Forum Discussion

Jesse_42915's avatar
Jesse_42915
Icon for Nimbostratus rankNimbostratus
Mar 07, 2012

Use one ASM policy for multiple classes?

I'm trying to find out if it's possible to use the same ASM policy on multiple classes and/or Virtual Servers.

 

 

Basically I've got multiple virtual servers that I want to have the same ASM policies applied, and be able to manage one policy for all of them, instead of one policy for each.

 

 

 

If that's not possible, is there a way to get the attack signatures copied over when I copy a policy? Right now when I copy a policy from one class to another it puts all the attack signatures back into staging. I'd like to be able to copy the policy and have all the attack signatures already be applied instead of in staging.

 

 

 

I'm running v 10.2.3

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Mar 07, 2012
    In 10.x, there is a mapping of HTTP class to one ASM web app to one active ASM policy. In 11.x they removed the concept of a webapp, so the mapping should be HTTP class to policy. Regardless, you can assign the same ASM policy to multiple virtual servers using the same HTTP class. If you want to use different HTTP class filters with the same ASM policy, you could use a single HTTP class and select it from an iRule using HTTP::class select class_name:

     

     

    https://devcentral.f5.com/wiki/iRules.http__class.ashx

     

     

    Aaron