AWAF-DOS protection profile
Need help setting up a DOS profile with below requirements. /api/customer/* 50 requests/sec/client IP /api/contracts/* 100 requests/sec/client IP /api/search/* 20 requests/sec/client IP and site wide 200 requests/sec/client IP. How to achieve this using AWAF DOS profile. I am bit confused by the way the configuration options are given under TPS based detection. How to add all the above conditions in one profile. If i do by source ip then how to implement it per url or uri? Thanks.
LTM Health Monitor Issue
There is a pool which has three members but two of them are not coming up with any of the health monitor. I tried, gateway ICMP, TC-half open, content monitoring almost everything. However, one member of the same pool is working fine. I would appreciate any suggestion. Thanks, NilesjvCMP to rSeries Config comperision
We procured the rSeries some time ago, and I built it using the UCS files from the vCMP guests. However, I was unable to make it live on the network. During this time, several changes have been made to the vCMP guests. I am now planning to bring the rSeries into production and decommission the vCMP appliances, but I am not sure what changes have been made on the vCMP guests since the initial build. Is there a way to identify those changes and apply them to the rSeries appliances? I would prefer not to rebuild the rSeries appliances from scratch. Any suggestion would be appreciated. Thanks,F5 BIG-IP Advanced WAF Troubleshooting: What I Check First
When an application protected by F5 BIG-IP Advanced WAF / ASM starts failing, I try not to change the security policy immediately. Before disabling signatures, creating exceptions, or switching the policy to Transparent mode, I first ask: Where exactly is the request failing? 1. Validate LTM first Before blaming the WAF, confirm that the application delivery path is healthy. tmsh show ltm virtual <virtual_server> tmsh show ltm pool <pool_name> Check: Virtual Server status Pool and pool members Health monitors Backend connectivity If the pool is unavailable, the problem is probably not Advanced WAF. Client | Virtual Server | Advanced WAF | Pool | Application The objective is to determine whether the failure happens before, during, or after WAF inspection. 2. Confirm that Advanced WAF actually blocked the request Check: Security > Event Logs > Application > Requests If the user receives a blocking page, capture the Support ID. Correlate: Timestamp Client IP URL HTTP method Violation Attack signature Security policy Support ID An application error does not automatically mean that Advanced WAF blocked the request. Also remember that missing events do not necessarily mean traffic bypassed the WAF. Verify the configured logging profile. 3. Check the enforcement state A detected violation is not necessarily a blocked request. Verify: Transparent vs Blocking Learn Alarm Block Signature/entity staging A policy in Blocking mode does not mean every detected violation will block traffic. 4. Identify the exact violation Before disabling anything, understand exactly what triggered the policy. Examples: Attack Signature Detected Illegal parameter Illegal URL HTTP protocol violation JSON/XML parsing violation Disallowed method CSRF DataGuard Then identify the affected entity: Signature ↓ URL ↓ Parameter / Header / Cookie / JSON element ↓ Matched value This is critical for proper WAF tuning. 5. Tune the smallest possible scope Suppose a legitimate parameter triggers a SQL injection signature. Do not immediately disable that signature globally. Instead determine: Signature ↓ Affected URL ↓ Affected parameter ↓ Expected application behavior ↓ True positive or false positive? ↓ Granular exception, if justified My rule is simple: Change the smallest possible security scope. 6. If there is no WAF event, validate the traffic path Check whether: The request reaches the expected Virtual Server The correct security policy is assigned The HTTP profile is present An LTM policy changes processing An iRule redirects or modifies traffic SSL terminates where expected Traffic reaches another VIP Packet capture can quickly confirm the flow: tcpdump -nni 0.0:nnn -s0 host <client_or_server_ip> 7. Correlate logs Useful starting points: tail -f /var/log/asm tail -f /var/log/ltm Do not troubleshoot using one log line. Correlate: Timestamp + Client + Virtual Server + Support ID + WAF Event + LTM behavior + Backend response 8. Do not blame WAF for every HTTP error For example: 404 Check URI, redirects and application routing. 500 Investigate the application/backend. 502 / 503 / 504 Check pool members, health monitors, TCP connectivity, server-side SSL and timeouts. The fact that Advanced WAF is enabled does not mean it generated the error. 9. Remember TLS TLS failures can look like WAF problems. Check: Client SSL profile Server SSL profile Certificates SNI TLS versions Cipher negotiation Backend TLS handshake If TLS fails before HTTP inspection, you are troubleshooting a different layer. My Quick Workflow Reproduce the issue ↓ Validate Virtual Server ↓ Validate Pool / Backend ↓ Confirm traffic path ↓ Find WAF event / Support ID ↓ Identify violation or signature ↓ Check enforcement and staging ↓ Identify affected entity ↓ True positive or false positive? ↓ Apply the smallest justified change ↓ Retest The main principle is: Do not troubleshoot a WAF by disabling security controls until the application starts working. Correlate: Traffic path + policy + enforcement + violation + entity + logs + application behavior That is the difference between proper WAF tuning and simply weakening the policy. What do you normally check during the first few minutes of an Advanced WAF incident? Essa é a faixa de tamanho que eu usaria no F5 DevCentral: técnica, escaneável e sem parecer capítulo de manual.
