Forum Discussion

Nimbostratus

Dec 15, 2023

Solved

F5 AWAF - bypass request based on the pressence of a request header - value

Hello, We work with a service provider that need to automatically perform requests to our website. However this request has some values that triggers waf signatures. We would like to bypass those...

security

Nikoolayy1
Dec 19, 2023
The irules are the way to go. Only for HTTP headers that have an ip addresses like X-Forwarded-For / Real Client IP you can make the WAF policy to use the ip address in the header and bypass the WAF by using the trusted IP addresses option.

Overview of the Trusted X-Forwarded-For header (f5.com)

Managing IP Address Exceptions (f5.com)

bfm

Nimbostratus

Hello,

Thanks for the help. I was trying to not use irules for this. Isn't there a way to whitelist based on a header using the graphical interface?

Thank you.

Nikoolayy1

MVP

Dec 19, 2023

The irules are the way to go. Only for HTTP headers that have an ip addresses like X-Forwarded-For / Real Client IP you can make the WAF policy to use the ip address in the header and bypass the WAF by using the trusted IP addresses option.

Overview of the Trusted X-Forwarded-For header (f5.com)

Managing IP Address Exceptions (f5.com)

Forum Discussion

F5 AWAF - bypass request based on the pressence of a request header - value

Recent Discussions

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

Related Content

Logging DNS Requests

Distributed caching of authentication requests with NGINX Ingress Controller

Using Client Subnet in DNS Requests

Monitoring Failure OAuth request

HTTP Request Throttle