Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

Lesson 15: ASM Backups, High Availability, Synchronization and Recovery

F5 ASM CLASSROOM • LESSON 15

Level: Advanced  |  Suggested study and lab time: 75 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

Availability and consistency are different

Two BIG-IP devices do not automatically provide identical application protection. High availability involves traffic ownership and failover. Configuration synchronization involves distributing configuration. Application-security policy synchronization has its own documented requirements. Verify all three rather than treating an “in sync” indicator as the whole design.

Understand your recovery artifacts

A policy export preserves a security-policy representation. A platform backup covers a wider configuration scope. Neither should be treated as a complete substitute for the other without checking what it contains. Certificates, dependencies, custom signatures, license constraints, and version compatibility can affect restoration.

F5 supports different policy export formats depending on the release and workflow. Compact exports may omit details such as staging state. Exported signature sets and the actual custom signature definitions are not always the same thing. Review the selected format and dependencies before relying on an export.

Plan synchronization

Document the device group, trust relationships, supported version combination, source of truth, and synchronization direction. Confirm ASM is appropriately provisioned and synchronization enabled where required. Avoid simultaneous conflicting edits on multiple devices. Never use a synchronization action to guess which copy is authoritative.

Guided lab

  1. Export the bookshop policy and label it with version, date, application release, and purpose.
  2. Record its dependencies, including any custom signatures and related logging configuration.
  3. Import into a separate test policy or recovery environment using a supported path. Do not overwrite the working policy as your first restoration attempt.
  4. Compare settings, staging state, signature availability, and associations.
  5. Attach the recovered policy to a lab traffic configuration and rerun representative valid and invalid requests.
  6. If you have a supported HA lab, verify synchronization before a controlled failover.
  7. After failover, confirm traffic reaches the new active device, the intended policy is selected, enforcement works, and events reach the expected destination.

Expected result: the recovered configuration behaves as intended under test. A successful file import is an intermediate result, not proof of successful recovery.

What failover testing should answer

  • Does the application remain available within the agreed expectations?
  • Which existing connections or sessions may be affected?
  • Is the same intended security behavior present on the peer?
  • Can operations identify the active traffic owner and find its events?
  • Is the fallback path documented if the peer behaves differently?

Common mistake

Failover, configuration synchronization, and connection/session mirroring are distinct features. Do not promise seamless preservation of every session simply because two devices form an HA pair. Test the actual deployment and consult the supported behavior for the release.

Knowledge check

Your backup imports successfully. What must happen before you declare recovery complete?

Instructor answer

Validate dependencies, effective policy state and associations, legitimate workflows, intended negative tests, logging, and the required operational behavior. Recovery is demonstrated by service and protection, not by an import message alone.

Further reading

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more