Forum Discussion

Rene_Bader_1308's avatar
Rene_Bader_1308
Icon for Nimbostratus rankNimbostratus
Aug 05, 2014

URL parameter not working (ASM)

Hi all,   I'm new to the ASM and currently trying to protect an application that uses URL parameters in some requests.   I want the ASM to allow only named parameter values and configured th...
ASM Advanced WAF
security
  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Aug 06, 2014

    Check your policy blocking settings. As I always tell my students there are three things required for ASM to block.

     

    1. The policy must be in blocking mode.
    2. The entity must not be in staging.
    3. The blocking settings (learn, alarm and block) must have block ticked for that violation.

    There is a specific violation related to static parameter settings, it is easily missed.

     

Kevin_Davies_40's avatar
Kevin_Davies_40
Icon for Nacreous rankNacreous
Aug 06, 2014

Check your policy blocking settings. As I always tell my students there are three things required for ASM to block.

 

  1. The policy must be in blocking mode.
  2. The entity must not be in staging.
  3. The blocking settings (learn, alarm and block) must have block ticked for that violation.

There is a specific violation related to static parameter settings, it is easily missed.

 

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Aug 06, 2014
    Kevin - good clear advice on this one. try to follow these rules myself. Interesting "Illegal static parameter value" doesn't seem to be enabled for learn,alarm or block by default. At least not for my quick test on v11.4.1.