching conditions:
- client IP - x.x.x.x.
- URIs and paths:
/apis - for all URIs starting with /apis
/example/proxy.aspx – Exact path match till the end
/examplepath/version – Exact path match till the end
And to bypass ASM signature 200000152
We are thinking of using all these at once.
Right now we have something like this:
Rule-1
-------
when ASM_REQUEST_DONE {
if {[IP::addr [IP::client_addr] equals x.x.x.x] and [string tolower [HTTP::uri]] starts_with "/apis" and [ASM::violation details] contains "200000152"}
{
ASM::unblock
log local0. "ASM unblocking [HTTP::uri] and Source IP.x.x.x.x"
}
}
Rule-2
-------
when ASM_REQUEST_DONE {
if {[IP::addr [IP::client_addr] equals x.x.x.x] and [string tolower [HTTP::uri]] equals "/example/proxy.aspx" and [ASM::violation details] contains "200000152"}
{
ASM::unblock
log local0. "ASM unblocking [HTTP::uri] and Source IP.x.x.x.x"
}
}
Rule-3
-------
when ASM_REQUEST_DONE {
if {[IP::addr [IP::client_addr] equals x.x.x.x] and [string tolower [HTTP::uri]] equals "/examplepath/version" and [ASM::violation details] contains "200000152"}
{
ASM::unblock
log local0. "ASM unblocking [HTTP::uri] and Source IP.x.x.x.x"
}
}
- Ismael_Goncalves
Employee
davidfisher , your iRule logic seem to be fine, however, could you clarify more the reason why you want this? Is this due a false positive? I've seen similar scenarios where a parameter contained an XML data such as param=<?xml version="1.0"?>... causing some false positive. In that case, you could create a parameter of XML Value instead of 'User input' value. Also, if you don't care much about the source IP, you can disable the signatures at the URL level but then you disable for everybody. This would depend if it is satisfy your security requirements.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com