Forum Discussion

Jeremy_140196's avatar
Jeremy_140196
Icon for Nimbostratus rankNimbostratus
Mar 01, 2017

Always Learning for Entities ASM

Hi,

 

I would like to share a strange behavior on ASM. Even all checkbox are disabled for URL learning, learning suggestions still continue to be created.

 

For example, I don't want to have suggestions related to illegal URL ("Illegal URL" Learning Flag is disabled). Illegal URL are blocked (as expected) but suggestions appear in the "Traffic Learning" page. In details of the suggestion, related to the Illegal URL protection, only "block" and "Alarm" are tagged. In more, Wildcard URL object doesn't exist. In theory new elements cannot be learned.

 

So in Automatic learning mode, Illegal request could be added to the Policy... really annoying.

 

Same behavior with Parameters (Illegal parameter).

 

Tried on production and I have reproduced the issue on LAB : same behavior. version 12.1.0 and 12.1.1.

 

Maybe someone has already encountered this issue or I have missed something...

 

Thank you.

 

Jeremy.

 

ASM Advanced WAF
security

1 Reply

Sort By
  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Mar 02, 2017

    I haven't seen this, but I would suggest that you open a case with F5 support. If it's a misconfiguration, looking at your ASM policies should quickly allow them to diagnose that. If it's a problem in our code, that would also be the proper avenue to pursue that.