For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

muhammad_Tanvir's avatar
muhammad_Tanvir
Icon for Nimbostratus rankNimbostratus
Sep 03, 2021

White listing URLs in Security Policy in F5

Hi   I have created a security policy whose Enforcement Mode is transparent. In the event log I can see a lot of URLs which I can click and accept. How do I whitelist a URL like https:/abcd.com/...
BIG-IP
security
Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Sep 03, 2021

Hi Tanvir,

 

depending on which template you used for your Security Policy the * (wildcard) should be there by default.

Go and see here: Security ›› Application Security : URLs : Allowed URLs : Allowed HTTP URLs

There you should see entities for HTTPS * and HTTP *.

 

And, again depending on which template you choose, the policy will or will not learn New URLs as entities.

See here: K15530590: Overview of BIG-IP ASM security policy templates

"Learn New HTTP URLs: Never" means your policy will not offer new learning suggestions for URLs.

Did you maybe change the learning setting for New HTTP URLs from Never to something else in the Learning and Blocking Settings for your policy?

 

KR

Daniel