F5 not sending traffic to Web pool
Hello All, I am having issues with a new configured F5 big-IP that everything works fine as follows. traffic from the client is coming to the firewall which is then natted to the private network. (works) the Load balancer ( Virtual server) IP is accessible and request is sent to the virtual server. and from the big ip to the pool is not sent. connection between the F5 to the pool is fine and vice versa and pool and nodes are available (green). connection between web-server and F5 is through Https (443). configuration F5 as follows: F5 Virtual IP : 192.168.1.41 self IP: int 1 : 10.10.10.14 self IP int 2 : 192.168.1.41 web server pool : 10.10.10.X range with class c subnet. SSL is configured between the client to F5 as clientssl and between the server and F5 as serverssl. source address translation is automap. I am having trouble why it doesn't work and is trying to find out the problem.
I want to restore disabled&down interface due to LLCF.
Interface 1.1, 1.2 was up to vlan group. I set llcf to each other on these interfaces, and when 1.1 was subtracted, the state of 1.2 was disabled. Even if I try 1.1 again, 1.1 is disabled and 1.2 is down. I want to restore it to up, up. Please tell me how
Problems connecting to vpn after upgrading to ubuntu 24.04
good afternoon, I have upgraded ubuntu to 24.04 and since then I can no longer connect correctly to the vpn with the f5 client. In the client it appears that I am connected to the vpn, but then I do not reach any of the sites and servers that with the 22.04 version if it arrived. Can you help me.Using okta as SSO to login F5 GUI
Hi All, Greetings..!! Currently we are using local user accounts in f5 to login. We have different users with different roles on f5. In our organization we are using okta for other apps authentication. Is it possible to have Okta for logging in f5 with SSO. If yes, please share the article or guide with the required configurations. Thanks in Advance, K Kuzhali
Content type hearder charset=UTF-8
Hello friends, We have a requirement to have WAF should only allow charset=UTF-8 in the Content-Type header. So curios does this cover by any rule in ASM policy or do we have to create a custom rule through iRule or other ? Basically our objective to accept only ute-8 and reject rest of any. Appreciate any inputs !!
LDAPS and renegotiation
Hello, hope everyone is well! we have a requirement to present 2 different issuer/signed certificates based on the incoming client IP. I am pretty sure from an HTTP perspective I would do something like this when CLIENT_ACCEPTED { if {([class match [IP::client_addr] eq signer_list_of_client_A_IPs]) } { SSL::profile cert_with_issuer_type_A } else { SSL::profile cert_with_issuer_type_B } } when HTTP_REQUEST { SSL::renegotiate } Question I have is whether this would work for LDAPS clients and how (if needed at all) the renegotiation step would be achieved, given that the HTTP_REQUEST will not be available. Many thanks Jon
Need help on i-rule to specific uri path
Hello All, I'm working on an i-rule that I need to do the following; given a set of specific source ip addresses, only allow access to specific uris of /ws/rest/external*. I set the specific source addresses in a data group, referencing the data group. When I apply this i-rule to the virtual server, on testing I get an Insecure HTTPS message. I am on version 15.8.1.2. We plan to upgrade to most stable release on 16 soon. Any suggestions on what I can do with the i-rule posted below? Thanks in advance. when CLIENT_ACCEPTED { if { [class match [IP::client_addr] equals Boomi_external] } { pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool } } when HTTP_REQUEST { if ![HTTP::has_responded] { if { ([HTTP::host] equals "apigway-d.lanl.gov" or [HTTP::host] equals "apigway-d.lanl.gov") } { if { [HTTP::uri] starts_with "/ws/rest/external* " || [HTTP::uri] starts_with "/ws/rest/external*" } { pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool } else { reject } return } } }
ASM - Parent policy vs OWASPcompliance
Hi folks, I am implementing a WAF in my company and I would like to work with parent and child policies. This way, if we need to add something in general, I can apply it to the parent policy and it will replicate this change to the child policies, instead of going one by one and applying it individually. However, I found out that "Parent and Child Security Policies are not supported by the OWASP Top 10 compliance dashboard." So, I would like to know what the best approach is. Is it worth going ahead with the parent and child policies and ignore the OWASP compliance dashboard? Or, in terms of security, is it better to create a normal ASM policy without parent or child relationships?
