Forum Discussion

Majda_Wazzan_18's avatar
Majda_Wazzan_18
Icon for Nimbostratus rankNimbostratus
Mar 29, 2015

Best practice for Allowed URLs

Hi,

 

  1. What is the best practice to create an Allowed URLs list for a huge website that contains blogs and uses a URL generator. The website contains more than 60,000 page?

     

  2. is it necessary to configure a list of Allowed and NOT-Allowed URLs?

     

Thanks

 

ASM Advanced WAF
security

1 Reply

Sort By
  • StephanManthey's avatar
    StephanManthey
    Icon for MVP rankMVP
    Mar 29, 2015

    Hi Majda,

    from my perspective it is best practice to use an iRule with a "

    [class match [string tolower [HTTP::path]] starts_with ]
    " condition.

    The datagroup will be of type string and contains a whitelist (allowed list) of allowed paths in lower-case format as keys (no values required).

    You will find tons of working examples here on DC.

    The "

    class
    " wiki page will be a good start.

    Please avoid using the legacy syntax of "

    matchclass
    " or "
    findclass
    " and datagroups with the "
    $::
    " prefix!

    With current TMOS versions it should not be a problem to use a datagroup of this size.

    I would recommend, to work with a so called external datagroup (stored as a separate file in the TMOS filestore, which can be easily updated).

    Thanks, Stephan

    PS: Just noticed the "Application Security Manager" (ASM) tag in your post. My response refers to standard "Local Traffic Manager" (LTM) features.