Lab 1.1: Allowed URL List

Task 1 - Create a Security Policy and Enable Logging

  1. Browse to the BIGIP management console by opening FireFox and clicking on the bigip01 shortcut.

  2. Login with the credentials username: f5student and the password: password.

  3. Create a new ASM policy by navigating to Security -> Application Security -> Security Policies.

  4. Click Create New Policy and fill in the page as follows, using lab1 as the name, then click Create Policy.

    Note

    If you find the images difficult to read, you can click on them to zoom in.

    lab1-1

  5. Navigate to Local Traffic -> Virtual Servers and select the “asm_vs” virtual server.

  6. Click the Security tab and select policies to view Policy settings.

    lab1-update

  7. Enable “Log Profile” then add the “Log All Requests” profile as shown below, and click Update.

    lab1-2

  8. Finally, lets configure this ASM policy to Alarm on “Illegal URLs”. Navigate to Security -> Application Security -> Security Policies.

  9. Click “View Learning and Blocking Settings”.

    lab1-update2

  10. Expand the “URLs” dropdown and check Alarm for “Illegal URL”.

  11. Click Save and then click Apply Policy.

    lab1-6

Task 2 - Examine the Allowed URLs list

  1. Open a new firefox tab and login to http://10.1.10.145/WebGoat (credentials are f5student / password).

  2. Explore around the app. Notice as you click between (for instance) Injection Flaws and Authentication Flaws that the URL changes to correspond to the page. We can use this information to build our ASM policy.

  3. Return to the BIG-IP UI and navigate to Security -> Application Security -> URLs -> Allowed URLs .

  4. Our WAF is currently set to allow any URL as represented by the wildcard entries.

    lab1-3

  5. We can verify the WAF is seeing the traffic by navigating to Security -> Event Logs -> Application -> Requests and inspecting the entries.

    lab1-4

  6. Don’t forget to clear the “Illegal Requests” filter, so that legal requests will be displayed!

    lab1-5

Task 3 - Modify the Allowed URLs List

  1. Return to the Allowed URLs list.

  2. Delete the HTTP and HTTPS Wildcard entries.

    lab1-7

  3. Click the Apply Policy button.

  4. Attempt to browse the test site http://10.1.10.145/WebGoat , what are your results?

  5. We are still able to browse because our policy is not configured to block for Illegal URLs. Return to the “View Learning and Blocking Settings” page.

    lab1-update2

  6. Check the Block box for Illegal URLs. Click Save followed by Apply Policy.

    lab1-update3

  7. Attempt to browse the test site http://10.1.10.145/WebGoat , what are your results?

  8. Return to the Allowed HTTP URLs and add an Allowed URL. Click the Create button and create an allowed URL with the following settings:

    lab1-8

  9. Click Apply Policy.

  10. Test site again, are you able to browse?

Task 4 - Create Explicit Allowed URLs with Manual Traffic Learning

  1. Now that we’ve seen how wildcard URLs work, let’s get the site to work with explicit URLs.

  2. Delete the Wildcard URL /WebGoat/* .

  3. Click Apply Policy.

  4. Due to the number of URLs actually involved in making our application work, we’ll see if we can use manual traffic learning to make the Login page render properly.

    Note

    It is much easier to use the automatic policy builder or manaul traffic learning starting with wildcard URL entries. We’re doing it this way so that you’ll get a better understanding of how ASM works under the hood.

  5. Return to the learning and blocking settings page once more and configure ASM to always learn URLs:

    lab1-4-1

  6. Click save then Apply Policy.

  7. Now, attempt to load the login screen again (http://10.1.10.145/WebGoat/login) then return to the Requests log at Security -> Event Logs -> Application -> Requests.

  8. Find the entry for the login page and click Accept Request.

    lab1-4-2

  9. Return to Security -> Application Security -> URLs -> Allowed URLs. | There should now be an explicit entry for /WebGoat/login.

  10. Select the entry and click Enforce, then OK, then click Apply Policy followed by OK

    lab1-4-3

  11. Try to load http://10.1.10.145/WebGoat/login again. It should now partially load but will not look correct. This is because the application is actually comprised of many other URLs that are not in our list.

  12. Repeat these steps a few times and see if you can get the login page to load fully. Note that you can accept multiple requests at once before returning to the URLs dialog and new requests in the Requests log should be bolded…making it easier to find the issue.

Task 6 - Lab Cleanup

  1. Let’s cleanup and prepare for the next module by deleting the lab1 policy we’ve been using.
  2. Navigate to Security -> Application Security -> Security Policies.
  3. Select lab1 and click Delete.
Previous Next