How to increase the size of upload file size in ASM

Forums Technical Forums
, ,
1

Hello Experts

How to increase the upload file size in ASM? I am using 11.2.1

2

via system variable “long_request_buffer_size” untill 20MB

3

via system variable “long_request_buffer_size” untill 20MB

4

Thank you but it will be for global level. If I would like to set the upload limit size only for one ASM policy. How could I do that?

5

Thank you but it will be for global level. If I would like to set the upload limit size only for one ASM policy. How could I do that?

6

You can apply the following iRule to your virtual server: The “/upload” is in the path of the file you are uploading. Note that ASM is disable when uploading and malicious files could be uploaded in this particular location without detection…

++++++++++++++++ when HTTP_REQUEST { if {[HTTP::uri] contains “/upload” } { ASM::disable log local0. “ASM disabled.” } else { ASM::enable /Common/ log local0. “ASM enabled. Current ASM policy is [ASM::policy]” } } +++++++++++++++++++

7

try it with the post data length of file types and the maximum length of the parameter

8

try it with the post data length of file types and the maximum length of the parameter

9

hello Pascal. Thanks. But we are disabling the ASM altogether. There is no way we can restrict the size of upload file for only one policy?

10

Hi Torti. Could you please explain in detail. Appreciated !

11

Hi Torti. Could you please explain in detail. Appreciated !

12

All solutions I have seen so far will either increase the upload limit globally, or disable ASM for a specific URI as shown in the irule. The iRule can be enhanced to do other checks, like only disabling ASM for some trusted IP addresses,..etc.

13

can you explain, what you have for a problem with your app? do you get an error message?

14

can you explain, what you have for a problem with your app? do you get an error message?

15

Thanks Pascal. Can you give me that IRULE to disable ASM for trusted IP. Appreciated

16

+++ Following is A simple iRule that will disable ASM for a subset of IP addresses++++ +++ You need to create a data group that contains the list of allowed IP addresses++++

+++++++++++

ltm rule /Common/disable-asm-for-ip {

when HTTP_REQUEST {

if {( [class match [IP::client_addr] equals my-IP-list-data-group] ) } {

ASM::disable
log local0. "ASM disabled for [IP::client_addr]."
}

else { ASM::enable “/Common/jt-vs”

log local0. "ASM enabled. Current ASM policy is [ASM::policy]"

}

}

}

++++

++++Sample data group with a list of IP addresses++++

ltm data-group internal /Common/my-IP-list-data-group {

records {
    10.12.0.32/32 { }
    10.12.0.33/32 { }
    10.12.0.34/32 { }
}
type ip

}

++++++

17

Above irule will once again disable ASM altogether for a give IP. if you know the URI for file upload (Depending on the application), you can combine the first and second iRule with (AND), that would be more effective and more secure. The users with certain IPs will have ASM disabled only when they are trying to upload…