F5 ASM Blocking Legit Traffic: tmsh show asm policy When Support Uploads Fail

F5 BIG-IP · Techclick CLI troubleshooting lab

Support cannot upload a 20 MB log zip. ASM block log shows violation. App has no file-size limit.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on F5 BIG-IP for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

ASM request limits and file-upload violations fire before the app. Exception the parameter or raise the limit on that URL.

Why this ticket shows up

WAF limits are independent of the application. A new upload feature often forgets ASM.

Symptoms operators actually see

• ASM block page

• Violation: request length / file type

• Works when ASM is transparent

• New upload URL

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh show asm policy policy-web
tmsh list asm policy policy-web
tail -50 /var/log/asm
tmsh show asm request-log

How to read that output

The block log names the violation and the URL. That is the exception or the limit to change.

Triage order

1. Read the last ASM block

2. Note violation and URL

3. Learn the request or add an exception

4. Apply the policy

5. Retest the upload

Classic traps

What you see	Real cause	Fix
Disable ASM	One URL is new	Learn/exception
Raise global max to 1 GB	Only support needs 20 MB	Scope the URL
Blame the app	Transparent mode works	It is ASM

Proof the ticket is closed

• Upload succeeds in blocking mode

• ASM still on

• Violation gone for that URL

Say this in an interview

If transparent works and blocking fails, I treat it as ASM, not the application.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/