ASM Policy in "Blocking" Mode switch to "Transparent" for some IP's

Hi Steph,

You can create exceptions based on IP addresses. Please look this: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-2-0/2.html

Cheers

Thank you,

This would be exactly what I need... but the other way around. I need to block a specific range e.g. 10.10.10.0/24 but allow all the others.

With the build-in solution, I can only "unblock" a specific range, I dont know how to unblock ALL but 10.10.10.0/24.

Are your users coming in from the global internet then, or are they coming from a specific intranet? You can still use the exclusions list, but it's more work.

Another option would be to duplicate your policy and have a transparent policy that is an exact match for your blocking policy, but is the default for the virtual server while the 10.10.10.0/24 network is sent to the blocking policy.

This would require you to be disciplined about changes, but would probably be the simplest way to handle this.

Hi Chris,

I had the idea of duplicating the policy, the discipline about syncing both policy is not an issue ;) The tools on the F5 (Policy Diff) will help a lot. The concerns are more related to the business who want "One and Same" policy for both.

You are correct, there will be the internal IP range which should be in blocking mode in the first place, and the rest of the world in transparent.

There will be 2 VS pointing to the same policy : * one internal * one for the others

Using exclusion list will make the story a bit complicated. An iRule to disable ASM would take not more than 3 lines of code... instead of a "disable ASM" I could use a command to set the policy to transparent... but I can't find anything about that.

Truthfully I'm not sure this use case occurred to the team that developed the ASM. The ASM is designed to be used in transparent, then moved to blocking. Because the transparent/blocking setting is a setting that is global for the entire policy, it can't be easily toggled on and off per connection.

ASM can be disable for certain flows very easily, as we simply pass the request to the back end servers without handing it off to bd (the ASM process). Setting ASM to transparent for certain IPs would be far less straightforward (and is likely why irules can't do it). You might be able to convince PD to whip something up to do this, but likely not without paying for the feature (an expensive proposition, but your Account team can help).

Barring that, duplicate policies will be your best option.