When you use Application Security Manager™ (ASM) to create a security policy attached to a virtual server, the BIG-IP^® system automatically creates a local traffic policy. The local traffic policy forms a logical link between the local traffic components and the application security policy.

By default, the system automatically creates a simple local traffic policy directs all HTTP traffic coming to the virtual server to the ASM™ security policy that you created. ASM examines the traffic to ensure that it meets the requirements of the security policy. If that is all you need to do, your task is done. If, however, you want more flexibility, such as applying different security policies depending on the type of traffic or disabling ASM for certain types of traffic, you can use the local traffic policy to do that.

Local traffic policies can include multiple rules. Each rule consists of a condition and one or more actions to be performed if the condition holds. So you can create a local traffic policy that works with ASM and includes multiple rules that do different things depending on the conditions you set up. In this type of traffic policy, the rules perform these actions:

• Enable ASM enforcing a specific security policy
• Disable ASM

For example, you may want a local traffic policy directed to a specific URL to enforce a security policy. As a default rule, all other traffic could disable ASM. You can also direct people using different aspects of an application (or different applications) to various security policies. Many other options are available for directing ASM traffic using local traffic policies.

If you create a security policy not attached to a virtual server, the system creates the security policy but does not create a local traffic policy. However, you will need to have a virtual server and local traffic policy to select the traffic for the security policy to enforce.

In that case, you can develop the security policy, adding the features that you want to use. Without a virtual server, the system cannot build the security policy automatically until you have traffic going through. But you can manually develop the security policy by adding entities such as file types, URLs, assigning server technologies, and so on.

When you are ready to enforce the security policy and start sending traffic through the system, create a virtual server with an http profile, and enable the security policy you created in the virtual server resources. When you save the virtual server, the system automatically creates a default local traffic policy that enforces the security policy on all traffic. You can edit the local traffic policy rules if you want more flexibility concerning how the security policies are implemented.

1. On the Main tab, click Security > Application Security > Security Policies > Policies List .
   The Policies List screen opens.
2. Click Create New Policy.
   You only see this button when no policy is selected.
3. In the Policy Name field, type a name for the policy.
4. Leave Policy Type, set to Security.
5. For Policy Template, select Fundamental.
6. For Virtual Server, click Configure new virtual server to specify where to direct application requests.
   1. For What type of protocol does your application use?, select HTTP, HTTPS, or both.
   2. In the Virtual Server Name field, type a unique name.
   3. In the HTTP Virtual Server Destination field, type the address in IPv4 (10.0.0.1) or IPv6 (2001:ed8:77b5:2:10:10:100:42/64) format, and specify the service port.
      Tip: If you want multiple IP addresses to be directed here, use the Network setting.
   4. In the HTTP Pool Member setting, specify the addresses of the back-end application servers.
   5. From the Logging Profile list, select a profile such as Log illegal requests to determine which events are logged on the system.
7. In the upper right corner, click Advanced.
   You can use default values for the Advanced settings but it's a good idea to take a look at them.
   • If you selected Fundamental or Comprehensive for the Policy Template, Learning Mode is set to Automatic and Enforcement Mode is set to Blocking.
     Tip: If you need to change these values, set application language to a value other than Auto detect.
   • If you know the Application Language, select it or use Unicode (utf-8).
   • To add specific protections (enforcing additional attack signatures) to the policy, for Server Technologies, select the technologies that apply to the back-end application servers.
   • You can configure trusted IP addresses that you want the security policy to consider safe.
8. Click Create Policy to create the security policy.

1. On the Main tab, click Local Traffic > Policies .
2. Click the name of the local traffic policy associated with the security policy.
3. To edit the policy, click Create Draft.
4. In the Draft Policies list, click the name of the draft policy.
5. In the Rules area, click Create to create a rule that defines when traffic is handled by the security policy.
6. In the Name field, type the name admin.
7. In the Match all of the following conditions area, click + and specify these conditions:
   1. For the first condition, select HTTP URI.
   2. For the second condition, select path.
   3. For the third condition, select begins with.
   4. For the fourth condition, by the field below any of, type /admin and click Add.
   This rule looks for requests with a URI that begins with /admin.
8. In Do the following when the traffic is matched, click + and specify the actions:
   1. For the first action, select Enable.
      For the second action, select asm.
   2. Next to for policy, select the security policy you created.
9. Click Save to add the rule to the local traffic policy.
   The admin rule is added to the list.
10. In the Rules area, click the rule called default.
    The default rule was added to the local traffic policy when the system created it.
    The screen displays the General Properties of the rule.
11. To change the default action for all other traffic, in the Do the following when the traffic is matched area, edit the action that is shown there.
    1. For the first action, select Disable.
    2. For the second action, select asm.
    3. To save the rule, click Save.
    The default rule now disables ASM protection for other traffic.
12. To save the updated policy, click Save Draft.
    The Policy List Page opens.
13. Select the check box next to the draft policy you edited, and click Publish.