Forum Discussion

James_Dawkins_1's avatar
James_Dawkins_1
Icon for Nimbostratus rankNimbostratus
Jan 26, 2015

ASM, System Variables, causing issues on websites

Hey guys/girls,

 

viprion 2400, 11.4.1, running ASM/LTM

 

Need some help. Basically, I am trying to get various websites behind the F5 ASM in transparent/learning mode, as a first step, and letting them run a while. But, even this is causing us issues. We have one website that sometimes displays empty image boxes upon refresh, or a tcp connection rst error on refresh or first display. When I remove the ASM policy we no longer have these issues.

 

After a little research I am thinking this may be due to the global ASM system variables, which can be found under Security -> options -> application security -> advanced configuration -> system variables. But, I am not sure which settings could be causing the issues. Does the F5 log when a system variable like this causes a connection reset? If so what logging policy does it use?

 

Right now I am not sure which variables could possibly be the culprit.

 

Thank you, James

 

ASM Advanced WAF
availability
deployment
microsoft
security

4 Replies

Sort By
  • MVA's avatar
    MVA
    Icon for Nimbostratus rankNimbostratus
    Jan 26, 2015

    Check the Security log (Security->Even Logs) for any blocks from that security policy. That would be what I check first. It should show the whats/whys of any blocks. Interesting that you don't see the standard ASM "block" page, too.

     

  • Erik_Novak's avatar
    Erik_Novak
    Icon for Employee rankEmployee
    Jan 26, 2015

    Hello James, here is a solution doc for logging TCP reset packets: https://support.f5.com/kb/en-us/solutions/public/13000/200/sol13223.html.

     

    Do you have the blocking flag enabled for web scraping by any chance? That has caused similar behavior in a few cases, and can be corrected by turning off blocking for the web scraping feature. If you do not see anything on the Event Requests screen, it means that this activity is not related to a security event--i.e., an event that occurred because it violated a rule specified in your security policy. There is also this log: System ›› Logs : Application Security which can shed some light on more ASM activity.

     

  • James_Dawkins_1's avatar
    James_Dawkins_1
    Icon for Nimbostratus rankNimbostratus
    Jan 26, 2015

    Correction. I am actually running 11.5.1.

     

    Anyway, in the under system/logs/application security I am actually seeing this: ASM bad request: event code I3652 Request has an unknown HTTP selector:

     

    Though the problem I am having started before these. Anyway, I think there are two issues going on and I have a ticket opened with F5 right now. I will follow up. Thanks for the comments.

     

  • shaggy's avatar
    shaggy
    Icon for Nimbostratus rankNimbostratus
    Jan 26, 2015

    if you are using webscraping protection, CSRF protection, or DDoS protection with client-integrity, the F5 will insert Javascript which can cause interoperability issues with some sites/pages/objects. Since these features function by inserting the client-side javascript, they will insert even in transparent mode - transparent mode prevents ASM from blocking, but not necessarily from interacting with traffic