Forum Discussion

tuganim's avatar
tuganim
Icon for Altostratus rankAltostratus
Feb 14, 2024

"Ignore value" parameter type

Hi,

We are using BIG-IP 16.1.4.1 with the ASM module. 

When defining a parameter, one of the available Parameter Value Types is "Ignore value". The help regarding this option states the following:

Ignore value: Specifies that the system does not perform validity checks on the value of the parameter. Regarding signatures, the system does not perform parameter-based signature checks on the value of this parameter, but the system does perform all other signature checks on this parameter’s value.

What is the meaning of "the system does perform all other signature checks on this parameter’s value"?

As a check, I tried to configure a custom attack signature that looks for a string in the entire content of the request:

content:"bar";

I also configured test URL with a parameter named "payload" and configured it as "Ignore Value". I assumed that this signature would be triggered when the "bar" string appears anywhere in the request, including in the "payload" parameter. To my surprise, a request to the test URL with the parameter "payload" with the value "bar" did not trigger this attack signature.

If so, what is the meaning of "the system does perform all other signature checks on this parameter’s value"? What signatures can be triggered on parameters defined as "Ignore Value"?

 

Thanks