# \#waf **URL:** https://community.f5.com/tag/waf/311.md [Latest](https://community.f5.com/latest.md) · [Categories](https://community.f5.com/categories.md) · [Tags](https://community.f5.com/tags.md) --- ## [F5 Distributed Cloud Multi-Cloud Networking Lab - Part 2: Hybrid](https://community.f5.com/t/f5-distributed-cloud-multi-cloud-networking-lab-part-2-hybrid/77331)
**Author:** [@Martin\_Petersen](https://community.f5.com/u/Martin_Petersen)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 12:00pm UTC](https://community.f5.com/t/f5-distributed-cloud-multi-cloud-networking-lab-part-2-hybrid/77331 "2026-09-01T12:00:00Z")
Series: F5 Distributed Cloud Multi-Cloud Networking Lab Previous: Part 1: SaaS - RE-Only Architecture Next: Part 3: Multi-Site - CE-Only Architecture When Public Is Not an Option The SaaS model works well for applic… --- ## [F5 Distributed Cloud Multi-Cloud Networking Lab - Part 1: SaaS](https://community.f5.com/t/f5-distributed-cloud-multi-cloud-networking-lab-part-1-saas/77330)
**Author:** [@Martin\_Petersen](https://community.f5.com/u/Martin_Petersen)\ **Replies:** 0\ **Last updated:** [August 31, 2026, 12:00pm UTC](https://community.f5.com/t/f5-distributed-cloud-multi-cloud-networking-lab-part-1-saas/77330 "2026-08-31T12:00:00Z")
Series: F5 Distributed Cloud Multi-Cloud Networking Lab Previous: Hub - MCN Lab Overview Next: Part 2: Hybrid - RE + CE Architecture The Simplest Path to Application Delivery Every distributed cloud platform needs a… --- ## [Building a Multi-Cloud Networking Lab with F5 Distributed Cloud — A Hands-On Series](https://community.f5.com/t/building-a-multi-cloud-networking-lab-with-f5-distributed-cloud-a-hands-on-series/77329)
**Author:** [@Martin\_Petersen](https://community.f5.com/u/Martin_Petersen)\ **Replies:** 0\ **Last updated:** [August 27, 2026, 12:00pm UTC](https://community.f5.com/t/building-a-multi-cloud-networking-lab-with-f5-distributed-cloud-a-hands-on-series/77329 "2026-08-27T12:00:00Z")
Introduction Multi-Cloud Networking sounds straightforward until you try to build it. Connecting applications across regions, clouds, and on-premises environments while maintaining consistent security policies is one of … --- ## [F5 ASM remote logging format (Splunk KV pairs)](https://community.f5.com/t/f5-asm-remote-logging-format-splunk-kv-pairs/77337)
**Author:** [@lee9926](https://community.f5.com/u/lee9926)\ **Replies:** 3\ **Last updated:** [August 26, 2026, 10:27pm UTC](https://community.f5.com/t/f5-asm-remote-logging-format-splunk-kv-pairs/77337 "2026-08-26T22:27:20Z")
Hi, I had referred to F5 resource for the details about the fields found in the ASM logs (f5 AWAF). However, it seem like it doesn’t have the full details of every fields found in the logs. Do we have a full documentatio… --- ## [Why Your WAF Can't Read a Prompt Injection](https://community.f5.com/t/why-your-waf-cant-read-a-prompt-injection/77342)
**Author:** [@stmcallister](https://community.f5.com/u/stmcallister)\ **Replies:** 0\ **Last updated:** [August 25, 2026, 9:53pm UTC](https://community.f5.com/t/why-your-waf-cant-read-a-prompt-injection/77342 "2026-08-25T21:53:37Z")
You just deployed an LLM-powered API and put it behind your best Web Application Firewall (WAF). You tuned your rate limits. You applied the OWASP Core Rule Set. You feel secure. You are not. By wiring an LLM into your… --- ## [Protecting Your MCP Server From Secret Exposure With F5 BIG-IP Advanced WAF's Data Guard](https://community.f5.com/t/protecting-your-mcp-server-from-secret-exposure-with-f5-big-ip-advanced-wafs-data-guard/77227)
