I would try to verify in first place, whether this message is sent by the BIG-IP at all. I would be highly surprised. My approach to analyse this issue would be to access the application: a) direct, bypassing the BIG-IP b) via BIG-IP without ANY ASM features assigned to the VS c) via BIG-IP with ASM features enabled Use Developer Tools in Browser for a, b and c. Compare. Look for error messages, 404, etc. Use tcpdump on F5 for b and c. Use the p flag to capture client- and server-side. Compare.