Hi, I'm trying to let websockets (ws://) connections run through ASM, the backend application is based on socket.io/nodejs. It seems that connections are falling back to xhr-polling which means that websocket couldn't initialize a connection properly. Does anybody have experience with websockets on ASM? Regards, Jo

Hi Jo, I don't think ASM can do much with web sockets. Aaron

Hello, Have you find any solution for this? I am facing the same Issue! Web Socket application works well over LTM, but does not work when ASM Security Policy is assigned on the virtual Server Thanks Regards, Georges

Please disregard my previous post. Answer-editing is extremely buggy in DevCentral. I've written an iRule for disabling ASM & HTTP on websocket request. Please give it a try. when HTTP_REQUEST { if { [string tolower [HTTP::header value Upgrade]] equals "websocket" } { HTTP::disable ASM::disable log local0. "[IP::client_addr] - Connection upgraded to websocket protocol. Disabling ASM-checks and HTTP protocol. Traffic is treated as L4 TCP stream." } else { HTTP::enable ASM::enable log local0. "[IP::client_addr] - Regular HTTP request. ASM-checks and HTTP protocol enabled. Traffic is deep-inspected at L7." } }

Big-IP ASM and websockets

31 Replies

Jo_97199
Nimbostratus
Jun 15, 2015
Hi Which version are you running. With 11.6 the workaround is obsolet as websockets are supported.

Regards, Joris
Jorjjj_118094
Nimbostratus
Jun 15, 2015
Hello,

I am using v11.6.0, VMware Virtual Edition

Is there any thing specific to configure to enable the WebSocket support over ASM?

Regards,

Georges
- Hannes_Rapp
  Nimbostratus
  Jun 15, 2015
  You will still need to use the workaround. Websockets support only covers LTM. Depending on what other iRules you use, the HTTP::disable and HTTP::enable functions might be eligible for removal (you'll have to test it for yourself). The ASM::disable & ASM::enable MyPolicyName are still required, and so is the iRule workaround. You can also use an LTM Policy (Local Traffic > Policy) for the purpose.
- Jorjjj_118094
  Nimbostratus
  Jun 15, 2015
  Hello It worked well with the iRule! What is the difference between using iRule & LTM Policies in my Use Case?
- Hannes_Rapp
  Nimbostratus
  Jun 15, 2015
  LTM Policy is visually appealing and easier to understand, typically preferred by "jack-of-all-trades" network admins. Deeply specialized F5 engineers prefer to use iRules because they can be used to solve problems where LTM Policy is lacking in functionality. You can also use a combination of both, no ultimate right or wrong here - do what makes the most sense to you.
Jorjjj
Nimbostratus
Jun 15, 2015
Hello,

I am using v11.6.0, VMware Virtual Edition

Is there any thing specific to configure to enable the WebSocket support over ASM?

Regards,

Georges
- Hannes_Rapp
  Nimbostratus
  Jun 15, 2015
  You will still need to use the workaround. Websockets support only covers LTM. Depending on what other iRules you use, the HTTP::disable and HTTP::enable functions might be eligible for removal (you'll have to test it for yourself). The ASM::disable & ASM::enable MyPolicyName are still required, and so is the iRule workaround. You can also use an LTM Policy (Local Traffic > Policy) for the purpose.
- Jorjjj
  Nimbostratus
  Jun 15, 2015
  Hello It worked well with the iRule! What is the difference between using iRule & LTM Policies in my Use Case?
- Hannes_Rapp
  Nimbostratus
  Jun 15, 2015
  LTM Policy is visually appealing and easier to understand, typically preferred by "jack-of-all-trades" network admins. Deeply specialized F5 engineers prefer to use iRules because they can be used to solve problems where LTM Policy is lacking in functionality. You can also use a combination of both, no ultimate right or wrong here - do what makes the most sense to you.
Jo_97199
Nimbostratus
Jun 15, 2015
we have a VIPs for LTM and an ASM http profile assigned, working without any workaround in the irules. 11.6 HF4
- Jorjjj
  Nimbostratus
  Jun 15, 2015
  Hello Jo, Do you have an Application with WEB Socket traffic?
Jo_97199
Nimbostratus
Jun 15, 2015
yes, we have one but you were right. I double-checked it and my notes and as those VIP only host the websockets, we disabled the http profile there. That's the reason the irules are not enabled any more. sorry :(
- Jorjjj
  Nimbostratus
  Jun 15, 2015
  No Worries!! :D Glad I help ya Somehow, hehehe Have a nice Day...
- boneyard
  MVP
  Jun 15, 2015
  if you disable the HTTP profile, does ASM then still function?
- Jo_97199
  Nimbostratus
  Jun 15, 2015
  no, asm will be disabled as well.

Forum Discussion

Big-IP ASM and websockets

31 Replies

Recent Discussions

Disk space full - what files, folders are safe to delete?

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

Related Content

What is BIG-IP Next?

Getting Started with BIG-IP Next: Fundamentals

BIG-IP Report

Mitigating JSON-based SQL injection with BIG-IP ASM / Advanced WAF Attack Signatures

Re: Get Started with BIG-IP Virtual Edition (VE), BIG-IQ VE or BIG-IP Cloud Edition Trial