**Author:** [@jus](https://community.f5.com/u/jus)\ **Replies:** 0\ **Last updated:** [August 3, 2026, 12:00pm UTC](https://community.f5.com/t/protecting-your-mcp-server-from-secret-exposure-with-f5-big-ip-advanced-wafs-data-guard/77227 "2026-08-03T12:00:00Z")
The Threat of Token Mismanagement in MCP Servers Tokens and credentials serve as the backbone for authentication and authorization in MCP servers, yet their mishandling presents a significant security risk. Developers so… --- ## [Malware Protection with F5 Distributed Cloud Web App & API Protection](https://community.f5.com/t/malware-protection-with-f5-distributed-cloud-web-app-api-protection/77191)
**Author:** [@jus](https://community.f5.com/u/jus)\ **Replies:** 0\ **Last updated:** [July 29, 2026, 12:00pm UTC](https://community.f5.com/t/malware-protection-with-f5-distributed-cloud-web-app-api-protection/77191 "2026-07-29T12:00:00Z")
F5 Distributed Cloud WAAP comes with robust malware protection built with the precision and scope to address the unique challenges of safeguarding file uploads. Allowing users to upload files is a staple of web applicat… --- ## [Making WAF Monitoring Mode Powerful](https://community.f5.com/t/making-waf-monitoring-mode-powerful/77195)
**Author:** [@Preston\_Ashworth](https://community.f5.com/u/Preston_Ashworth)\ **Replies:** 1\ **Last updated:** [July 28, 2026, 6:41pm UTC](https://community.f5.com/t/making-waf-monitoring-mode-powerful/77195 "2026-07-28T18:41:38Z")
In a nutshell, the current state of the F5 Distributed Cloud WAF considers several factors before making a block/allow decision. The default configuration does the following: Operates in a monitoring mode, which logs W… --- ## [ASM allow specific url from outside country of geolocation ON](https://community.f5.com/t/asm-allow-specific-url-from-outside-country-of-geolocation-on/77019)
**Author:** [@Srj73](https://community.f5.com/u/Srj73)\ **Replies:** 2\ **Last updated:** [May 29, 2026, 10:10am UTC](https://community.f5.com/t/asm-allow-specific-url-from-outside-country-of-geolocation-on/77019 "2026-05-29T10:10:54Z")
Team, we have asm policy in blocking mode and Geolocation is ON. There is requirement that we have to allow specific url’s for the country which is blocked by geolocation. how we can do this ? --- ## [Guest Role User Lost Visibility in ASM/WAF Module – LTM Working Fine](https://community.f5.com/t/guest-role-user-lost-visibility-in-asm-waf-module-ltm-working-fine/77128)
**Author:** [@A\_hassanein](https://community.f5.com/u/A_hassanein)\ **Replies:** 3\ **Last updated:** [May 21, 2026, 8:16am UTC](https://community.f5.com/t/guest-role-user-lost-visibility-in-asm-waf-module-ltm-working-fine/77128 "2026-05-21T08:16:04Z")
Hi community, I’m troubleshooting a strange issue on our F5 BIG-IP and hoping someone has run into this before. Environment: - Module: ASM (WAF) - User Role: Guest - Partition Access: All Partitions Problem: … --- ## [AI-Enabled Risk Scoring Helps Reduce Risks](https://community.f5.com/t/ai-enabled-risk-scoring-helps-reduce-risks/77046)
**Author:** [@jus](https://community.f5.com/u/jus)\ **Replies:** 0\ **Last updated:** [May 19, 2026, 12:00pm UTC](https://community.f5.com/t/ai-enabled-risk-scoring-helps-reduce-risks/77046 "2026-05-19T12:00:00Z")
Risk Categories AI-enabled Risk Scoring for F5 Distributed Cloud WAF reduces key risk categories: Security, Business/availability, and Operational. Security risk (missed attacks / false negatives): F5 Distributed Cloud’… --- ## [Implementing Risk-Based Actions with AI-Powered WAF: Customer Policy Paths](https://community.f5.com/t/implementing-risk-based-actions-with-ai-powered-waf-customer-policy-paths/77045)
