User gets blocking page instead of captcha for brute force attack

[Muhannad]

Dears,

I am trying to configure Captcha during brute force attacks for OWA, but i am getting the blocking page instead.

I have read that i need to qualify the URL as a login page. by running the command: tmsh modify /sys db asm.cs.qualified_urls value /loginpage.mvc, my questions as follows:

1- Is this value loginpage.mvc is specific for OWA, or i should use the name of my login page?

2-Should i qualify the already configured working logging pages or this is not related?

Many thanks in advance for your help.

Regards,

Muhannad

[samstep]

1. loginpage.mvc is not an OWA login page
2. setting "asm.cs.qualified_urls " was a workaround for a bug in v13.1 https://cdn.f5.com/product/bugtracker/ID686108.html

• this bug was fixed in 14.0.0, 13.1.0.2 - make sure you are using the latest version
• if you are still experiencing a blocking page you should raise a case with F5 Support

[Sebastiansierra]

Hi,

1. This behavior is caused for a bug.

2. some URLs fails and another no, you need to test all the brute force login that configuring to figure out if is affected or not.

3. You need to specify the URL path, not the domain.

4. Additional if you need to add more than one path, you must determine if there are URL added, because run the command replaces the current value.

* First run the command :

tmsh list /sys db asm.cs.qualified_urls

*Then modify the db parameter with all the URLs that you need to exclude, in the next example I add /login and /index.php:

tmsh modify /sys db asm.cs.qualified_urls value /loginpage.mvc,/login,/index.php