I85PREP
⌘ K
F5-304 study materials
F5-304 study resources

F5-304: Security and Access Policy Enforcement

F5-304 · Work through your exam, one topic at a time.

All guide sections

Security and Access Policy Enforcement

Security and Access Policy Enforcement

This domain covers BIG-IP security enforcement: ASM web application firewall policies and APM access policies. Questions test enforcement modes, positive versus negative security, signature staging, authentication, authorization, and SSO.

Core rules

  • ASM attaches a security policy to a virtual server. In Transparent mode the policy logs and raises alarms but does not block. In Blocking mode it can block requests that violate the policy. A policy that is not attached to the virtual server enforces nothing.
  • Positive security defines what is allowed: URLs, parameter names and types, file types, HTTP methods, and content lengths. Negative security defines what is denied: attack signatures, IP reputation, bot signatures, and DoS protections. Strong policies use both.
  • Learning builds suggestions from traffic. Automatic policy building can add URLs and parameters; signature staging lets a new signature observe traffic before it blocks. Wildcard parameters are convenient but weaken validation because any value is accepted.
  • APM access policies are built in the Visual Policy Editor and attached to a virtual server. Typical items include Logon Page, Authentication (LDAP, RADIUS, SAML, OAuth), AD group query, Decision/Branch, SSO Credential Mapping, ACL, Endpoint Security, Macro, and Ending. Session variables carry authentication and authorization data.
  • Authentication proves identity; authorization decides access. An LDAP logon does not automatically restrict a user to a group; add a group query and a decision branch. SSO credential mapping lets APM log the user in to back-end applications.
  • ASM sees traffic after SSL termination; if BIG-IP decrypts, the WAF inspects HTTP. X-Forwarded-For handling matters when another proxy sits in front.

Worked example

An internal portal needs LDAP authentication plus a one-time password, access limited to CN=PortalUsers, and SQL injection blocking without breaking a new API endpoint. Reasoning: build APM policy: Logon Page, LDAP Auth, OTP verification, AD group query for CN=PortalUsers, Decision (member: continue; not member: deny), SSO Credential Mapping, ACL, Ending. Put the ASM policy in Blocking mode with the SQL injection signature set active. For the new API, use learning and staging, or a URL-specific parameter policy; do not disable SQL injection globally. Transparent mode would only log attacks, not stop them.

Traps

Leaving ASM in Transparent mode and claiming protection; using a wildcard parameter for a sensitive field; blocking on a signature that is still staged; forgetting the group authorization step after LDAP; confusing an ACL item with an iRule; letting APM session timeout expire before the application session; and attaching the ASM policy to the wrong virtual server.