**Author:** [@jus](https://community.f5.com/u/jus)\ **Replies:** 1\ **Last updated:** [May 9, 2026, 8:37am UTC](https://community.f5.com/t/implementing-risk-based-actions-with-ai-powered-waf-customer-policy-paths/77045 "2026-05-09T08:37:19Z")
Why Custom policy is where risk-based actions matter most The default policy is straightforward: it applies a broad mix of signatures, threat campaigns, and violations; “Enhance with AI” is an optional add-on. Custom po… --- ## [Cloud Apps Protection](https://community.f5.com/t/cloud-apps-protection/77004)
**Author:** [@Stan\_Marsh](https://community.f5.com/u/Stan_Marsh)\ **Replies:** 2\ **Last updated:** [April 17, 2026, 8:43pm UTC](https://community.f5.com/t/cloud-apps-protection/77004 "2026-04-17T20:43:56Z")
Hello Everyone, I hope you’re well, I realize a deploy A F5 Big-IP. I have two doubts: Can the Big-IP on-premise solution protect external web applications hosted on AWS and Azure? Can the WAF module in Big-I… --- ## [F5 bot defense - false positives](https://community.f5.com/t/f5-bot-defense-false-positives/76998)
**Author:** [@DudleyJones](https://community.f5.com/u/DudleyJones)\ **Replies:** 3\ **Last updated:** [March 29, 2026, 12:49pm UTC](https://community.f5.com/t/f5-bot-defense-false-positives/76998 "2026-03-29T12:49:21Z")
I’m hoping someone can offer some advice. We have a Bot defense service (ex Volterra I think?) running on our WAF, and we’re getting a lot of false positives, far greater than what we’d initially expected or what I’ve se… --- ## [Need step-by-step guidance for migrating BIG-IP i2800 WAF to rSeries (UCS restore vs clean build)](https://community.f5.com/t/need-step-by-step-guidance-for-migrating-big-ip-i2800-waf-to-rseries-ucs-restore-vs-clean-build/76909)
**Author:** [@Blue\_whale](https://community.f5.com/u/Blue_whale)\ **Replies:** 3\ **Last updated:** [March 24, 2026, 10:02am UTC](https://community.f5.com/t/need-step-by-step-guidance-for-migrating-big-ip-i2800-waf-to-rseries-ucs-restore-vs-clean-build/76909 "2026-03-24T10:02:49Z")
Hello DevCentral Community, We are planning a hardware refresh migration from a legacy BIG-IP i2800 running WAF/ASM to a new rSeries platform and would like to follow F5 recommended best practices. Could you please… --- ## [Securing Applications using mTLS Supported by F5 Distributed Cloud](https://community.f5.com/t/securing-applications-using-mtls-supported-by-f5-distributed-cloud/72827)
**Author:** [@Shajiya\_Shaik](https://community.f5.com/u/Shajiya_Shaik)\ **Replies:** 1\ **Last updated:** [December 26, 2025, 9:51am UTC](https://community.f5.com/t/securing-applications-using-mtls-supported-by-f5-distributed-cloud/72827 "2025-12-26T09:51:50Z")
Introduction Mutual Transport Layer Security (mTLS) is a process that establishes encrypted and secure TLS connection between the parties and ensures both parties use X.509 digital certificates to authenticate each other… --- ## [Unblock Request WAF](https://community.f5.com/t/unblock-request-waf/76782)
**Author:** [@Stan\_Marsh](https://community.f5.com/u/Stan_Marsh)\ **Replies:** 4\ **Last updated:** [December 24, 2025, 5:09pm UTC](https://community.f5.com/t/unblock-request-waf/76782 "2025-12-24T17:09:08Z")
Hello Everyone I hope Youre well!!! I have a policy created in WAF, and I have this request URL; however, it needs to be valid, yet the WAF blocks it and flags it as a level 3 triggered violation. How can I exempt… --- ## [Advanced WAF v16.0 - Declarative API](https://community.f5.com/t/advanced-waf-v16-0-declarative-api/68686)
