Map ASM events in iRule?
Hello Guys, Can anyone please help me mapping ASM events in an iRule? Customer wants to block any violation (generated by ASM) contains the word "Alert". I have no experience using ASM events within an iRule, hence any help will be appreciated. I have gone through the iRule knowledge base article where iRule events are described, unfortunately I couldn't understand how to map within an iRule. https://devcentral.f5.com/wiki/iRules.ASM__violation.ashx Thank you, Darshan
Which runs first iRULE or PolicyLTM(With ASM being applied)
Hello all Its well known by the K16590 that LTMPolicies will run before the irules using the same event, for example HTTP_REQUEST in an irule and "at request time" in LTMPolicy. But regardless the order, if the LTM Policy says to enable ASM policy the BIG-IP would still return and process the irule or the traffic would be sent to ASM policy for process leaving the irule whitout a match/process ? In my understanding the LTM Policy would be read first, after that the irule and then the traffic sent to ASM Policy. But i'm not having my irule redirects occuring. In this case of configuration: when HTTP_REQUEST { if {[HTTP::uri] starts_with "/region1/abc"} { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } elseif {[HTTP::uri] starts_with "/region2/abc"} { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } elseif {[HTTP::uri] starts_with "/region3/abc"} { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } elseif {[HTTP::uri] starts_with "/region4/abc"} { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } else { # do nothing } } ltm policy LTM_POLICY_ASM_MYSITE { controls { asm } requires { http } rules { MYSITE { actions { 0 { asm enable policy /Common/ASM_MYSITEWAFPOLICY } } conditions { 0 { http-host values { www.mysiteexample.com.br mysiteexample.com.br } } } } default { actions { 0 { asm enable policy /Common/ASM_MYSITEWAFPOLICY_MISC } } conditions { 0 { http-uri contains values { miscelaneous } } } ordinal 1 } no_asm { actions { 0 { asm disable } } ordinal 2 } } status published strategy first-match }