Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

Lesson 03: Build an Isolated F5 ASM Lab and Understand BIG-IP Traffic Flow

F5 ASM CLASSROOM • LESSON 03

Level: Beginner  |  Suggested study and lab time: 75 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

What we are building

We will use a fictional bookshop throughout the course. The lab has a test client, a licensed BIG-IP environment with ASM or the required Advanced WAF capabilities, and an application server. Keep the management interface on a restricted management network. Put the test application on an isolated network and use synthetic accounts and data.

Use a release supported for your environment and follow its installation requirements. CPU, memory, hypervisor support, licensing, and provisioning requirements depend on the chosen image. An unlicensed virtual machine is not a complete working ASM lab.

Meet the BIG-IP building blocks

  • Node: an application server's address.
  • Pool member: an address and service port, such as a test server's HTTP service.
  • Pool: the collection of members that can serve the application.
  • Health monitor: a check used to determine service availability.
  • Virtual server: the address/port clients connect to, with associated traffic settings.
  • HTTP profile: configuration that enables HTTP processing on the traffic path.
  • SSL profiles: settings for client-side and, where required, server-side TLS.
  • ASM policy: application security checks associated with the relevant virtual server or policy-selection configuration.

Plan the path before clicking

Test client → lab virtual IP → pool member → test application
Management workstation → management interface

These are different paths. Being able to sign in to the management interface does not prove application traffic reaches the virtual server. Likewise, a healthy pool does not prove a client can reach the virtual address.

Guided lab

  1. Record the BIG-IP version, provisioned modules, license capabilities, and your lab network diagram.
  2. Start a simple application with a homepage, a search endpoint, and an application health endpoint.
  3. Create its pool member and a monitor matching the application's expected response.
  4. Create the lab virtual server with the appropriate HTTP processing and pool.
  5. For HTTPS, configure a certificate trusted by your lab client and the necessary SSL profiles.
  6. Arrange return routing. Use SNAT only when the design calls for it, rather than treating it as a universal fix.
  7. Resolve books.example.test to the virtual IP using your lab DNS or a local test mapping.
  8. Load the application through that hostname and record a baseline response before adding ASM protection.

Expected result: the homepage and search work through the virtual server, the pool is available, and your diagram explains both directions of traffic. No public exposure is needed.

If it does not work

Connection timeout: check client routing, network ACLs, the virtual address, and listener port. TLS error: examine certificate name, trust, and the TLS configuration. Unavailable service: check pool selection, member reachability, and monitor results. Request leaves BIG-IP but no response returns: inspect origin routing and whether the return path traverses BIG-IP.

A monitor can fail even while a server responds to a browser if the monitor uses a different host header, path, or expected response. Make the monitor represent service health deliberately.

Knowledge check

Is an available pool proof that ASM is protecting the application?

Instructor answer

No. It proves only the availability information represented by that pool's monitoring. Verify the client path, the correct virtual server, the attached policy, and actual ASM events separately.

Lab record: save your version, topology, baseline requests, and rollback notes. They will make the next lesson much easier.

Further reading

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more