**Author:** [@Matt\_Dierick](https://community.f5.com/u/Matt_Dierick)\ **Replies:** 3\ **Last updated:** [November 10, 2025, 10:31am UTC](https://community.f5.com/t/advanced-waf-v16-0-declarative-api/68686 "2025-11-10T10:31:05Z")
Since v15.1 (in draft), F5® BIG-IP® Advanced WAF™ can import Declarative WAF policy in JSON format. The F5® BIG-IP® Advanced Web Application Firewall (Advanced WAF) security policies can be deployed using the declarativ… --- ## [WAF Policy upload using AS3](https://community.f5.com/t/waf-policy-upload-using-as3/76531)
**Author:** [@idcf5](https://community.f5.com/u/idcf5)\ **Replies:** 2\ **Last updated:** [September 29, 2025, 7:14pm UTC](https://community.f5.com/t/waf-policy-upload-using-as3/76531 "2025-09-29T19:14:36Z")
I am using per-app declaration to upload multiple WAF policies in an app. when I post the declaration using POST command, i only get 202 accepted, and in the backend, the F5 uploads the ASM policies. How can I get to kno… --- ## [Is it possible to select ASM BoT profile from irule?](https://community.f5.com/t/is-it-possible-to-select-asm-bot-profile-from-irule/76524)
**Author:** [@kridsana](https://community.f5.com/u/kridsana)\ **Replies:** 3\ **Last updated:** [September 15, 2025, 7:51pm UTC](https://community.f5.com/t/is-it-possible-to-select-asm-bot-profile-from-irule/76524 "2025-09-15T19:51:06Z")
Hi. . Is it possible to select BoT profile from irule? . Concept is we have different set of IP which need to allow “some” BoT type. That why we can’t use whitelist IP in BoT profile because it will allow all BoT typ… --- ## [AS3 Storage](https://community.f5.com/t/as3-storage/76520)
**Author:** [@Tausif](https://community.f5.com/u/Tausif)\ **Replies:** 3\ **Last updated:** [September 11, 2025, 2:46pm UTC](https://community.f5.com/t/as3-storage/76520 "2025-09-11T14:46:24Z")
I declared 2 WAF polices using AS3, now I deleted one using the tmsh command. In the bigip.conf I can see only 1 WAF policy, but while I do a GET api call for that App, I am still getting 2 WAF policies. It is persistent… --- ## [How to allow Request getting blocked due to Malformed JSON data](https://community.f5.com/t/how-to-allow-request-getting-blocked-due-to-malformed-json-data/76406)
**Author:** [@Jack3](https://community.f5.com/u/Jack3)\ **Replies:** 1\ **Last updated:** [August 4, 2025, 8:38pm UTC](https://community.f5.com/t/how-to-allow-request-getting-blocked-due-to-malformed-json-data/76406 "2025-08-04T20:38:14Z")
Hi Everyone, I’ve little trouble understanding how i can allow this request. Requests are getting blocked at WAF end due to “Malformed JSON data” violation (Illegal character encountered - json syntax error -" / ") C… --- ## [F5 ASM XML processing - policy name.](https://community.f5.com/t/f5-asm-xml-processing-policy-name/76344)
**Author:** [@Asura2003](https://community.f5.com/u/Asura2003)\ **Replies:** 5\ **Last updated:** [July 16, 2025, 2:10pm UTC](https://community.f5.com/t/f5-asm-xml-processing-policy-name/76344 "2025-07-16T14:10:24Z")
Hello, we have an error message in logs: ASM out of memory error: event code X89 Exceeded maximum memory assigned for XML processing we have already increased both variables total\_xml\_memory and additional\_xml\_memor… --- ## [Mitigate AI Scraping bots using F5 Distributed Cloud Web Application Firewall](https://community.f5.com/t/mitigate-ai-scraping-bots-using-f5-distributed-cloud-web-application-firewall/76264)
**Author:** [@Janibasha](https://community.f5.com/u/Janibasha)\ **Replies:** 0\ **Last updated:** [July 14, 2025, 3:00pm UTC](https://community.f5.com/t/mitigate-ai-scraping-bots-using-f5-distributed-cloud-web-application-firewall/76264 "2025-07-14T15:00:00Z")
Introduction Web scraping isn’t a new phenomenon, but the advent of AI and using scraped data to train AI models has elevated concerns associated with it. Previously, generative AI models could only use data that was bei… --- ## [About perpetual license expiry In WAF](https://community.f5.com/t/about-perpetual-license-expiry-in-waf/76299)
