F5 Access Guard Deprecated: ZTA APM
Since F5 Access Guard is deprecated and not supported on Win 11, newer browsers, and some versions of MacOS, what is the replacement for posture checking when implementing a ZeroTrust architecture using APM as an identify aware proxy? One major point of ZT is to do continuous posture checking of a client and the requests they are making--each and every one utilizing a per-request policiy. Without this component, it seems like APM is not a great candidate for use. What are others doing when using APM within their ZT network? Are they using 3rd part solutions with an HTTP connector to evaluate to client/request for each and every request?ASM Bot Defense JS and CSP
Our company has issued a requirement for all applications to enable CSP (Content Security Policy). The problem is one of the first applications to enable this has Bot Defense enabled. Part of PBD is to inject a JAVA script inline which causes an issue with the page not loading per the CSP policy. We opened a support case and F5 level II and the ENE say they can't find a way to make these compatible and this is beyond the scope of Support i.e. engage Professional Services. I'm a long-time F5 user and so this was frustrating, to say the least. Part of our CSP is our scripts have a nonce key generated. PBD script is not being delivered from our server (it's directly injected into the response), and it does not contain our nonce key. This means that the CSP will tell the browser to NOT allow the execution of that script thereby breaking the application. Part of the CSP Rules The browser should accept any JS that is delivered as a file from 'self' which means it's delivered from our web server with a relative path The browser should accept any JS that is delivered to the browser with our nonce key (value in the header) All other JS should be ignored by the browser! So, the only question that we really had for F5 is how do we make PBD JS work with a CSP? The CSP is set up in a basic way and is not customized to our application at all. It seems we either need to have this JS delivered by a file (not directly injected) or the F5 will need to pick up our nonce key and add it to that injection. Has anyone come across this and what methods did you employ to resolve it, i.e. iRule or Traffic policy to set the nonce key on the JS, which is not super ideal? Depending on when ASM/PBD fire, something similar to the following: when HTTP_RESPONSE { # Check if the response header contains a CSP if {[HTTP::header exists "Content-Security-Policy"]} { # Get the CSP header value set csp [HTTP::header value "Content-Security-Policy"] # Check if the CSP contains a nonce if {[string first "nonce-" $csp] != -1} { # Get the nonce value set nonce [string range $csp [string first "nonce-" $csp] [string first ";" $csp]] # Check if the response body contains a script tag if {[string first "<script" [HTTP::payload]] != -1} { # Add the nonce to the script tag HTTP::payload replace [string first "<script" [HTTP::payload]] [string first ">" [HTTP::payload]] "<script nonce=\"$nonce\"" } } } }
CWE-20: Improper Input Validation
Good afternoon, We've recently had a burp suite scan done on our F5 pair. This was the result: The application may be vulnerable to DOM-based DOM data manipulation. Data is read from window.location.search and passed to the 'setAttribute()' function of a DOM element. The results page from the scan included the requests and responses to and from the F5s; so I believe this is not a false positive. I am wondering if there is a fix for this through an update? Currently, we're running "BIG-IP v15.1.10.3 (Build 0.0.12)"
BIG-IP Next
Dears, I need to develop BIG-IP next, anyone can guide me, please? I tried to install BIG-IP next and Central Manager inside EVE-eg but it is not found, Can I install it in EVE? I need to start with BIG-IP LTM and ASM, there is a guide for all installation steps and all labs step by step. Thanks
Observing unexpected VLAN traffic on F5OS TMOS Tenant
I noticed running on TMOS (17.1.3) based tenant on an F5 OS (1.7) appliance (R4800) that I was receiving traffic from unattached VLAN. It was first observed while investigating something else and happened to run 'pcacp -ni 0.0' (within the TMOS Tenant shell). Confirmed the unexpected frames still held the correct VLAN TAG # (one that was not attached/assigned to this Tenant). Curious if anyone else has seen this, if this expected (that L2 traffic would be seen that does not belong to a Tenant)? Running on R4000 series appliance. Both expected VLANs and unexpected vlans are sharing the same LACP Bond (2x 10g) to the network in the F5 OS layer. I would expect this sounds like a bug, otherwise why even have the 'VLAN' assignment section in Tenant configuration. I am curious though if this may just be a side effect of the NIC driver / 'pcacp' running in a VM-on-Container environment that is F5OS w/ TMOS. Curious if anyone else has run into this. The way I read this documentation would indicate this probably shouldn't be happening: https://clouddocs.f5.com/training/community/rseries-training/html/rseries_networking.html
