Understanding False Positives In F5 ASM Policy And The Role Of Enforcement Readiness Period (ERP)

When used correctly, the F5 ASM “Enforcement Readiness Period” (ERP) ensures that your application doesn’t block legitimate traffic, thereby preventing false positives. This article delves into how ERP works and why it’s crucial for maintaining a secure and accessible application.

How ERP Works:

Every time you add or adjust an entity (File Type, URL, Parameter, Cookie, or Redirect), a timer starts or resets. This timer must reach the full ERP period—without further changes—before the entity is considered safe to enforce.

An entity is “Ready to Enforce” when:
No outstanding learning suggestions remain.
No changes have been made during the full ERP period.
Entity changes can happen manually or through accepting a policy learning suggestion.

Key Points about ERP:

Works in both Transparent and Blocking modes.
Live policy changes in blocking mode are safe and risk-free when used correctly.
In manual policies, an entity is only marked ready to enforce.
In automatic policies, the entity is updated automatically after ERP completion.
ERP monitoring only applies to entities in staging mode, not enforcement mode.

Choosing the Right ERP Period:

If it is too short, it won’t cover all possible requirements.
If too long, it might overlap with an app release cycle.

Example of ERP in Action:

You have a Policy in Blocking Mode and need to add the file type “CSS”.

2. The ERP is set to 7 days.

You add the file type entity “CSS”, and the ERP timer starts.
Day 5: You accept a learning suggestion to increase a property. The ERP timer resets to zero, requiring another full 7 days to pass.
Day 11: Although 11 days have passed since adding “CSS,” the ERP timer is only at 6 days (due to the reset on Day 5).
Day 13: Another learning suggestion is accepted, so the ERP timer remains at zero.
After a full 7-day period with no learning suggestions, the entity is considered stable, the ERP timer expires, and “CSS” is marked as “Ready to Enforce”.

You Should Know:

Linux Command to Monitor Network Traffic: Use `tcpdump` to capture and analyze network traffic, which can help in understanding the traffic patterns that might trigger false positives.
```
tcpdump -i eth0 -w capture.pcap
```
Windows Command to Check Network Connections: Use `netstat` to display active connections and listening ports.
```
netstat -an
```
F5 ASM CLI Command to Check ERP Status: Use the following command to check the ERP status of an entity.
```
tmsh show asm policy enforcement-readiness
```

Automating ERP Monitoring: You can use a simple shell script to monitor the ERP status and log changes.

#!/bin/bash
while true; do
tmsh show asm policy enforcement-readiness >> erp_status.log
sleep 86400 # Check every 24 hours
done

What Undercode Say:

Understanding and correctly implementing the F5 ASM ERP is crucial for minimizing false positives and ensuring the security of your applications. By leveraging the right tools and commands, you can automate and monitor the ERP process effectively, ensuring that your application remains secure without blocking legitimate traffic. Always remember to choose an ERP period that aligns with your application’s release cycle and traffic patterns to avoid unnecessary overlaps or gaps in security.

For more detailed information on F5 ASM and ERP, visit the official F5 documentation.