ASM Advanced WAF

3173 Topics

F5 ASM - Compact Learning
Hi, I have configured a manual policy with the Compact learning for parameters but it doesn't add parameters to the list. However, wildcard parameter is changed with suggestions. I think it's working like Never (Wildcard Only) learning, why? On the other hand, I've read in K74535942 that the policy must include the following: Most commonly used entities Disallowed file types Top-level URLs, such as /abc/* https://support.f5.com/csp/article/K74535942 How can I include these requirements in the security policy? Thanks, best regards.
dromerot
Jul 28, 2025 Place Technical Forum
2.7KViews
0likes
8Comments
Need- F5 webserver for to setup own lab (not LAMP server in the partner portal)
Hi Team / Experts, Anyone please share me the F5 webserver(backend server) which is used to setup F5 official lab for training. I got lamp server from f5 partner portal, but i want to setup same F5 training lab in my home to prepare and practice with F5 official training material. It would be more helpful if anyone guided me or share me those official lab setup with webserver(backend server). Thanks, RK
RKRam
Jul 06, 2025 Place Technical Forum
2KViews
0likes
10Comments
TCL error: _cgc_pick_clientside
Hi, in an ASM-LTM (Perimeter) Setup I see frquently the following logs: ***err: tmm3[19962]: 01220001:3: TCL error: _cgc_pick_clientside - unknown cgc sni: f5-bei1.xxxx.xx (line 49) invoked from within "CGC::sni $tls_servername"*** Any idea what this TCL error causes? The clientssl is quite Basic: one certificate chain, no Server Name set. Thanks, Rolf
rolf
Apr 12, 2025 Place Technical Forum
1.3KViews
1like
5Comments
What is F5 ASM conviction and can it be used for configuring custom URL honey pot trap?
I see the feature conviction can be triggered in an irule but can it be done also in the ASM policy? Also can the honey pod traps be configured to send specific URL for the honey pod server or this is something that the ASM does automatic and sends custom URLs that target things on the ASM, so the ASM can detect attacks or the ASM sends the URL of an F5 web based honey pod server ? https://clouddocs.f5.com/api/irules/ASM__conviction.html This feature seems like the Citrix ADC bot trap url but there the trap url can be configured. This is my question if f5 ASM/WAF has options to send selected honey pod trap urls with javascript injection to bot devices or hackers?
Solved
Nikoolayy1
Feb 16, 2025 Place Technical Forum
1.8KViews
0likes
7Comments
Automate ASM "Ready to Be Enforced" Attack Signatures
Hi All, Problem scenario is this: Multiple F5 ASM deplyoments which use BigIQ to push out updated attack signatures ( works well ) and a 14 day Enforcement Readiness Period. This all works well up to this point, where someone manually has to go and click the "Enforce Ready Entities" button. That sounds like a minor thing to do, but in an Enterprise it includes change control/PVT etc to do... ...but automating this out as a fortnightly thing should reduce risk and I can do other things. So I am comfortable with the API, but looking at v13/v14 API I dont see a functionality that can do this for me. Has anyone done this last step to fully utomate attack signature updates ?
Solved
danielpenna
Jan 31, 2025 Place Technical Forum
3.3KViews
1like
15Comments
Adding http only / secure flags to TS cookies per policy
Since it is a global change to add flags to the TS or ASM cookie, I am guessing if you need to add it to a specific policy and not global would involve an irule. Below is a rule that seems would work but is not for me and I am out of ideas. The flow is using two vips as we need to limit the number of public ip addresses being used. public_ip_vip_443 redirected to public_ip_vip_8443. 443 has the client side cert and 8443 has serverside with ASM policy on 8443 vip. This works just fine. Automap as well. So on the 8443 vip I want to insert the flags for the TS* cookies. Any ideas why the cookies are not being flagged? when CLIENT_ACCEPTED { set is_ssl [PROFILE::exists serverssl] } when HTTP_RESPONSE { set cookie_list [HTTP::header values "Set-Cookie"] HTTP::header remove "Set-Cookie" if { $is_ssl } then { foreach cookie $cookie_list { switch -glob -- [string tolower $cookie] { "TS*" { } "*;*secure*httponly*" - "*;*httponly*secure*" { } "*;*httponly*" { set cookie "[string trimright $cookie "; "]; Secure" } "*;*secure*" { set cookie "[string trimright $cookie "; "]; HttpOnly" } default { set cookie "[string trimright $cookie "; "]; Secure; HttpOnly" } } HTTP::header insert "Set-Cookie" $cookie } } else { foreach cookie $cookie_list { switch -glob -- [string tolower $cookie] { "TS*" { } "*;*httponly*" { } default { set cookie "[string trimright $cookie "; "]; HttpOnly" } } HTTP::header insert "Set-Cookie" $cookie } } }
Solved
Dave_Pisarek
Jan 09, 2025 Place Technical Forum
3.3KViews
0likes
4Comments
Bypass the character for Evasion technique Detected violation
Hi, I need help to bypass or allow %", character which has triggered the Detection violation(Bad unescape) in JSON POST Data. This is legitimate request and i don't see this request on learning suggestion. I am able to find with the help support ID provided by user under the event logs.
Rahulve
Sep 13, 2024 Place Technical Forum
1.3KViews
0likes
4Comments
ASM Policy in "Blocking" Mode switch to "Transparent" for some IP's
I have a policy that I need to switch to blocking but the business want to have a phased approach. Only the testing team should be in Blocking, while the rest of the business (a different IP range) remains in transparent. I need to keep the same policy so that I can "proof" that everything is running fine. Is there a method to do that ? Was thinking about an iRule but dont know how. I know how to disable ASM with an iRule but, that's something I don't want because I need to keep the learning suggestions. Bye St.
Steph_282542
May 09, 2024 Place Technical Forum
621Views
0likes
6Comments
F5 WAF/ASM block users that trigger too many violations by source ip/device id using the correlation logs
Hello to All, I was thinking of using the iRule tables command to write when a user ip/device id makes too many violations for a time perioud and to get blocked for some time but I see that the F5 ASM has correlation logs that trigger incidents but there is not a lot info if this can be used in iRules or to block user ip addresses / deviceid. https://support.f5.com/csp/article/K92532922
Solved
Nikoolayy1
May 09, 2024 Place Technical Forum
2.1KViews
1like
7Comments
ASM cookie, modifying "domain" field
Is it possible to modify "domain" field in the ASM cookie ? As it appears ASM is using a hostname from http header, unfortunately the host is replaced to an internal hostname (required by an app) in an irule. So scanners point that this is a vulnerability.
PiotrL
May 07, 2024 Place Technical Forum
562Views
0likes
2Comments