Forum Discussion

nirsham_178691's avatar
nirsham_178691
Icon for Nimbostratus rankNimbostratus
May 05, 2015

Strange ASM block

Hi,

 

I have an application that works through UAG and publishes RDP connections through SSL (remote desktops and remote apps like Adobe reader , CLI SHELL etc.)

 

For example , when you press the link it publishes the app through RDP (if you know how JETRO works with IE then it's something like that).

 

Any way , i'm trying to protect that site with ASM . The policy is pretty generic and works on my other sites. Now this specific site , when I put it behind the ASM , the RDP publishing stops working. Each time you press the link the RDP window pops out in order for you to press "connect" and right after that I get an error message that doesn't give me anything (believe me I searched).

 

Support didn't give me anything. it looks like when I press the "connect" button the traffic is not HTTP but I think it's pure RDP so for some reason the ASM blocks it with no error messages or logs to be seen.

 

To make the issue more difficult , it happens only on Windows XP , Windows 7 works perfect (both with IE8 which is what the clients have).

 

1) has anyone , anywhere encounered such an issue ? 2) What I want to try doing is to bypass the ASM when it sees the RDP connection to the specific RDP publishing server. What iRule will help me with that ?

 

Regards,

 

Nir

 

application delivery
ASM Advanced WAF
deployment
devops
iRules
microsoft
security

2 Replies

Sort By
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    May 05, 2015

    First of all: did you follow the F5 RDP Deployment Guide?

     

    https://www.f5.com/pdf/deployment-guides/f5-microsoft-remote-desktop-services-dg.pdf

     

    Also, are you seeing this issue when the ASM policy is in Blocking mode? What happens if the policy is in Transparent mode? Anything at all in the logs (/var/log/ltm /var/log/asm)?? If ASM has blocked a request there must be something in the logs - I expect at least an "INVALID METHOD" or an "HTTP Protocol Compliance Violation" to be present (provided you have a logging profile assigned).

     

    I am not surprised Windows XP clients don't work with RDP - the legacy clients do not support the authentication levels introduced since Windows7, so if you are only having issues with legacy clients that might give you a clue that the outdated version of RDP authentication protocol used by these clients is causing this. Finding the differences and tuning the policy is non-trivial in this case.

     

    From the security point of view - do you really want to disable ASM? What was the rationale for enabling it in the first place for this service? Is the virtual server public facing? You need to protect access from certain countries/malicious IP addresses?

     

    RDP/RDWeb is not a traditional web application - it uses RDP protocol encapsulated in HTTP requests, so creating a meaningful ASM policy is not easy. It is bound to trigger lots of false positives and will require careful configuration and tuning.

     

    If you do believe that you want to keep ASM on, but bypass it for specific IP addresses then:

     

    check out this solution for bypassing ASM: https://support.f5.com/kb/en-us/solutions/public/14000/700/sol14709.html

     

    and also this DevCentral thread:

     

    https://devcentral.f5.com/questions/bypass-asm

     

    Hope this helps,

     

    Sam

     

  • nirsham_178691's avatar
    nirsham_178691
    Icon for Nimbostratus rankNimbostratus
    May 06, 2015

    Hi,

     

    I'm not trying to publish RDP through F5 . The customer already has is published via UAG. We just put an ASM in in front of it.

     

    The issue happens even when the ASM is in transparent mode . There are no alerts or logs anywhere. It looks like some kind of HTTP parsing issue with the RDP over HTTP but I don't know why it just work in Win7 and not WinXP.

     

    I thought I could bypass the ASM through HTTP_METHOD or URL but it just doesn't work.

     

    I'm trying to work with our F5 SE representative here to see if he can see what is the issue.

     

    Thanks.

     

    Regards,

     

    Nir