Forum Discussion

Bala_128530's avatar
Bala_128530
Icon for Nimbostratus rankNimbostratus
Oct 27, 2015

Does APM will support Non-Browser component

Hi,

 

I am implementing new web portal via APM , which is developed on XBAP.

 

APM validations are getting completed and some of the objects are getting response from F5/server to browser, but some of the requests are getting blocked at APM and it is not forwarding to backend server.

 

After the APM policy validation, there are some request and response. Then XML file is getting downloaded locally. This xml file is initiating connection(non-browser). i am getting blow request “Branding.xml”, this is not having user-agent and cookies.

 

APM initiate new session for this request, it’s not prompting APM login screen and getting page cannot display.

 

  1. APM policy completed
  2. Request1,2, 3... (request and response)
  3. mysite.com/DWeb/Settings/CommonImages/Branding.xml (request)
  4. mysite.com/my.policy (request)
  5. mysite.com/my.logout.php3?errorcode=19 (request)
  6. mysite.com/my.logout.php3?errorcode=19 (response)

APM LOG: (1) 3f95b406: "User-Agent header is absent or empty" < == No user agent (2) 01490544:5: 3f95b406: Received client info - Type: unknown Version: 0 Platform: unknown CPU: unknown UI Mode: Full Javascript Support: 0 ActiveX Support: 0 Plugin Support: 0 (3) 3f95b406: New session from client IP xx.x.x.xy at VIP xx.xx.xx.xx Listener (Reputation=Unknown)

 

I have tried following steps.

 

1.Cookie persistent in access profile, still application is not working.

 

2.Enable session cookie – still application is not working when HTTP_REQUEST { HTTP::header insert "clientless-mode" 1 }

 

3.No user agent and MRHSession on specific request. So forced site redirection for non-browser request, site redirection is not happening.

 

when HTTP_REQUEST { set user_agent [ACCESS::session data get "session.user.agent"] set user_cookie [HTTP::cookie value MRHSession] if { ($user_agent eq "") or ($user_cookie eq "") } { log local0. " no user agent and cookie" HTTP::respond 301 https://mysite.com/Dweb }

 

Any help or a point in the right direction would be wonderful! Thanks!

 

BIG-IP Access Policy Manager (APM)
deployment
security

4 Replies

Sort By
  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Oct 28, 2015

    Clientless-mode (if it's inserted) will cause the 302 to /my.policy to NOT occur. So if you're seeing that, then your header insert isn't working for some reason. The lack of a host header in the client request may be interfering also.

     

    Try using this command on the connection along with your header insert, and add a log statement to make sure it's executing:

     

    https://devcentral.f5.com/wiki/iRules.ACCESS__restrict_irule_events.ashx

     

    • Bala_128530's avatar
      Bala_128530
      Icon for Nimbostratus rankNimbostratus
      Oct 29, 2015
      Hi, Thanks for your update, I have tried this option. It’s keep on looping the login. 1) HTTP::redirect "/" Client 1xx.1yy.1.30:52290 -> mysite.com/DWeb/Settings/CommonImages/Branding.xml (request) Client 1xx.1yy.1.30:52291 -> mysite.com/my.policy (request) Client 1xx.1yy.1.30:52292 -> mysite.com/my.logout.php3?errorcode=19 (request) site redirected Client 1xx.1yy.1.30:52292 -> mysite.com/ (request) Client 1xx.1yy.1.30:52293 -> mysite.com/my.policy (request) Client 1xx.1yy.1.30:52294 -> mysite.com/my.logout.php3?errorcode=19 (request) site redirected << looping>> 2) I have tried specific URL, still the same result. HTTP::redirect "https://mysite.com/DWeb/Settings/CommonImages/Branding.xml mysite.com/DWeb/Settings/CommonImages/Branding.xml (request) mysite.com/my.policy (request) mysite.com/my.logout.php3?errorcode=19 (request) : site redirected mysite.com/DWeb/Settings/CommonImages/Branding.xml (request) <= looping Each redirection APM creates new session. Each session ends with “User-Agent header is absent or empty” Is there any other variable to validate user session to allow.
    • Bala_128530's avatar
      Bala_128530
      Icon for Nimbostratus rankNimbostratus
      Oct 29, 2015
      when CLIENT_ACCEPTED { ACCESS::restrict_irule_events disable } when HTTP_REQUEST { HTTP::header insert "clientless-mode" 1 if { [HTTP::uri] ends_with "/my.logout.php3?errorcode=19" }{ HTTP::redirect "https://mysite.com/DWeb/Settings/CommonImages/Branding.xml" log local0. ": site redirected" } }
    • Bala_128530's avatar
      Bala_128530
      Icon for Nimbostratus rankNimbostratus
      Oct 29, 2015
      If i use insert/replace "clientless-mode" 1 , then APM is not working Erro message : Access was denied by the access policy. This may be due to a failure to meet access policy requirements.