Applying ASM policy takes too long
Hi Experts, Need help to identify why applying policy in ASM takes long. In the below snapshot, you can see the "Applying Policy" keeps spinning for almost an hour. I think it is because of the learning mode selected as Automatic and Auto-Apply selected as Real-Time. Please advise.
ASM Application Security PolicyManual Configuration (Advanced)
Hi, In 13.1.0.7 (I am not sure if it was the same in 13.1.4 but for sure not like that in 12.1.x) when security policy is applied via Security tab of VS configuration pop up allowing to disable or change policy is gone. Instead entry like that is presented: Application Security PolicyManual Configuration (Advanced) Why so? Is that some kind of weird improvement? With this change management becomes quite complicated: There is no way to figure out which policy is attached to VS (except checking Resources > Policies section of VS) There is no easy way to change or disable security policy (again Resources > Policies and detach Local traffic Policy pointing to security policy) What is reason for this change, I can't see any benefits. Piotr
Assign an existing Security Policy through Python SDK
Can I assign to an Existing Virtual Server an existing Security Policy? Not a local Traffic Policy, I have already created a Automatic Security Policy through the Deployment Wizard but I would like to automate the process through a Python Script. Thanks in advance.Activate a Policy through F5 Common Python
I tried to activate a policy, which is inactive once is created this way: policy.modify(active=True) Obviously it is worng as I have guessed from the answer, which is this one: '{"code":401,"message":"Policy must be applied and/or activated by a Task" What are the tasks and I how can I have a code to do this? Thanks in advance
ASM Application Security PolicyManual Configuration (Advanced)
Hi, In 13.1.0.7 (I am not sure if it was the same in 13.1.4 but for sure not like that in 12.1.x) when security policy is applied via Security tab of VS configuration pop up allowing to disable or change policy is gone. Instead entry like that is presented: Application Security PolicyManual Configuration (Advanced) Why so? Is that some kind of weird improvement? With this change management becomes quite complicated: There is no way to figure out which policy is attached to VS (except checking Resources > Policies section of VS) There is no easy way to change or disable security policy (again Resources > Policies and detach Local traffic Policy pointing to security policy) What is reason for this change, I can't see any benefits. PiotrDifference between Local Traffic Policy and Application Secutiry Policy
Can someone give some explanation between these two kind of policies and for what kind of servers should they be used? I mean, for example depending whether I have a web application or a MySQL db, or an ssh port etc... Thanks in advanceScheduled Report - Top Attacks By Security Policy
Hello, I am looking to generate a scheduled report to display the top attacks by each security policy I have (4) and I am using v12.1.2. I navigate to "Security ›› Reporting : Scheduled Reports" and enter the required fields such as name, SMTP info, frequency, etc. But the question is obviously in the exact configuration of the report. If I use... Dynamic Report Time Period: Last Week Show Results: Top 20 Top Report Criteria: Security Policy Select Measure: Requests .. then I get a report with a chart that shows the amount of requests each of those policies has received. Cool. But that is not exactly what I want. So I hit the plus button to "Use top result from security policy to report" > "Attack Type" Is there any way that I can "Use ALL results from security policy to report > Attack Type" ?? Any other info on how I could get something like this working to see attack types / violation for the last week from all my policies is appreciated. It is hard to share this info with others when I can only see traffic from my largest virtual server in these reports.
How to best address signature tripping and exception list
I am looking for an answer on how to best address signature tripping and exception list; do we disable base signature, create custom signature inheriting from base, adjust it to allow legit traffic but block all else. we have some scanners in the internal network and want to allow only these certain IPs or domains to scan. how would I go about addressing this?
