Forum Discussion

Victor_Soares's avatar
Victor_Soares
Icon for Nimbostratus rankNimbostratus
Apr 12, 2021

iRule to Allow acess to /wp-admin

Hello guys, I have a site protected by ASM that works on WordPress, it was requested that an exception to be created for the path /wp-admin, because they are receiving several blocks on access to the path, I tried to add the path in the section of URL'S allowed but it did not work, I keep receiving the logs and the blocks keep occurring for the path /wp-admin, is there a way or an iRule to perform a bypass in the path /wp-admin so that it is not blocked access?

 

 

Best Regards.

 

ASM Advanced WAF
iRules
security

8 Replies

Sort By
  • SanjayP's avatar
    SanjayP
    Icon for Nacreous rankNacreous
    Apr 13, 2021

    What's your current setup? How do you block /wp-admin currently via an iRule or ASM policy?

     

    • Victor_Soares's avatar
      Victor_Soares
      Icon for Nimbostratus rankNimbostratus
      Apr 13, 2021

      Hello SanjayP! about hardware we are using 2 i2800 (Active - Passive), about the URL we're only using ASM protection on BIG-IP, don't using any other feature like load balancing or something like that. Currently using default ASM policy, without any iRule, i've tryied to input the path on allowe URL'S but without success.

      • SanjayP's avatar
        SanjayP
        Icon for Nacreous rankNacreous
        Apr 13, 2021

        If you are using ONLY "ASM" to disallow URL and you want to allow specific URL then

        Navigate to Security -> URL's --> disallowed URL's and remove /wp-admin.

         

        If in the allowed URL list (security -> URL -> Allowed URLs) if wildcard (*) is removed, then add the /wp-admin (for explicit) or /wp-admin* for the wildcard. 

         

        if you are still receiving ASM blocks, please provid the log snippet for the reason of the ASM block and URL getting blocked.

  • Victor_Soares's avatar
    Victor_Soares
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2021

    Hello SanjayP, currently i'm using the allowed urls method, like the image :

    At the moment, i had to switch the application to learning mode, but i have an alert after this allowed URL applied and the blocked alert :

     

    Keyword match :

    1st Path :

    2st Path at the same signature :

     

    Both was blocked with the Allowed URL'S configured like the 1st image.

     

    Thank You.

     

  • Victor_Soares's avatar
    Victor_Soares
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2021

    Both of the alerts are matching at the   img tag: src/dynsrc/lowsrc (Parameter) signature in /wp-admin/* path

    • SanjayP's avatar
      SanjayP
      Icon for Nacreous rankNacreous
      Apr 13, 2021

      well, it's not getting blocked because you have not allowed the URL.

      It's getting blocked because of the ASM signature triggered or HTTP compliance setting (I still can't see the exact reason as you have not shared it). But either way you would need to fine tune the ASM policy further to allow this request.

      If you want to completely disable ASM inspection on this path, you can create LTM policy and disable ASM for this path or iRule as below. But the recommended way would be to fine tune ASM policy in learning mode and whitelist the signatures as required on that path

      when HTTP_REQUEST {
    switch -glob [string tolower [HTTP::uri]]  {
	      "/wp-admin*" 
		{
            ASM::disable
	    } default {
	        return
	       }
	}
 }
  • Victor_Soares's avatar
    Victor_Soares
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2021

    Thank You Sanjay, there is a way to to the same thing applying an rule in local traffic policy ? Like "HTTP URI path contains any of /wp-admin at request then disable asm at request time ? like the image belllow :

     

    • SanjayP's avatar
      SanjayP
      Icon for Nacreous rankNacreous
      Apr 13, 2021

      Yes, you can use LTM policy or iRule to completely bypass ASM.