AWAF with customized virtual port

[Sushant]

BIG IP F5 is not learning anything once I start to use customized port. This is mainly for API traffic where source come through site to site vpn querying the api having customized port. My API virtual server will be listening to customized port like 8888. LTM is working but not in the context of using HTTP profile which is required for AWAF to work as far as my knowledge is concerned.

[ragunath154]

Http Profile is must to attach waf profile to virtual server.

without http profile LTM wont have L7 visibility.

http profile will work with any custom port unless its http protocol.

[Sushant]

Hello ragunath,

Yes, http is a must attach inorder for L7 inspection to happen but once i place my virtual server with HTTP profile , it doesnt work at all .

[Daniel_Wolf]

Hi ,

as mentioned above, a HTTP profile is required. You could check how the learning settings are configured in your policy. What entities are learned (URL, file type, cookies, parameters) and also check the setting for Policy Building Learning Mode.

Next take a look at K15530590, it will explain to you which type of Security Policy templates exist and what entities are learned by default and at which level of granularity the AdvWAF will learn them.

Additionally read the manual about learning: BIG-IP Application Security Manager: Implementations Refining Security Policies with Learning.

For me it is a good comparison to have "Log all requests" enabled while troubleshooting. You can compare the requests log vs. the new learning suggestions.

Hope this helps.

KR

Daniel

[Sushant]

Hello Daniel,

The virtual server will learn traffic if I tend to use port 80 as my virtual server listening port. If I use customized port then the application itself wont work incase of using HTTP as my profile. If I remove the HTTP profile it will work even with the customized port.

[Daniel_Wolf]

So it is not the traffic learning that stops when you change from 80 to 8888 but the whole traffic processing stops?

Where do you change to port 8888? On the VS or on the pool member?

Can you do a tcpdump to analyze why traffic processing stops?

[Sushant]

I have tried using port 80 just for testing purpose. 8888 does work until and unless I use it till Layer 4 . The virtual server stops working when I use HTTP profile.

[Daniel_Wolf]

I'd recommend you to take a tcpdump and to compare what changes between port 80 and 8888. And also what changes with an without HTTP profile.

To me this doesn't look like the Security Policy is causing this issue.

Start with this tutorial:

https://clouddocs.f5.com/training/community/adc/html/class4/class4.html

And check out K00463541, it has links to all relevant tcpdump solution articles:

https://support.f5.com/csp/article/K00463541