**Author:** [@SanYang](https://community.f5.com/u/SanYang)\ **Replies:** 1\ **Last updated:** [July 7, 2025, 2:19pm UTC](https://community.f5.com/t/about-perpetual-license-expiry-in-waf/76299 "2025-07-07T14:19:49Z")
Hi Expert, Can the Attack Signatures be updated automatically after the perpetual license expiry ? --- ## [Configuration of Pools VS LTM Policies and AWAF for Multiple Applications on Same Backend](https://community.f5.com/t/configuration-of-pools-vs-ltm-policies-and-awaf-for-multiple-applications-on-same-backend/76251)
**Author:** [@othmane\_lach](https://community.f5.com/u/othmane_lach)\ **Replies:** 1\ **Last updated:** [June 26, 2025, 5:31pm UTC](https://community.f5.com/t/configuration-of-pools-vs-ltm-policies-and-awaf-for-multiple-applications-on-same-backend/76251 "2025-06-26T17:31:45Z")
I need your assistance and confirmation regarding a critical deployment involving F5 AWAF for internal applications. We have six internal applications accessible through the following URLs:https://gtt.XXX.ma:8443/gtt/;ht… --- ## ['F5 rules for AWS WAF' ruleset not working for jsp web shell attack](https://community.f5.com/t/f5-rules-for-aws-waf-ruleset-not-working-for-jsp-web-shell-attack/75851)
**Author:** [@ajayp](https://community.f5.com/u/ajayp)\ **Replies:** 2\ **Last updated:** [May 27, 2025, 5:45pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-ruleset-not-working-for-jsp-web-shell-attack/75851 "2025-05-27T17:45:38Z")
I have subscribed to ‘F5 rules for AWS WAF’ Common Vulnerabilities & Exposures (CVE) Rules in AWS market place and protected the ALB’s. Even after enabled, I see my web server got affected by jsp web shell attack and fou… --- ## [What dose "Accept" do in BIG-IP ASM event logs](https://community.f5.com/t/what-dose-accept-do-in-big-ip-asm-event-logs/76028)
**Author:** [@Jack3](https://community.f5.com/u/Jack3)\ **Replies:** 2\ **Last updated:** [April 21, 2025, 8:12am UTC](https://community.f5.com/t/what-dose-accept-do-in-big-ip-asm-event-logs/76028 "2025-04-21T08:12:47Z")
I’m trying to understand what will happen if i click on accept in event log. Will waf simply whitelist this request ? --- ## [Mitigating OWASP Web Application Security Top 10 risks using F5 NGINX App Protect](https://community.f5.com/t/mitigating-owasp-web-application-security-top-10-risks-using-f5-nginx-app-protect/75894)
**Author:** [@Karthik\_Hadagali](https://community.f5.com/u/Karthik_Hadagali)\ **Replies:** 1\ **Last updated:** [April 16, 2025, 5:01pm UTC](https://community.f5.com/t/mitigating-owasp-web-application-security-top-10-risks-using-f5-nginx-app-protect/75894 "2025-04-16T17:01:43Z")
The OWASP Web Application Security Top 10 outlines the most critical security risks to web applications, serving as a global standard for understanding and mitigating vulnerabilities. Based on data from over 500,000 real… --- ## [SNI Sites not taking correct certificate.](https://community.f5.com/t/sni-sites-not-taking-correct-certificate/75910)
**Author:** [@Militza](https://community.f5.com/u/Militza)\ **Replies:** 8\ **Last updated:** [March 30, 2025, 2:54pm UTC](https://community.f5.com/t/sni-sites-not-taking-correct-certificate/75910 "2025-03-30T14:54:40Z")
I have configured one VIP with two certificate aks.test.com aks4.test.com On SSL profile for aks.test.com i have enabled SNI feature and aks.test.com is working fine taking correct certificate (aks.test.com). but aks… [Next page](https://community.f5.com/tag/waf/311.md?match_all_tags=true&page=1&tags%5B%5D=waf)