Forum Discussion
NimbostratusTransparent and Blocking mode in the same ASM Policy?
Hi all,
My scenario is one ASM Policy (ASM-1) applied to one Virtual Server (VS-1). On the other side, I have a Local Traffic Policy which enables ASM-1 when the url starts with /application1 or /application2, otherwise disables asm. ASM-1 iw working in Blocking Mode.
It would be possible to add a new application (starting with /application3), which is in VS-1, but working in Transparent Mode? In my actual scenario, changing the policy ASM-1 to Blocking Mode would affect application1 and application2.
Thanks in advance.
4 Replies
Yann_DesmarestCirrus
Hi,
You can assign multiple ASM policies on the same VS by using Local Traffic Policies.
Just pay attention to the strategy adopted : best-match, all-match, first-match
If you have to protect /application1 and /application1/test using 2 different ASM policies, you need to define 2 rules. In this case, the first rule must assign the ASM policy for /application1/test and first-match strategy should be adopted.
Albert_252822Hi Yann, this was my first idea, but in each rule I define a different ASM Policy (one Transparent and the other one in Blocking Mode) and ASM only allows to have one active policy for each Virtual Server. Having an ASM Policy without a VS associated, it won't work because of next: "A security policy not associated with a virtual server is unusable because no traffic will go through this security policy, and therefore it is meaningless to run the Policy Builder on this type of security policy."
Yann_Desmarest_Nacreous
Hi,
You can assign multiple ASM policies on the same VS by using Local Traffic Policies.
Just pay attention to the strategy adopted : best-match, all-match, first-match
If you have to protect /application1 and /application1/test using 2 different ASM policies, you need to define 2 rules. In this case, the first rule must assign the ASM policy for /application1/test and first-match strategy should be adopted.
- Albert_252822Hi Yann, this was my first idea, but in each rule I define a different ASM Policy (one Transparent and the other one in Blocking Mode) and ASM only allows to have one active policy for each Virtual Server. Having an ASM Policy without a VS associated, it won't work because of next: "A security policy not associated with a virtual server is unusable because no traffic will go through this security policy, and therefore it is meaningless to run the Policy Builder on this type of security policy."
