For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dfigueroa's avatar
dfigueroa
Icon for Nimbostratus rankNimbostratus
Apr 28, 2017

Virtual Server requires a profile type web security

Recently upgraded from 11.5.1 to 12.1.2 and having issues with Outlook Anywhere. This is configured via an Exchange iAPP. When I try to reconfigure the iApp I get the following error:   "Virtual S...
application delivery
ASM Advanced WAF
LTM
security
web security
Leonardo_Souza's avatar
Leonardo_Souza
Icon for Cirrocumulus rankCirrocumulus
Apr 28, 2017

That profile is used for ASM. Probably the LTM policy referenced in the error has ASM enabled.

If you dont need ASM, remove the LTM policy if is only for ASM, or modify it to remove ASM. In your case, as you are using iApp, check if any of the questions in the iApp is to enable ASM.

If you need to use ASM, you need to add the profile to the virtual server. I don't think there is a way to do via GUI, so here is the tmsh command:

root@(LABBIGIP1)(cfg-sync Unknown)(Standby)(/Common)(tmos) list ltm virtual vs_http
ltm virtual vs_http {
    destination 10.0.0.100:http
    ip-protocol tcp
    mask 255.255.255.255
    pool pool_http
    profiles {
        http { }
        tcp { }
    }
    source 0.0.0.0/0
    translate-address enabled
    translate-port enabled
    vs-index 6
}
root@(LABBIGIP1)(cfg-sync Changes Pending)(Standby)(/Common)(tmos) modify ltm virtual vs_http profiles add { websecurity }
root@(LABBIGIP1)(cfg-sync Changes Pending)(Standby)(/Common)(tmos) list ltm virtual vs_http
ltm virtual vs_http {
    destination 10.0.0.100:http
    ip-protocol tcp
    mask 255.255.255.255
    pool pool_http
    profiles {
        http { }
        tcp { }
        websecurity { }
    }
    source 0.0.0.0/0
    translate-address enabled
    translate-port enabled
    vs-index 6
}
root@(LABBIGIP1)(cfg-sync Changes Pending)(Standby)(/Common)(tmos)

About the impact, that is only related with the virtual server (in this case iApp) that you are reconfiguring. Either reconfiguring the iApp or adding the profile, should be done take into account possible downtime to that service.