Forum Discussion

jokragly's avatar
jokragly
Icon for Nimbostratus rankNimbostratus
Feb 26, 2013

ASM slows basic website

We have a pretty basic ASM policy applied in transparent mode against a standard https website. When we apply the ASM HTTP Class the website slows to a crawl to get to the home page. If we remove the ASM HTTP Class the site opens as expected less than a second. I know it doesn't make a difference whether the ASM policy is in transparent mode or blocking mode its still processing the request its just the final outcome that is different.

 

Does anyone have any suggestions on what to look for?

 

ASM Policy includes the following.

 

RFC – Evasion technique detected, HTTP protocol compliance failed

 

Access Violations - Access from malicious IP address, Illegal HTTP status in response, Illegal meta character in parameter name, Illegal method, Illegal URL, Request length exceeds defined buffer size

 

Length Violations - Illegal cookie length, Illegal header length

 

Input Violations - Disallowed file upload content detected, Illegal meta character in value

 

Cookie Violations - Modified ASM cookie

 

Negative Security Violations - Attack signature detected

 

APM
app sec
security

3 Replies

Sort By
  • Mike_Maher's avatar
    Mike_Maher
    Icon for Nimbostratus rankNimbostratus
    Feb 26, 2013
    So I run over 20 web applications behind ASM and I don't see what you are seeing here. So let me ask you a couple more questions.

     

     

    What version are you running?

     

     

    What does your resource provisioning look like?

     

     

    What type of Virtual Server is this?

     

     

    When you remove the HTTP Class do you keep or remove the http protocol profile on the Virtual Server?

     

     

    Do you have a client SSL profile applied to the Virtual Server?

     

     

    Are there any iRules attached to the Virtual Server?

     

     

    From an ASM standpoint

     

    Do you have IP Intelligence licensed and turned on in the policy?

     

     

    Have you tried going in and disabling various protection you think may be the problem and retesting? I would do it one a at time

     

     

    Mike
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Feb 26, 2013
    jokragly,

     

     

    Just some thoughts, suggestions:

     

     

    Anything in /var/log/asm or /var/log/ltm that might give some clues? Have you tried running httpfox/ httpwatch from a client? What about a tcpdump capturing both on the client and server side of the connection?

     

    Are you terminating the SSL connection on the f5 and/or re-encrypting to the backend server?

     

    Is this the only HTTP Class / ASM enabled VS? Do the others work ok?

     

    What about if you run the "top" command whilst the HTTP Class is enabled? I think the "bd" process is the one to bear in mind with ASM.

     

     

    Rgds

     

    N
  • jokragly's avatar
    jokragly
    Icon for Nimbostratus rankNimbostratus
    Feb 26, 2013
    I feel bad posting this as I should have known better to try this before hand but Mike, thanks for the suggestion.

     

    The Illegal URL Violation was causing this issue. I had to accept the homepage as a trusted URL. The hit count was several hundred, I also cleared this.

     

     

    We are running ASM on several other VIPs without any issues, this was just unique.

     

     

    Thanks again!