Per ip connection limit on virtual server
i want to apply per ip connection limit on a virtual server . i have AFM provisioned on the F5 . the requirement is that, example - any client IP address can open TOTAL max of 50 connections . meaning per ip connection limit on 50. How can i achieve this . Thanks
Beginner in F5 ASM
Hi All, I hope you are doing well. I am currently learning about F5 ASM to add one more technical skill to my skill set. I already have good experience with firewalls (Palo Alto and Check Point) As F5 ASM is not deployed in our environment and we use a different vendor WAF (Imperva) I wanted to know what the normal procedure is to onboard a web application on F5 in production. Which policy template do you choose (Rapid deployment, comprehensive, fundamental) Also, what is the best practice for policy building in learning mode? How are signatures enforced? After 7 days learning period, do you enforce all staging signatures learned or do some manual checks as well?
DoS Captcha Preview Not showing
Hello All, I am seeing an issue trying to preview the DoS Captcha. When I press show, a blank pop-up appears. In the dev tools I can see the following error in the console: dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1332 Uncaught TypeError: Cannot read properties of undefined (reading 'contentDocument') at show_captcha_response (dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1332:59) at HTMLInputElement.onclick (dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1720:132) dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1332 Uncaught TypeError: Cannot read properties of undefined (reading 'contentDocument') at show_captcha_response (dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1332:59) at HTMLInputElement.onclick (dos_profile_properties.php?mode=edit&profile=/Common/_ddos_policy:1720:132) Has anyone seen this issue before or know how to resolve? We are running asm version 17.5.1.3
HTTP DoS Profiles & Learning process
Hello Dear F5 Community ! I'm trying to understand better all the secrets of the HTTP DoS Profiles I created and attached to some VIPs in transparent mode. I essentially wanna see the evolution of the learning process via the following command : admd -s vs. | grep info.learning Here is an example of the output I get : vs./Common/VS_TEST_1+/Common/DoS-L7_TEST_1.info.learning:[73.685, 693, 1108896, 100] vs./Common/VS_TEST_2+/Common/DoS-L7_TEST_2.info.learning:[79.6533, 690, 6208526, 100] vs./Common/VS_TEST_3+/Common/DoS-L7_TEST_3.info.learning:[65.2094, 299, 33624, 100] vs./Common/VS_TEST_4+/Common/DoS-L7_TEST_4.info.learning:[58.057, 250, 483729, 100] vs./Common/VS_TEST_5+/Common/DoS-L7_TEST_5.info.learning:[52.8262, 678, 33330, 100] vs./Common/VS_TEST_6+/Common/DoS-L7_TEST_6.info.learning:[74.8512, 685, 288011, 100] Although the VIPs & Profiles names have been anonymized here, these are production VIPs with a lot of traffic. According to F5 docs & labs, the 1st number into the brackets represents the "baseline_learning_confidence" which is in % how confident the system is in the baseline learning. Still according to F5 docs & labs, this number should reach around 90-95% before we should feel safe about activating the blocking mode instead of transparent mode. It's been a whole week now and these "baseline_learning_confidence" numbers still oscillate between 40% and 80% (for each VS+Profile) every time I check via the "admd -s" command. So I wonder why, and if it's safe anyway to activate the blocking mode on these HTTP DoS Profile. Anyone had some similar experience with HTTP DoS profiles ? Some precisions : - an example of F5 lab about this topic : https://clouddocs.f5.com/training/community/ddos/html/class7/bados/module1.html - these are DoS profiles created from the "Security/DoS Protection/Protection Profiles" menu in v17.1.x - only the "HTTP" has been activated in these profiles "families" setting - no TPS-based settings activated, only stress-based & behavioral/bad actors settings, with "Threshold Mode" set to "Automatic" - some of the VIPs have a default pool + another pool invoked via iRule/LTP (maybe it's more difficult to establish a baseline for such traffic) but some other are more standard with only a default pool. Many thanks ! David
F5 Rules for AWS WAF - does F5 have any access to the request data inspected by the rule groups?
