Lesson 17: F5 ASM Capstone — Protect, Tune, Troubleshoot and Recover
F5 ASM CLASSROOM • LESSON 17
Level: Advanced practical assessment | Suggested study and lab time: 120 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP
Start Here / Course Guide · All lessons
Your final assignment
You are responsible for a fictional bookshop application. It supports browsing, search, login, a cart, and a JSON order API. Demonstrate that you can build and operate an understandable ASM policy while preserving legitimate behavior. This assessment measures applied reasoning; reading the series alone does not establish production mastery.
Prepare your evidence pack
Include the application input contract, network diagram, BIG-IP version and licensed capabilities, policy settings, sanitized events, regression results, and recovery procedure. Use synthetic users and data. Every result should identify the policy revision tested.
Task 1: prove the path
Show a valid request reaching the virtual server and application through the intended route. Explain the TLS inspection point, pool selection, and policy association. Demonstrate why the test did not bypass BIG-IP by reaching the origin directly.
Task 2: describe the application
Document at least five endpoints with their intended methods and inputs. Define an appropriate quantity constraint for the order API and a separate search-input requirement. Explain the scope of every wildcard and exception you use.
Task 3: build and observe
Create the policy, generate representative valid journeys, and review learning evidence. Explain one suggestion you accept and one you reject or defer. Demonstrate a deterministic violation in observation and then controlled enforcement in the lab.
Task 4: tune a legitimate edge case
Introduce a valid punctuation case that conflicts with an intentionally restrictive lab parameter rule. Find the event, identify the exact check, and implement a narrow correction. Demonstrate both the restored valid case and a negative case that remains controlled.
Task 5: troubleshoot an ambiguous failure
Have a partner generate an application-originated error or request to a different policy path. Investigate it without assuming ASM caused it. Use timestamps, policy identity, Support ID where available, and backend evidence to explain the result.
Task 6: recover
Export the policy and record dependencies. Import into a separate recovery policy, verify settings, and rerun core tests. If you have a supported HA lab, add a controlled failover and verify policy behavior on the new traffic owner.
Assessment rubric
| Area | Evidence required | Points |
|---|---|---|
| Traffic and TLS | Correct path and inspection explanation | 15 |
| Application model | Documented endpoints and scoped constraints | 20 |
| Learning and enforcement | Reasoned suggestions and explained decisions | 20 |
| Tuning | Valid behavior restored; negative controls preserved | 20 |
| Troubleshooting | Evidence-based attribution | 15 |
| Recovery | Restored and retested policy | 10 |
Suggested classroom target: 80/100, with no unexplained broad exception or untested recovery procedure. This is a learning rubric, not an F5 certification or endorsement.
Instructor debrief
Explain your most important tradeoff, one limitation you could not eliminate, and what you would monitor after deployment. A strong engineer can state what the evidence proves and what remains uncertain.
Where to go next
Continue with release-specific deep dives into XML security, file-upload controls, WebSocket handling, Data Guard, threat campaigns, bot profiles, application DoS, custom signatures, and supported automation. Repeat the assessment after an application release or platform upgrade. Mastery grows through maintained labs, supervised operational experience, and careful investigation.
Further reading
Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.
Comments
Post a Comment