Forum Discussion

Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Jan 12, 2016

ASM scenario - Shared Policy for Dozens of Virtual Servers

Hello Team,   Perhaps someone has a creative solution to my problem.   Question: What would be a good way to put an ASM Security Policy to Transparent Mode (for one Virtual Server). Consider th...
ASM Advanced WAF
BIG-IP
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Jan 12, 2016

Hi Hannes,

as already sugested by Tzoori the 

[ASM::unblock]
command can be used to selectively overwrite your "Blocking Mode" policy to "Transparent Mode". The snippet below can be used as a starting point...

when ASM_REQUEST_DONE {
    if { ( [ASM::status] eq "blocked" ) and 
         ( [HTTP::host] equals "www.domain.de" ) and
        (( [IP::addr [IP::client_addr] equals 10.0.0.0/8] ) or 
         ( [IP::addr [IP::client_addr] equals 172.16.0.0/12] ) or
         ( [IP::addr [IP::client_addr] equals 192.168.0.0/16] )) } then {
        ASM::unblock
    }
}

Note: Keep in mind that have to enable the post v11.5 iRule operation mode in your ASM policy, to trigger the 

ASM_REQUEST_DONE
event.

Cheers, Kai