I'm reviewing the data handling characteristics of the F5 Rules for AWS WAF managed rule groups (purchased through AWS Marketplace) and would like to confirm my understanding with the community. K21015971 describes the procedure for reporting a suspected false positive. As I read it, the customer is asked to log the blocked HTTP requests along with the names of the rules that matched, mask any sensitive information with ****, and then submit a question with the F5 rules for AWS WAF tag and attach those requests. My reading of that procedure is that F5 has no independent access to the requests inspected by the rule groups. If F5 could see them, there would be no need for the customer to extract, mask and attach them manually. Is that reading correct? More specifically, could someone confirm whether the following are accurate? 1. HTTP request data inspected by the rule groups (source IP addresses, headers, request bodies, query strings, cookies) is never transmitted to F5. 2. AWS WAF logs, sampled requests, CloudWatch metrics, and the labels generated by rule matches remain entirely within the subscriber's own AWS account, with no access path available to F5. 3. The only information F5 receives in connection with a subscription is AWS Marketplace billing and metering data. One related question. Section 5 of the F5 End User License Agreement (Collection and Use of Product Information) notes that, depending on the product and the licensed pricing tier, a customer may be able to opt out of the collection and use of such information by configuring the product to disable those features. Is there any such configuration available for these rule groups? Or does the question simply not arise because no collection takes place for this product? Thanks in advance.
F5 XC WAF Automation for Bulk IP Prefix Blocking
I've a requirement to block more than 5,000 IP addresses in F5 Distributed Cloud (XC) WAF. Is there any supported option to automate the creation or update of IP Prefix Sets using scripts or APIs, instead of adding the prefixes manually through the UI? The goal is to automate the process of importing and maintaining the IP prefixes used for blocking traffic. Thank you.
An Irule for Client Ssl Profile that Allows Unassigned TLS Extension Values (17516)
Hello Community, I have a requirement to allow enriched https header enrichment. The SSL negotiation (I'm doing ssl termination on F5) fails because the enriched header from client contains reserved tls extension values. (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtmltls-extensiontype-values-1). The Client Hello request in the SSL Handshake was captured and contained an Extensions list, which included a reserved TLS Extension value (17156), which the F5 isn't presenting in Server Hello. I need an irule that can allow that Extension to be added on the client ssl profile so the ssl handshake doesn't fail.F5 LTM logs and application access logs
Hi, I would like to ask for guidance, as I do not have the access to test on this kind of scenario. When using LTM to route the application traffic to the application server hosted in LTM virtual server. Meaning every time the requests from client will first reach the LTM before being forwarded/routed to the respective virtual server. (In case there isn't AWAF enabled) In DFIR/SOC analyst's point of view, we would expect LTM logs would log the time slightly earlier for each requests than the access logs found in the server itself. However, if there were SQLi with payload containing "sleep", which would potentially delay the responses, how would these two different logs record the timestamp of the requests? Will the timestamps recorded in the access logs in the server itself would have delay if the payload is working?restore the BIG-IP to its previous state (where server.csr displays No CSR) without impact
Hello, I made same mistake and filled in the CSR file (server.csr) under: System > Certificate Management > Device Certificate Management > Device Certificate Signing Request Before this change, the server.csr entry already existed in the GUI and its status was: No Certificate Signing Request After I filled in the CSR parameters, I would like to restore the BIG-IP to its previous state, where server.csr appears with the message: No Certificate Signing Request I would like to remove the CSR information safely without impacting the existing configuration. I performed the following checks: tmsh list sys crypto csr tmsh list sys crypto csr one-line tmsh list sys crypto csr server.csr None of the above commands return any output. I also found that the file exists only at: /config/ssl/ssl.csr/server.csr Furthermore, searching for server.csr under /config did not show any reference to it in the BIG-IP configuration files. If not, what would be the recommended and safest procedure to remove the CSR information and restore the BIG-IP to its previous state (where server.csr displays No Certificate Signing Request) without impacting the current Device , i want to remove it from cli using this command: rm /config/ssl/ssl.csr/server.csr Thank you in advance
PQC: a blindspot (logging) on BIG-IP - RFE
On BIG-IP it's currently not possible to log information such as proposed and negotiated Key Exchange Algorithm. No available iRule commands for that. On the other hand, NGINX do offer the possible to log it ($ssl_curve/$ssl_curves variables). I've got a RFE created for the following: Provide new iRule commands in events CLIENTSSL_CLIENTHELLO and CLIENTSSL_HANDSHAKE that outputs the Key Exchange Algorithm: - list of proposed (by the SSL client) Key Exchange Algorithms in CLIENTSSL_CLIENTHELLO - negotiated Key Exchange Algorithms in CLIENTSSL_HANDSHAKE => RFE ID2347153 — "iRule command equivalent to NGINX's $ssl_curve for logging the negotiated KEM/DH group" Don't hesitate to open a support case to bind it to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀 Alexandre