Forum Discussion

YoonJoo__Moon_1's avatar
YoonJoo__Moon_1
Icon for Nimbostratus rankNimbostratus
Feb 11, 2014

using websocket via ASM

Hi all.

I'm testing about ASM v11.4.1 and a website using websocket. I wonder ASM can support websocket.

In my test, LTM can support websocket but ASM can't support it. When apply ASM policy to VirtualServer, I can't show websocket part. So I made a iRule, that is below:

when CLIENT_ACCEPTED { 
             HTTP::enable
}
when HTTP_REQUEST { 
             if { ([string tolower [HTTP::header value Upgrade]] equals "websocket" ) && ([string tolower [HTTP::header value Connection]] equals "upgrade" ) } {  
                           log local0. "HTTP Disable"  
                ASM::disable 
             }
}

In this iRule, when websocket traffic is come, it disable ASM and pass to LTM. But it means, if some web attacks are come through websocket, ASM can't block attacks.

In addition, if i change iRule from ASM::disable to HTTP::disable, page loading is slowed.

Does any solution using with ASM and websocket?

application delivery
deployment
design
devops
iRules
TMOS
websocket
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Feb 11, 2014

    But it means, if some web attacks are come through websocket, ASM can't block attacks.

     

    as you know, currently it is not supported. i do not hear any plan.

     

    In addition, if i change iRule from ASM::disable to HTTP::disable, page loading is slowed.

     

    have you run tcpdump to see where the slow comes from?

     

    • YoonJoo__Moon_1's avatar
      YoonJoo__Moon_1
      Icon for Nimbostratus rankNimbostratus
      Feb 11, 2014
      have you run tcpdump to see where the slow comes from? --> Yes. I captured it. In Wireshark, filtering "websocket", i can't find when using HTTP::disable, but others can find "websocket"
  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    Feb 11, 2014

    But it means, if some web attacks are come through websocket, ASM can't block attacks.

     

    as you know, currently it is not supported. i do not hear any plan.

     

    In addition, if i change iRule from ASM::disable to HTTP::disable, page loading is slowed.

     

    have you run tcpdump to see where the slow comes from?

     

    • YoonJoo__Moon_1's avatar
      YoonJoo__Moon_1
      Icon for Nimbostratus rankNimbostratus
      Feb 11, 2014
      have you run tcpdump to see where the slow comes from? --> Yes. I captured it. In Wireshark, filtering "websocket", i can't find when using HTTP::disable, but others can find "websocket"
  • J_Castro's avatar
    J_Castro
    Icon for Nimbostratus rankNimbostratus
    Mar 05, 2015

    Hi everyone.

     

    I have the same problem running 11.5.1. I've opened a support ticket and they confirmed that ASM currently does not support web socket streams and there is not an ETA to fix this issue.

     

    But, How can we deal with this in the most secure way? Anyone has heard about a workaround for this? I'm not a web developer but if this is a common behavior for websites behind a security device, it must be an option, from the developer perspective, to fulfill the operation of the websites without using websockets, just wondering.

     

  • Jorjjj's avatar
    Jorjjj
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2015

    Hello There,

     

    Have you find any solution for this?

     

    I am facing the same Issue!

     

    Web Socket application works well over LTM, but does not work when ASM Security Policy is assigned on the virtual Server

     

    Thanks Regards,

     

    Georges

     

  • philyeo_72087's avatar
    philyeo_72087
    Icon for Nimbostratus rankNimbostratus
    Jun 14, 2016

    I have the same issue. Can anyone get it working? Even if the ASM only works for the non-websocket part would be good? That way it could still inspect GET/POST