Lesson 04: Create and Attach Your First F5 ASM Security Policy

F5 ASM CLASSROOM • LESSON 04

Level: Beginner  |  Suggested study and lab time: 60 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

---

Our starting point

The lab application already works through BIG-IP. Today we will add a security policy and prove that the correct traffic reaches it. Do not troubleshoot a new traffic path and a new WAF policy at the same time; preserve the working baseline from Lesson 03.

Understand the decisions

A policy template supplies initial settings. It is a starting point, not a finished description of your application. Select a template appropriate to the lab, record its name, and inspect its actual defaults. Templates may start in different enforcement and learning modes, and defaults change across versions.

Server technologies identify technologies used by the application and can influence relevant signature selection. Select technologies based on an application inventory, not guesses. More checks do not automatically mean better protection if they introduce noise you cannot investigate.

Guided lab

1. Export or record the current lab configuration so that you can restore the baseline.
2. Open the security-policy creation area. A common navigation path is Security → Application Security → Security Policies; verify it against your version.
3. Create a policy named lab_books_asm. Use the correct application encoding and select an appropriate template.
4. Inspect the proposed learning mode, enforcement mode, signature sets, and staging settings before completing creation.
5. For this introductory exercise, explicitly select Transparent enforcement and Manual learning where supported. We want to review changes deliberately. Do not assume the wizard selected these settings for you.
6. Associate the policy with the bookshop virtual server using your release's policy-assignment controls. Check any local traffic policy that selects security policies.
7. Save the settings and use Apply Policy when required to activate policy edits.
8. Assign an application-security logging profile to the virtual server. In the isolated lab, choose logging sufficient to observe your test requests.
9. Send the same valid homepage and search requests used for the baseline.

Expected result: the application still behaves correctly, the intended virtual server selects lab_books_asm, and the relevant events identify that policy. Capture a sanitized screenshot or worksheet entry proving the association.

Prove inspection, not just connectivity

Temporarily configure a deterministic lab check, such as disallowing a harmless test-only URL that exists on the application, with the relevant Alarm setting enabled. Request that URL. In Transparent mode the policy should report the violation without enforcing an ASM block for that policy check. Other controls could still reject a request, so correlate with the event.

Return that test setting to the intended baseline after recording the result. A normal page load alone cannot demonstrate that ASM inspected the request: a misconfigured or unattached policy could also allow it.

Common mistakes

• Editing a similarly named policy while a different policy is attached to the virtual server.
• Saving an edit without applying the policy.
• Testing the origin server directly rather than the virtual IP.
• Expecting request records without the necessary logging profile and filters.

Knowledge check

What evidence would you show an instructor to prove a policy is active?

Instructor answer

Show the virtual-server/policy association, the effective applied policy state, and a controlled request with a corresponding event under that policy. Connectivity alone is insufficient.

---

Further reading

• F5 documentation: creating a simple security policy
• F5 documentation: logging application security events

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →