sslprovide (--f5 ssl) does not generate CLIENT/SERVER_TRAFFIC_SECRET on server-side TLS traffic
When I enable the sslprovider and start a tcpdump on the server-side in order to decode TLSv1.3 traffic, only the CLIENT_HANDSHAKE_TRAFFIC_SECRET and SERVER_HANDSHAKE_TRAFFIC_SECRET 'keys' are stored in the packet capture file, but the CLIENT_TRAFFIC_SECRET and SERVER_TRAFFIC_SECRET 'keys' are missing. This prevents me to decode the application data in the packet capture: # tmsh modify sys db tcpdump.sslprovider value enable # tcpdump -i <server-side-VLAN> -s0 -f5 ssl:v -vvv -w /var/tmp/output.cap <Generate traffic> # tshark -r /var/tmp/output.cap -Y "f5ethtrailer.tls.keylog" -T fields -e f5ethtrailer.tls.keylog On the client-side, this works as expected. Is this a bug (tested with TMOS 17.5.1)? Am I doing something wrong?
SSL cipher
Hi guys TLS is weird. Why is this behavior happening? The server that receives the client hello sends an alert. Transport Layer Security TLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 688 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 684 Version: TLS 1.2 (0x0303) The server only allows TLS 1.0. Our SSL profile is also set to only allow TLS 1.0.
getting compiling error when enabling Nginx App_potect
i m trying to install NGinx plus with App_ptotect but when trying to enable app_protect module after installing it i get the following error nginx: [emerg] APP_PROTECT config_set_id 1752649466-871-149162 not found within 45 seconds nginx: [emerg] APP_PROTECT fstat() "/opt/app_protect/config/compile_error_msg.json" failed (2: No such file or directory) and i can not start the nginx service, any idea about the issue?
How can I measure Advanced WAF (ASM) throughput on a running BIG-IP VE (per VIP / per policy)?
Hi everyone, I’m running BIG-IP VE with LTM + Advanced WAF (ASM) and I’m planning a license upgrade (e.g., 200 Mbps to 1 Gbps). Before upgrading, I want to measure the real WAF throughput on the currently running VM, ideally: Per virtual server (VIP) And, if possible, per ASM/AWAF security policy Questions: 1- Is there a supported way to get throughput (Mbps/Gbps) per ASM/AWAF security policy (not just per VIP), either from GUI, tmsh? 2- If per-policy throughput isn’t available, is VIP throughput the recommended proxy for WAF throughput (since the policy is attached to that VIP)? 3- For sizing/licensing discussions, should throughput be considered request-only or request + response (bidirectional)
What is the best practice for migrating from iseries to rseries?
hi ,we plan to migrate to new r-series F5 (v15.1.x) from i-series legacy appliance v13.x.x. We will create the same vlans and IP address config, but the physical interfaces will be different. The new r-series appliance is already licensed. What is the best practice for this migration? option1: import the whole UCS file to new r-series appliance. after importing the ucs to new appliance, what are the next steps to complete the whole migration? option2: copy the config for every module, for example to copy ltm config first, then gtm, final AFW ...... can someone please advise, thanks in advance!
BIG-IP i11000 – License compatibility with TMOS versions above 14.1.2 and Web GUI inaccessible
We are currently working on the recovery of an F5 BIG-IP i11000 appliance and would like guidance. The device boots normally and console access is available. However, the system remains in an INOPERATIVE state and the Web GUI is not accessible. MCP and related services do not fully initialize. A valid license file exists locally at /config/bigip.license. The license is bound to TMOS version 14.1.2. We understand that this license may only be valid for TMOS 14.1.2.x hotfix versions. The system currently has installation images for TMOS versions 15.x, 16.x, 17.x and later available. We would like clarification on the following points. Does a license bound to TMOS 14.1.2 support only version 14.1.2.x, or can it run versions above that? If the license is limited to 14.1.2.x, is reinstalling TMOS 14.1.2 on a new volume the correct recovery approach? Can an incompatible TMOS version cause the Web GUI to fail, MCP not to start correctly, and the system to remain in an INOPERATIVE state? Our goal is to restore full functionality while remaining compliant with the existing license, without performing an upgrade. Any guidance would be appreciated. Thank you. Lucas Felipe de Jesus Moura
Add all rule labels to events in F5 Rules for AWS WAF - Web exploits OWASP Rules
Hi all, We're subscribed to the "F5 Rules for AWS WAF - Web exploits OWASP Rules" rules for AWS WAF via Marketplace, and we're looking at the labels that are added to events passing through the WAF. Currently we see only a single label added to all the events, regardless of which rule triggered a match, the label is: "labels": [ { "name": "awswaf:managed:f5:web-exploits-owasp-rules:OWASP4" } ], Is there any way to also see the specific rule that triggered, for example the `ruleId`, which we can see in the logs is `rule_Union_Based_AllQueryArguments_Body`. "terminatingRule": { "ruleId": "rule_Union_Based_AllQueryArguments_Body", "action": "BLOCK", "ruleMatchDetails": null }, This would allow us to better handle false positives for specific rules, without disabling the entire thing. Does anyone have any ideas? Thanks
AWS F5_OWASP Managed Rule Blocking requests
AWS F5 OWASP managed rules are blocking requests all of a sudden (23-01-2025) We want to understand if there was any update made and also the changelog for this update and which rules were updated. Where do I find this information and AWS is not supporting these rules since these are managed by F5. Do we have a way to reach the vendor ?Profile ssl server using pass phrase
Hola, buenas Necesito actualizar un certificado publico, pero me encuentre un par de profile ssl server usando pass phrase, el escenario es que me pasaran un certificado en formato pfx con su clave de proteccion. Entonces cuando actualice el certificado en el profile ssl server, debo ingresar la clave de proteccion del pfx en el pass phrase , previamente importado ? O cuando actualice automaticamente f5 cambia el pass phrase ? No tengo mucha experiencia en f5 y es primera vez que me encuentro en este escenario Encontre este articulo pero nose si lo estoy interpretando bien: https://my.f5.com/manage/s/article/K14806 Gracias y saludos a tod@s
