Security: Access Policy Manager, AFM, and Application Security Concepts
Domain 7 - Security: Access Policy Manager, AFM, and Application Security Concepts
This domain tests the division of labor between APM for access, AFM for network and DoS protection, and ASM for web application security.
APM
APM controls who gets to an application. An access profile contains a visual policy with start and end, authentication, authorization, and SSO actions. Per-request policies apply to individual requests after access. APM supports MFA, SAML, OAuth, client certificate authentication, and SSO to backend applications. It is not a WAF and does not parse SQL injection.
AFM
AFM provides network-layer protection: firewall rules, global and self-IP rules, DoS protection, IP intelligence, and geolocation. Rules match source, destination, protocol, port, and context. AFM can block flows before LTM processes them.
ASM
ASM protects web applications with a security policy: attack signatures, violations, parameter checks, positive security, XML and JSON profiles, and bot defense. ASM inspects HTTP after decryption, so it needs client SSL termination or re-encryption. A security policy is not the same as an APM access policy. Learning can tune the policy, but learning is not the same as enforcement.
Worked example
A request from 203.0.113.77 to https://app.example.com/login arrives. AFM checks a network firewall rule allowing 443 from the internet; the packet passes. The virtual server terminates TLS with a client SSL profile. APM's access profile challenges the user for MFA before the request reaches the pool. ASM then inspects the POST body for a SQL injection signature and raises a violation. Each module acts at a different layer; disabling one does not replace the others.
Traps
- Expecting ASM to inspect pass-through TLS; it cannot see cleartext without termination.
- Confusing an APM access policy with an ASM security policy.
- Assuming AFM firewall rules can match an HTTP URI; that is ASM or LTM territory.
- Forgetting that APM SSO and per-request policies are separate constructs.
- Treating DoS protection as equivalent to a WAF signature.
- Assuming ASM learning automatically blocks attacks without enforcement settings.