Forum Discussion

SSHSSH_97332's avatar
SSHSSH_97332
Icon for Nimbostratus rankNimbostratus
Mar 02, 2012

Staging Question

Q1 : Tightening Works fro Wildcard while Staging works for Wildcard & Explicit , is this the difference , so why do we have 2 naming , we could have said Staging which works for both ?

 

 

Q2: For signature staging , i understood that during staging period ( let's say 7 days ) requests that triggers new signatures will be logged under Traffic learning sothat admin can determine to enforce it or not ........... also there is an option to enforce all signature that didnot trigger during staging period ( Manually ) , so the question is : after the 7 days period i will need to manually enforce signatures that were at staging but was not triggered , what if i didnot do that and just waited for 3 weeks for example will the logs for them still comes under traffic learning ? if yes so what is the meaning of the 7 days ( as i expected that after 7 days signatures are automatically enforced ) ?

 

 

 

 

 

 

 

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Mar 05, 2012
    Hi SSHSSH,

     

     

    Tightening allows you to make the policy for wildcards more specific. Staging allows you to put a change in transparent mode (not block on it).

     

     

    After the staging period expires, you'll be prompted to accept changes which didn't have any positives. Nothing happens automatically to the policy that is enforced after the staging period expires.

     

     

    Aaron
  • SSHSSH_97332's avatar
    SSHSSH_97332
    Icon for Nimbostratus rankNimbostratus
    Mar 09, 2012
    So , i will be prompted to accept changes after the Staging Period expires or during & after the staging period ?

     

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Mar 09, 2012
    SSHSSH

     

     

    You'll only see the option AFTER the staging period. As you say above, you'll be able to specifically enable all those signatures in staging that weren't triggered, and underneath you'll see the signatures that were triggered for you to view for false positives and enable / disable accordingly. This option isn't available until the Staging period is finished.

     

     

    If you do wait 3 weeks then the signatures in staging are kept in non-block mode all that time - but the staging stats don't change to reflect any new hits (or at least I don't recall if they do!).

     

     

    Rgds

     

    N