HTTP DoS Profiles & Learning process
Hello Dear F5 Community ! I'm trying to understand better all the secrets of the HTTP DoS Profiles I created and attached to some VIPs in transparent mode. I essentially wanna see the evolution of the learning process via the following command : admd -s vs. | grep info.learning Here is an example of the output I get : vs./Common/VS_TEST_1+/Common/DoS-L7_TEST_1.info.learning:[73.685, 693, 1108896, 100] vs./Common/VS_TEST_2+/Common/DoS-L7_TEST_2.info.learning:[79.6533, 690, 6208526, 100] vs./Common/VS_TEST_3+/Common/DoS-L7_TEST_3.info.learning:[65.2094, 299, 33624, 100] vs./Common/VS_TEST_4+/Common/DoS-L7_TEST_4.info.learning:[58.057, 250, 483729, 100] vs./Common/VS_TEST_5+/Common/DoS-L7_TEST_5.info.learning:[52.8262, 678, 33330, 100] vs./Common/VS_TEST_6+/Common/DoS-L7_TEST_6.info.learning:[74.8512, 685, 288011, 100] Although the VIPs & Profiles names have been anonymized here, these are production VIPs with a lot of traffic. According to F5 docs & labs, the 1st number into the brackets represents the "baseline_learning_confidence" which is in % how confident the system is in the baseline learning. Still according to F5 docs & labs, this number should reach around 90-95% before we should feel safe about activating the blocking mode instead of transparent mode. It's been a whole week now and these "baseline_learning_confidence" numbers still oscillate between 40% and 80% (for each VS+Profile) every time I check via the "admd -s" command. So I wonder why, and if it's safe anyway to activate the blocking mode on these HTTP DoS Profile. Anyone had some similar experience with HTTP DoS profiles ? Some precisions : - an example of F5 lab about this topic : https://clouddocs.f5.com/training/community/ddos/html/class7/bados/module1.html - these are DoS profiles created from the "Security/DoS Protection/Protection Profiles" menu in v17.1.x - only the "HTTP" has been activated in these profiles "families" setting - no TPS-based settings activated, only stress-based & behavioral/bad actors settings, with "Threshold Mode" set to "Automatic" - some of the VIPs have a default pool + another pool invoked via iRule/LTP (maybe it's more difficult to establish a baseline for such traffic) but some other are more standard with only a default pool. Many thanks ! David
F5 Rules for AWS WAF - does F5 have any access to the request data inspected by the rule groups?
I'm reviewing the data handling characteristics of the F5 Rules for AWS WAF managed rule groups (purchased through AWS Marketplace) and would like to confirm my understanding with the community. K21015971 describes the procedure for reporting a suspected false positive. As I read it, the customer is asked to log the blocked HTTP requests along with the names of the rules that matched, mask any sensitive information with ****, and then submit a question with the F5 rules for AWS WAF tag and attach those requests. My reading of that procedure is that F5 has no independent access to the requests inspected by the rule groups. If F5 could see them, there would be no need for the customer to extract, mask and attach them manually. Is that reading correct? More specifically, could someone confirm whether the following are accurate? 1. HTTP request data inspected by the rule groups (source IP addresses, headers, request bodies, query strings, cookies) is never transmitted to F5. 2. AWS WAF logs, sampled requests, CloudWatch metrics, and the labels generated by rule matches remain entirely within the subscriber's own AWS account, with no access path available to F5. 3. The only information F5 receives in connection with a subscription is AWS Marketplace billing and metering data. One related question. Section 5 of the F5 End User License Agreement (Collection and Use of Product Information) notes that, depending on the product and the licensed pricing tier, a customer may be able to opt out of the collection and use of such information by configuring the product to disable those features. Is there any such configuration available for these rule groups? Or does the question simply not arise because no collection takes place for this product? Thanks in advance.
F5 XC WAF Automation for Bulk IP Prefix Blocking
I've a requirement to block more than 5,000 IP addresses in F5 Distributed Cloud (XC) WAF. Is there any supported option to automate the creation or update of IP Prefix Sets using scripts or APIs, instead of adding the prefixes manually through the UI? The goal is to automate the process of importing and maintaining the IP prefixes used for blocking traffic. Thank you.
