For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

P_Kueppers's avatar
P_Kueppers
Icon for MVP rankMVP
Sep 01, 2022

BigIP ASM Problems with FileUploads with SOAP

Hi there, actually my ASM Policy is blocking a file upload for one application with the error message:   HTTP protocol compliance failed Chunks number exceeds request chunks limit: 1000   I ra...
application delivery
asm
security
xml
AubreyKingF5's avatar
AubreyKingF5
Icon for Moderator rankModerator
Sep 27, 2022

Not a bad plan. Can you show me the tmsh out for the http profile? I take it you're not doing anything fancy like HTTP2?

P_Kueppers's avatar
P_Kueppers
Icon for MVP rankMVP
Sep 28, 2022

Pretty default I would say

We have some http/2 servers active:

ltm profile http2 Standard_http2_profile {
    app-service none
    concurrent-streams-per-connection 100
    connection-idle-timeout 60
    defaults-from http2
}
ltm profile http2 http2 {
    activation-modes { alpn }
    app-service none
    concurrent-streams-per-connection 10
    connection-idle-timeout 300
    enforce-tls-requirements enabled
    frame-size 2048
    header-table-size 4096
    include-content-length disabled
    insert-header disabled
    insert-header-name X-HTTP2
    receive-window 32
    write-size 16384
}

 

But most is http/1.2

ltm profile http SecureWEB_http {
    app-service none
    defaults-from http
    enforcement {
        known-methods { CONNECT DELETE GET HEAD LOCK OPTIONS POST PROPFIND PUT UNLOCK }
    }
    header-insert X-Forwarded-Proto:https
    hsts {
        maximum-age 31536000
        mode enabled
    }
    insert-xforwarded-for enabled
    proxy-type reverse
    redirect-rewrite all
    server-agent-name LB
}
ltm profile http http {
    accept-xff disabled
    app-service none
    basic-auth-realm none
    encrypt-cookies none
    enforcement {
        known-methods { CONNECT DELETE GET HEAD LOCK OPTIONS POST PROPFIND PUT TRACE UNLOCK }
        max-header-count 64
        max-header-size 32768
        max-requests 0
        pipeline allow
        truncated-redirects disabled
        unknown-method allow
    }
    fallback-host none
    fallback-status-codes none
    header-erase none
    header-insert none
    hsts {
        include-subdomains enabled
        maximum-age 16070400
        mode disabled
        preload disabled
    }
    insert-xforwarded-for disabled
    lws-separator none
    lws-width 80
    oneconnect-status-reuse "200 206"
    oneconnect-transformations enabled
    proxy-type reverse
    redirect-rewrite none
    request-chunking preserve
    response-chunking selective
    response-headers-permitted none
    server-agent-name LB
    sflow {
        poll-interval 0
        poll-interval-global no
        sampling-rate 0
        sampling-rate-global no
    }
    via-request preserve
    via-response preserve
    xff-alternative-names none
}