CirrostratusFolks
I have requirement to enable bot detection in F5 ASM policy for my application access via only mobile browsers or PC browsers not through mobile app, how i can avoid false positive here which detect by ASM. I understand that f5 inject java script in order to verify client integrity, what is the best practice here to achieve my goal.
any input appreciated.
NimbostratusErkkiS, won't this defeat only primitive bots?
CirrocumulusYou need to have 2 separate ASM policies - one for browsers and a separate one for the smartphone app. The browser policy will have full bot detection features enabled and the smartphone app policy will have JavaScript-requiring options in bot/anomaly detection switched off and relying more on IP-based anomaly detection features of ASM.
I assume you already have a separate Virtual Server for the mobile app, but if not then you can easily route the incoming traffic to two different ASM policies depending on the User-Agent header using Local Traffic Policy.
Hope this helps,
Sam