An Irule for Client Ssl Profile that Allows Unassigned TLS Extension Values (17516)
Hello Community, I have a requirement to allow enriched https header enrichment. The SSL negotiation (I'm doing ssl termination on F5) fails because the enriched header from client contains reserved tls extension values. (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtmltls-extensiontype-values-1). The Client Hello request in the SSL Handshake was captured and contained an Extensions list, which included a reserved TLS Extension value (17156), which the F5 isn't presenting in Server Hello. I need an irule that can allow that Extension to be added on the client ssl profile so the ssl handshake doesn't fail.
F5 LTM logs and application access logs
Hi, I would like to ask for guidance, as I do not have the access to test on this kind of scenario. When using LTM to route the application traffic to the application server hosted in LTM virtual server. Meaning every time the requests from client will first reach the LTM before being forwarded/routed to the respective virtual server. (In case there isn't AWAF enabled) In DFIR/SOC analyst's point of view, we would expect LTM logs would log the time slightly earlier for each requests than the access logs found in the server itself. However, if there were SQLi with payload containing "sleep", which would potentially delay the responses, how would these two different logs record the timestamp of the requests? Will the timestamps recorded in the access logs in the server itself would have delay if the payload is working?restore the BIG-IP to its previous state (where server.csr displays No CSR) without impact
Hello, I made same mistake and filled in the CSR file (server.csr) under: System > Certificate Management > Device Certificate Management > Device Certificate Signing Request Before this change, the server.csr entry already existed in the GUI and its status was: No Certificate Signing Request After I filled in the CSR parameters, I would like to restore the BIG-IP to its previous state, where server.csr appears with the message: No Certificate Signing Request I would like to remove the CSR information safely without impacting the existing configuration. I performed the following checks: tmsh list sys crypto csr tmsh list sys crypto csr one-line tmsh list sys crypto csr server.csr None of the above commands return any output. I also found that the file exists only at: /config/ssl/ssl.csr/server.csr Furthermore, searching for server.csr under /config did not show any reference to it in the BIG-IP configuration files. If not, what would be the recommended and safest procedure to remove the CSR information and restore the BIG-IP to its previous state (where server.csr displays No Certificate Signing Request) without impacting the current Device , i want to remove it from cli using this command: rm /config/ssl/ssl.csr/server.csr Thank you in advance
PQC: a blindspot (logging) on BIG-IP - RFE
On BIG-IP it's currently not possible to log information such as proposed and negotiated Key Exchange Algorithm. No available iRule commands for that. On the other hand, NGINX do offer the possible to log it ($ssl_curve/$ssl_curves variables). I've got a RFE created for the following: Provide new iRule commands in events CLIENTSSL_CLIENTHELLO and CLIENTSSL_HANDSHAKE that outputs the Key Exchange Algorithm: - list of proposed (by the SSL client) Key Exchange Algorithms in CLIENTSSL_CLIENTHELLO - negotiated Key Exchange Algorithms in CLIENTSSL_HANDSHAKE => RFE ID2347153 — "iRule command equivalent to NGINX's $ssl_curve for logging the negotiated KEM/DH group" Don't hesitate to open a support case to bind it to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀 AlexandreAWAF Access Profile, missing a configurable JWKS URL - RFE
The AWAF Access Profile functionality (introduced in 17.5) is potentially a great feature, but IMHO it (still) lacks an essential function in the "Verify Digital Signature" part: an automatic refresh/rotation interval to periodically fetch and update the JWKS from a specified URL. Currently, it only supports the upload of a file containing the key. Not enough for a mature solution, which supports enterprise deployments (OIDC integrations with such as Entra ID, Okta, etc.) Note: I do know that some experts here builded some automation to work around this lacking feature. Great stuff. Anyway, as I though the effort for the F5 devs should not be huge (they have already some code doing that in their APM OIDC auto-discovery function), I've opened a support case/RFE and got one back => RFE ID2294753: AWAF Access profile Verify Digital Signature to support dynamic JWKS retrieval via a configurable URL endpoint Don't hesitate to open a support case to get it bound to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀 AlexandreAPM Portal access and ECMAScript compatibility
I notice that ECMAScript (ES13) is supported as stated in version 21.1 release note https://techdocs.f5.com/en-us/bigip-21-1-0/big-ip-release-notes/big-ip-new-features.html#portal-access-ecmascript-es13-support-for-modern-javascript-applications As I know, latest version in 17.1 can also use the latest cache-fm-Modern.js file. Does it imply that latest version in 17.1, say 17.1.3.2, also support ECMAScript (ES13)? https://my.f5.com/manage/s/article/K000148786
