Manual Chapter : Configuring server side access to disallowed host violation

Applies To:

  • BIG-IP ASM

    16.1.2, 16.1.1, 16.1.0

Updated Date: 07/07/2026

Configuring server side access to disallowed host violation

  1. On the Main tab, click Security > Application Security > Policy Building > Learning and Blocking Settings.

  2. Expand Parameters.

  3. Check Alarm and Block fields for the Server-side access to disallowed host violation.

  4. Click Save and then Apply Policy.

The violation is configured. If user sends any of the disallowed domain name or IP address configured in SSRF host list, then the ASM will block the request and sends server-side access to disallowed host violation.

Note: If Is IP address field is unchecked and IP address as URI parameter is received, then Illegal parameter data type violation is raised.

The following is an example:

Configured Disallowed Hosts:
                          a.com
                          *b.com
                          100.20.10.1
                          200.10.0.0/16
                          2001:0000:3238:DFE1:63:0000:0000:FEFB
   For the above configured host list the following requests will be blocked and raise "Server-side access to disallowed host" violation.
             http://<VS>/index.html?uriParam=a.com                             (Is IP Address should be disabled)
             http://<VS>/index.html?uriParam=http://a.b.com/              (Is IP Address should be disabled)
             http://<VS>/index.html?uriParam=http://100.20.10.1          (Is IP Address should be enabled)
             http://<VS>/index.html?uriParam=http://200.10.201.255    (Is IP Address should be enabled)
             http://<VS>/index.html?uriParam=http://[2001:0000:3238:DFE1:63:0000:0000:FEFB]   (Is IP Address should be enabled)