Local Traffic Policy rule or irule to bypass the BIG-IP ASM

Forums Technical Forums
, ,
1

Hi ,

I need to bypass ASM for specific url request . Can any one help for this. LTM rule or irule can be feasible.

Example url for asm bypass: /fed/uat/pm.

I have referred KB22021244, But i am unable to create a ltm rule or irule for desired requirement.

Regards

Christy Thomas

2

Hi,

you can choose what ever suits your case. I did it this way:
LTM Policy for activating ASM. This policy is on every virtual server with one rule 
“Activate ASM” but with two other conditions

IF NOT HOST XYZ.com 
or
IF NOT URI Full String /abc/123.html

3

Hi,

Can you share a sample LTM rule or irule for the above requirement.

4

You can go by this:

image_340146.png
image_340146.png1455×379 16.3 KB

So first I select every Host that does not need ASM and any other Host gets ASM enabled. 
But you can do something like this also:

image_340146.png

And for those two conditions I have selected “skip this condition if its missing from request”

5

Hi,

Thank you ,

I have created the LTM rule that you have shared. and also i have created a iRule also: The irule worked.

Is there any possibility of fine-tuning the following iRule with a header name condition in addition to the URL? Can you help me with this?

when HTTP_REQUEST {

if {[HTTP::uri] contains “/sxx/xxx/cron”} {

ASM::disable

log local0. “ASM disabled”

} else {

ASM::enable /Common/SEC_Policy

log local0. " ASM ENABLED. Current ASM policy is [ASM::policy]"

}

}

6

Sure can you fine-tune this with more conditions. Header Based would look like this:

when HTTP_REQUEST {
if {[HTTP::uri] contains "/sxx/xxx/cron" OR [HTTP::header exists "DISABLE_ASM"]  } {
ASM::disable [...]