iRule to Allow acess to /wp-admin

[Victor_Soares]

Hello guys, I have a site protected by ASM that works on WordPress, it was requested that an exception to be created for the path /wp-admin, because they are receiving several blocks on access to the path, I tried to add the path in the section of URL'S allowed but it did not work, I keep receiving the logs and the blocks keep occurring for the path /wp-admin, is there a way or an iRule to perform a bypass in the path /wp-admin so that it is not blocked access?

Best Regards.

[SanjayP]

What's your current setup? How do you block /wp-admin currently via an iRule or ASM policy?

[Victor_Soares]

Hello SanjayP! about hardware we are using 2 i2800 (Active - Passive), about the URL we're only using ASM protection on BIG-IP, don't using any other feature like load balancing or something like that. Currently using default ASM policy, without any iRule, i've tryied to input the path on allowe URL'S but without success.

[SanjayP]

If you are using ONLY "ASM" to disallow URL and you want to allow specific URL then

Navigate to Security -> URL's --> disallowed URL's and remove /wp-admin.

If in the allowed URL list (security -> URL -> Allowed URLs) if wildcard (*) is removed, then add the /wp-admin (for explicit) or /wp-admin* for the wildcard. 

if you are still receiving ASM blocks, please provid the log snippet for the reason of the ASM block and URL getting blocked.

[Victor_Soares]

Hello SanjayP, currently i'm using the allowed urls method, like the image :

At the moment, i had to switch the application to learning mode, but i have an alert after this allowed URL applied and the blocked alert :

Keyword match :

1st Path :

2st Path at the same signature :

 

Both was blocked with the Allowed URL'S configured like the 1st image.

Thank You.

[Victor_Soares]

Both of the alerts are matching at the   img tag: src/dynsrc/lowsrc (Parameter) signature in /wp-admin/* path

[SanjayP]

well, it's not getting blocked because you have not allowed the URL.

It's getting blocked because of the ASM signature triggered or HTTP compliance setting (I still can't see the exact reason as you have not shared it). But either way you would need to fine tune the ASM policy further to allow this request.

If you want to completely disable ASM inspection on this path, you can create LTM policy and disable ASM for this path or iRule as below. But the recommended way would be to fine tune ASM policy in learning mode and whitelist the signatures as required on that path

when HTTP_REQUEST {
    switch -glob [string tolower [HTTP::uri]]  {
	      "/wp-admin*" 
		{
            ASM::disable
	    } default {
	        return
	       }
	}
 }

[Victor_Soares]

Thank You Sanjay, there is a way to to the same thing applying an rule in local traffic policy ? Like "HTTP URI path contains any of /wp-admin at request then disable asm at request time ? like the image belllow :

[SanjayP]

Yes, you can use LTM policy or iRule to completely bypass ASM.