DocumentationExperience Cloud KCS

AEM: Resolving Akamai WAF blocking of Operational Telemetry endpoint

Last update: August 18, 2026

This article explains how to resolve issues where Akamai Web Application Firewall (WAF) blocks requests to the Adobe Experience Manager (AEM) Operational Telemetry endpoint, causing HTTP 403 errors and temporary IP bans. The recommended solution is to enable external routing for telemetry data.

Description description

Environment

Adobe Experience Manager (AEM) as a Cloud Service, with Akamai WAF and CDN in front of AEM

Symptoms

  • Repeated HTTP 403 Forbidden errors occur when requests are made to the /.rum/100 path.
  • Akamai WAF triggers blocks for these requests, resulting in temporary IP bans for affected users.
  • Akamai generates alerts for the /.rum/100 route.
  • The issue occurs without recent platform changes.

Cause

Akamai WAF rules block requests to the AEM Operational Telemetry endpoint (/.rum/100), interpreting them as potential security threats. This results in HTTP 403 errors and temporary IP bans for users whose requests are blocked.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Enable external routing for AEM Operational Telemetry:

    • In Cloud Manager, set the environment variable AEM_OPTEL_EXTERNAL=true for your environment. This routes telemetry data through the external host instead of the default path.

    • To set the variable:

    1. Log in to Cloud Manager.
    2. Navigate to your environment’s configuration settings.
    3. Add or update the environment variable AEM_OPTEL_EXTERNAL, and set its value to true.
    4. Save and deploy the configuration changes.

  2. Clear the CDN cache after deployment to ensure the new routing takes effect.

  3. (Optional) If you can’t enable external routing immediately, you can temporarily disable AEM Operational Telemetry by setting the environment variable AEM_OPTEL_DISABLED=true in Cloud Manager. This will stop telemetry data collection and prevent further WAF blocks, but you won’t receive telemetry data during this period.

  4. Monitor Akamai alerts and verify that HTTP 403 errors and IP bans for the /.rum/100 path no longer occur.

recommendation-more-help
experience-cloud-kcs-help-kbarticles