ASM Application Security PolicyManual Configuration (Advanced)
Hi, In 13.1.0.7 (I am not sure if it was the same in 13.1.4 but for sure not like that in 12.1.x) when security policy is applied via Security tab of VS configuration pop up allowing to disable or change policy is gone. Instead entry like that is presented: Application Security PolicyManual Configuration (Advanced) Why so? Is that some kind of weird improvement? With this change management becomes quite complicated: There is no way to figure out which policy is attached to VS (except checking Resources > Policies section of VS) There is no easy way to change or disable security policy (again Resources > Policies and detach Local traffic Policy pointing to security policy) What is reason for this change, I can't see any benefits. Piotr
ASM policy HTTP/HTTPS Virtual Server
Hello, We have a VS running as HTTP with an ASM security policy and many learned objects and we need to move to HTTPS instead of HTTP i'm aware of option "Differentiate between HTTP/WS and HTTPS/WSS URLs" and the option is enabled so all the learned objects are working with HTTP only and when moving to HTTPS most of the url are blocked as they aren't learned yet (as HTTPS) so is there any way we can modify the security policy to be working with HTTPS instead of creating new one and start from scratch.
Difference between Local Traffic Policy and Application Secutiry Policy
Can someone give some explanation between these two kind of policies and for what kind of servers should they be used? I mean, for example depending whether I have a web application or a MySQL db, or an ssh port etc... Thanks in advance
ASM Application Security PolicyManual Configuration (Advanced)
Hi, In 13.1.0.7 (I am not sure if it was the same in 13.1.4 but for sure not like that in 12.1.x) when security policy is applied via Security tab of VS configuration pop up allowing to disable or change policy is gone. Instead entry like that is presented: Application Security PolicyManual Configuration (Advanced) Why so? Is that some kind of weird improvement? With this change management becomes quite complicated: There is no way to figure out which policy is attached to VS (except checking Resources > Policies section of VS) There is no easy way to change or disable security policy (again Resources > Policies and detach Local traffic Policy pointing to security policy) What is reason for this change, I can't see any benefits. Piotr
Unable to "accept" a HTTP protocol compliance failed violation that is of "HTTP Parser Attack type
While- I try to "accept" the HTTP protocol compliance violation for HTTP Parser attack type, I find the "accept" button greyed out and instead I getting the message "unlearnable request". How do I understand and allow these kind of requests, so that I can ensure that these requests are not blocked.