New rSeries Tenant Gui slow
We have deployed a new Tenant on new r4000 series appliances and have have noticed that the gui is extremely slow and will timeout occasionally. The Tenant has 8vCPU's and 32 GB of Ram, the dashboard shows everything is very low but switching from one gui section to another will result in the "Loading Retrieving ...." page for a bit. I have found articles that you can increase the memory that tomcat has but have not made any changes on that. The resource provisioning is set to small which is the same as our existing vCMP devices on iSeries appliances. At this point the new device has not been added to the device group/config sync so it doesn't have any of the VIPs/Pools/Health Monitors and is still running slow. Anyone else experience this behavior? Thanks, JoeRate limiting based on X-forwarded-For
Hello, Currently our external BIG-IP receive traffic from CloudFlare. I would like to apply a rate limit on the IP provided by X-FORWARDED-FOR header. Aside from building an iRule, is there any bulit-in option inside of F5 modules to achieve this? the use case is to rate limit for OTP submission and im scared that an iRule will have high load on the resources. Thanks in advance.
Beginner in F5 ASM
Hi All, I hope you are doing well. I am currently learning about F5 ASM to add one more technical skill to my skill set. I already have good experience with firewalls (Palo Alto and Check Point) As F5 ASM is not deployed in our environment and we use a different vendor WAF (Imperva) I wanted to know what the normal procedure is to onboard a web application on F5 in production. Which policy template do you choose (Rapid deployment, comprehensive, fundamental) Also, what is the best practice for policy building in learning mode? How are signatures enforced? After 7 days learning period, do you enforce all staging signatures learned or do some manual checks as well?Adding new rSeries Tenant to existing Device Group
We are refreshing our iSeries with rSeries hardware. I have deployed the new Tenant for LTM and associated the proper VLANs and I see them in the new LTM but they are all in the Common Partition. On the existing LTM's the VLANS are in their respective partitions. I have case open with support and they provided guidance on adding the new device to the group to get the configuration synced. Can I get any suggestions from anyone that has already gone through this exercise? I have a change request in for tonight to add this device to the group and I am concerned with the process. Thanks, JoePer ip connection limit on virtual server
i want to apply per ip connection limit on a virtual server . i have AFM provisioned on the F5 . the requirement is that, example - any client IP address can open TOTAL max of 50 connections . meaning per ip connection limit on 50. How can i achieve this . ThanksFinding the Primary Replica of an Availability Group
Hi All, I've configured VIPs and a WIP for a SQL Always On service and would like to ensure traffic is directed to the current Primary Replica wherever possible. The configuration is as follows: DC1 hosts a SQL server and a corresponding VIP. DC2 hosts a SQL server and a corresponding VIP. The WIP currently directs traffic to the DC1 VIP using Global Availability, with a fallback to Round Robin if required. Does anyone know of a way for the F5 infrastructure to identify which SQL Always On replica is currently the Primary Replica and automatically direct clients to the associated VIP across the two data centres? Any advice or experience with this would be greatly appreciated. Thanks in advance.
