# Can Irule forward request after ASM block?

**URL:** <https://community.f5.com/t/can-irule-forward-request-after-asm-block/58496>\
**Category:** Technical Forums\
**Tags:** irules, asm-advanced-waf, security\
**Created:** [September 9, 2020, 12:41pm UTC](https://community.f5.com/t/can-irule-forward-request-after-asm-block/58496 "2020-09-09T12:41:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_Knapp](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@Steve\_Knapp](https://community.f5.com/u/Steve_Knapp)\
**Post date:** [September 9, 2020, 12:41pm UTC](https://community.f5.com/t/can-irule-forward-request-after-asm-block/58496/1 "2020-09-09T12:41:14Z")

</div>

Below is a snippet from an inquiry I received from our web developers. Matching on part of the URI is no problem, but what about forwarding the request even after blocked by the ASM?

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

So the iRule would have to match on:

- Portions of the URI that indicate this is an FNOL
- That the ASM blocked the request

Then:

- Forward the buffered request to a specific URL

Assumptions:

- The iRule can buffer the request so it persists beyond the ASM block.&nbsp;This alone may be the show-stopper as this may be a significant performance problem.
- The iRule can send to a different location than just allowing to pass to the back end pool members

---

<div class="post-metadata">

**Author:** ![Andrew-F5](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@Andrew-F5](https://community.f5.com/u/Andrew-F5)\
**Post date:** [September 11, 2020, 3:38pm UTC](https://community.f5.com/t/can-irule-forward-request-after-asm-block/58496/2 "2020-09-11T15:38:50Z")

</div>

“The iRule can buffer the request so it persists beyond the ASM block. This alone may be the show-stopper as this may be a significant performance problem.”

◘ I’m not entirely sure what you mean by this?

“The iRule can send to a different location than just allowing to pass to the back end pool members”

◘ You can use a ‘forward’ command, redirect, etc, after the ‘ASM::unblock’ statement.

```tcl
when ASM_REQUEST_DONE {
    #log local0.debug "\[ASM::status\] = [ASM::status]"
    if { [ASM::status] equals "blocked" } {
            ASM::unblock
            log local0. "Unblocked request with ID [ASM::support_id]"
            }
}

```

References:

> **[ASM::status](https://clouddocs.f5.com/api/irules/ASM__status.html)**

> **[ASM::unblock](https://clouddocs.f5.com/api/irules/ASM__unblock.html)**

---

<div class="post-metadata">

**Author:** ![Steve\_Knapp](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@Steve\_Knapp](https://community.f5.com/u/Steve_Knapp)\
**Post date:** [September 11, 2020, 5:36pm UTC](https://community.f5.com/t/can-irule-forward-request-after-asm-block/58496/3 "2020-09-11T17:36:58Z")

</div>

Thanks. Great info!