New BIG-IP ASM v13 Outlook Web Access (OWA) 2016 Ready Template

Thanks Udo for reaching out, usually the alert is raised only after upgrading/changing the policy but it should stop after existing sessions are expired.

See https://support.f5.com/csp/article/K20323120 for more information.

If you think that is still occurs and it is a false-positive, you can remove the block protection: Security ›› Application Security : Policy Building : Learning and Blocking Settings >> Cookies >> Modified ASM cookie

Hello, have tried the Tamplate correspond. At the beginning, the call of OWA was also, but now I get a blocking. "Modiefied domain cookie Cookie Name: Clientid Reason: New Cookie" Why?

Thanks for the update Mr. Gundemarie, the logs are related to signatures that was removed, so it safe to ignore the logs. I would suggest to take the latest template 6.1.6 that was updated recently.

I am using the template for v13.1. I updated the attack signatures as described in step 2, and this is the first line of the readme:

Update: v13.1.0/ASM-SignatureFile_20180925_171453:

Importing the policy (step 3) completes successfully, but gives me 64 lines of the following before the success message:

signature with id xxxxxxxxx (previously used in this security policy) does not exist on this system.

I searched for a few IDs via Security ›› Application Security : Attack Signatures and saw that none of them seem to have an entry. What effect, if any, does it have on the policy if the XML file refers to attack signatures that are not defined on the box?

And does that mean the XML file is outdated (and with it the policy) every time the signature file gets updated?

Hi Nir, thanks for the quick reply. Unfortunately I had no logging profiles bound currently. I've just changed it and I'm waiting for a few events to occur. I hope to send you the logs latest by tomorrow.

Thanks Amir for updating about the issue with active-sync, As far as I understand you are testing in clear environment? could you please export the illegal logs and send it to my email nashkenazi@ so I will take a look (via Events Logs -> Applications -> Request -> Select All -> Export) ?

Hi,

I've implemented a policy in transparent mode with this template, but I'm facing some issues during traffic learning:

a) ActiveSync triggers strange SQL-Injection Suggestions: SQL-INJ "' --" (SQL comment) (Parameter) (2)

Is there any suggestion how to handle these suggestions in a good and secure manner?

The template was tested on v13 so unfortunately there is no backward comparability guarantee

Hi

will this work with 12.1.2 ?

Yes, it a patched version that would finally will be updated into the device template repository. The template was tested on OW16K so there is no guaranty it would work as expected in OWA13K.