• Web Application Firewall

waf
  1. Help Center
  2. Web Application Firewall
  3. User Guide
  4. Rule Configurations
  5. Configuring Precise Protection Rules

Configuring Precise Protection Rules

This section describes how to configure precise protection rules.

With these rules, WAF allows you to customize combinations of HTTP headers, cookies, URLs, request parameters, and IP addresses, improving defense accuracy.

Prerequisites

  • Login credentials have been obtained.
  • The domain name to be protected has been created.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Choose Security > Web Application Firewall. In the navigation pane, choose Domains. The Domains page is displayed (see Figure 1).

    Figure 1 Domains page

  4. In the Operation column of the row containing the target domain name, click Configure Policy. The protection configuration page is displayed, as shown in Figure 2.

    Figure 2 Protection configuration page

  5. In the Precise Protection configuration area, change Status as needed and then click Save in the upper right corner of the Protection Status list. In the dialog box displayed, click Yes to save the settings. Otherwise, click Cancel. See Figure 3.

    Figure 3 Precise Protection configuration area

  6. Click Customize Rule. On the displayed page, set Detection Mode. See Figure 4.

    NOTE:

    If you do not click Save after changing Status in step 5, the Warning dialog box is displayed when you click Customize Rule.

    • Click Yes to cancel the previous settings.
    • Click No and then Save to save the settings.
    Two detection modes are available:
    • Instant Detection immediately ends threat detection after blocking a request that meets Precise Protection specified conditions.
    • Full Detection finishes all threat detections before blocking requests that meet Precise Protection specified conditions.
    Figure 4 Setting Detection Mode

  7. In the upper left corner of the Precise Protection page, click Add Rule. See Figure 5.

    Figure 5 Clicking Add Rule

  8. In the displayed dialog box shown in Figure 6, specify the parameters by referring to Table 1.

    Figure 6 Adding a precise protection rule
    Table 1 Rule parameters

    Parameter

    Description

    Example Value

    Rule Name

    Customizable rule name

    test-gz1

    Protective Action

    Its value is Block or Allow. The default value is Block.

    Block

    Effective Since

    Select Immediately or select Customize to set a period. This period can only be a time segment in the future.

    Immediately

    Condition List

    Click Add to add conditions. You must add one to thirty conditions to a protection rule. If more than one condition is added, all the conditions must be met simultaneously for the rule to take effect.
    • Field
    • Subfield: Configure this field only when Params, Cookie, or Header is selected.
      NOTICE:

      The length of a subfield cannot exceed 2048 bytes. Only digits, letters, underscores (_), and hyphens (-) are allowed.

    • Logic: Select the desired logical relationship from the drop-down list.
    • Content: Enter or select the content of condition matching.
    NOTE:

    For detailed configurations, see Table 2.

    • Path Include /admin
    • User Agent Prefix is not mozilla/5.0
    • IP Equal to 192.168.2.3
    • Cookie key1 Prefix is not Nessus

    Priority

    Priority of a rule being executed

    Smaller values correspond to higher priorities. If two rules are assigned with the same priority, the rule added earlier has higher priority.

    5

    Table 2 Condition list configurations

    Field

    Example Subfield

    Logic

    Example Content

    Path: URL excluding a domain name. This value supports exact match only. That is, the path to be protected must match the path specified here. For example, if the path to be protected is /admin, set Path to /admin.

    --

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    /buy/phone/

    User Agent: A user agent of the scanner to be protected

    --

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    Mozilla/5.0 (Windows NT 6.1)

    IP: An IP address of the visitor to be protected

    --

    Equal to or Not equal to

    192.168.2.3

    Params: A request parameter to be protected

    sttl

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    201901150929

    Cookie: A small piece of data to identify web visitors

    name

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    Nessus

    Referer: A user-defined request resource

    For example, if the protected path is /admin/xxx and you do not want visitors to access the page from www.test.com, set Content to http://www.test.com.

    --

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    http://www.test.com

    Header: A user-defined HTTP header

    Accept

    Include, Exclude, Equal to, Not equal to, Prefix is, Prefix is not, Suffix is, or Suffix is not

    text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

  9. Click OK.

    • To modify the added rule, click Modify in the row containing the target rule.
    • To delete the added rule, click Delete in the row containing the target rule.