Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class
F5 ASM CLASSROOM • LESSON 01
Level: Beginner | Suggested study and lab time: 30 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP
Start Here / Course Guide · All lessons
Welcome to class
Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request?
A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM, is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users.
What you will learn
- Explain the purpose of a WAF in your own words.
- Identify where ASM fits in a web request's journey.
- Distinguish a violation, an attack, and a false positive.
Follow one request
Browser → BIG-IP virtual server + ASM policy → application server Browser ← allowed response or WAF blocking response ← BIG-IP
A virtual server is a BIG-IP traffic-listening configuration, not necessarily a virtual machine. It receives requests at a configured address and port. An attached security policy describes the checks ASM performs. If a request is permitted, BIG-IP can forward it to an application server. If policy enforcement blocks it, the client receives a configured response instead.
For example, /search?q=networks might be a valid book search. A request containing unexpected syntax might trigger a rule. That alert is evidence to examine, not automatic proof that a person is attacking you.
Four words you must understand
Policy: the collection of security settings for an application. Violation: a request or response failed a configured check. False positive: valid application behavior was incorrectly treated as suspicious. False negative: harmful behavior passed without the necessary detection or prevention.
A conventional network firewall often focuses on connections, addresses, and ports. A WAF adds application-layer inspection. Neither replaces secure code, authentication, authorization, patching, or monitoring. A perfectly formatted request can still access another user's order if the application has a broken authorization check.
ASM and Advanced WAF
You will encounter both ASM and BIG-IP Advanced WAF terminology. Advanced WAF builds on ASM capabilities and adds protections. Features, templates, licenses, and screen names vary by release. This course teaches shared foundations and labels advanced capabilities when availability needs checking. Do not assume that a feature shown in documentation is included in your license.
Guided exercise: explain the security boundary
- Draw a browser, BIG-IP, and a bookshop server.
- Draw the request path and the response path.
- Mark where an ASM policy examines traffic.
- Add an alternative direct path to the server. Explain why requests using that path would bypass the WAF.
Expected result: you can explain both the inspection point and the importance of controlling access to the origin server.
Knowledge check
1. Does every violation prove an attack? 2. Can a WAF correct every application authorization bug? 3. What is a false positive?
Instructor answers
1. No; compare the event with intended application behavior. 2. No; application controls remain essential. 3. A legitimate request incorrectly triggers a security decision.
Before moving on: explain what ASM does to a colleague without using the word “magic.” Next, we will read the HTTP messages it inspects.
Further reading
Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.
Comments
Post a Comment