This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Web Application Firewall profile settings
Following are the profile settings that you must configure on the appliance.
At the command prompt, type:
add appfw profile <name> [-invalidPercentHandling <invalidPercentHandling>] [-checkRequestHeaders ( ON | OFF )] [-URLDecodeRequestCookies ( ON | OFF )] [-optimizePartialReqs ( ON | OFF )] [-errorURL <expression>] [-logEveryPolicyHit ( ON | OFF )] [-stripHtmlComments <stripHtmlComments>] [-stripXmlComments ( none | all )] [-postBodyLimitSignature <positive_integer>][-fileUploadMaxNum <positive_integer>][-canonicalizeHTMLResponse ( ON | OFF )][-percentDecodeRecursively ( ON | OFF )] [-multipleHeaderAction <multipleHeaderAction> ...][-inspectContentTypes <inspectContentTypes> ...][-semicolonFieldSeparator ( ON | OFF )]
Example:
add appfw profile profile1 [-invalidPercentHandling secure_mode] [-checkRequestHeaders ON] [-URLDecodeRequestCookies OFF] [-optimizePartialReqs OFF]
Where,
invalidPercentHandling. Configure the method for handling percent-encoded names and values.
Available settings function as follows:
asp_mode - Strips and Parses Invalid Percent for Parsing. Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is stripped of and the rest of the content is inspected and action taken for the SQLInjection check.
secure_mode - We detect the Invalid Percent coded value and ignore it. Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is detected, counters are incremented and content is passed as is to the server.
apache_mode - This mode works similar to secure mode.
Possible values: apache_mode, asp_mode, secure_mode
Default value: secure_mode
optimizePartialReqs. When OFF/ON (without safe object), a Citrix ADC appliance sends the partial request to the back-end server. This partial response sent back to the client. OptimizePartialReqs makes sense when the Safe object is configured. The appliance sends requests for full response from the server when OFF, requests only partial response when ON.
Available settings are as follows:
ON - Partial requests by the client result in partial requests to the back-end server. OFF - Partial requests by the client are changed to full requests to the back-end server Possible values: ON, OFF Default value: ON
URLDecodeRequestCookies. When checkRequestHeaders is enabled, cookies are inspected for security checks (SQL, cross-site, cmd injection). If URLDecodeRequestCookies is enabled, the cookies are URL decoded and then inspected.
Possible values: ON, OFF Default value: OFF
Signature Post Body Limit (Bytes). Limits the request payload (in bytes) inspected for signatures with the location specified as ‘HTTP_POST_BODY’.
Default value: 8096 Minimum value: 0 Maximum Value: 4294967295
Post Body Limit (Bytes). Limits the request payload (in bytes) inspected by Web Application Firewall.
Default value: 20000000 Minimum value: 0 Maximum Value: 10 GB
For more information about the Security setting and its GUI procedure, see Configure Web App Firewall Profile topic.
postBodyLimitAction. PostBodyLimit honors error settings when you specify the maximum size of HTTP body to be allowed. To honor error settings you must configure one or more Post Body Limit actions. The configuration is also applicable for requests where the transfer encoding header is chunked.
set appfw profile <profile_name> -PostBodyLimitAction block log stats
Where, Block - This action blocks connection that violates the security check and it is based on the maximum size of the configured HTTP body (post body limit). You must always enable the option.
Log - Log violations of this security check.
Stats - Generate statistics for this security check.
Note:
The log format for post body limit action is now changed to follow the standard audit logging format, for example:
ns.log.4.gz:Jun 25 1.1.1.1. <local0.info> 10.101.10.100 06/25/2020:10:10:28 GMT 0-PPE-0 : default APPFW APPFW_POSTBODYLIMIT 1506 0 : <Netscaler IP> 4234-PPE0 - testprof ><URL> Request post body length(<Post Body Length>) exceeds post body limit.
inspectQueryContentTypes Inspect request query and web forms for injected SQL and cross-site scripts for the following content types.
set appfw profile p1 -inspectQueryContentTypes HTML XML JSON OTHER
Possible values: HTML, XML, JSON, OTHER
By default, this parameter is set as “InspectQueryContentTypes: HTML JSON OTHER” for both basic and advanced appfw profiles.
Example for inspect query content type as XML:
> set appfw profile p1 -type XML
Warning: HTML, JSON checks except “InspectQueryContentTypes” & “Infer Content-Type XML Payload Action” will not be applicable when profile type is not HTML or JSON respectively.
<!--NeedCopy-->
Example for inspect query content type as HTML:
> set appfw profile p1 -type HTML
Warning: XML, JSON checks except “InspectQueryContentTypes” & “Infer Content-Type XML Payload Action” will not be applicable when profile type is not XML or JSON respectively
Done
<!--NeedCopy-->
Example for inspect query content type as JSON:
> set appfw profile p1 -type JSON
Warning: HTML, XML checks except “InspectQueryContentTypes” & “Infer Content-Type XML Payload Action will not be applicable when profile type is not HTML or XML respectively
Done
<!--NeedCopy-->
errorURL expression. The URL that the Citrix Web App Firewall uses as an error URL. Maximum Length: 2047.
Note:
For blocking violations in a requested URL, if the error URL is similar to the signature URL the appliance resets the connection.
logEveryPolicyHit - Log every profile match, regardless of security checks results. Possible values: ON, OFF. Default value: OFF.
stripXmlComments - Strip XML comments before forwarding a webpage sent by a protected website in response to a user request. Possible values: none, all, exclude_script_tag. Default value: none
postBodyLimitSignature - Maximum allowed HTTP post body size for signature inspection for location HTTP_POST_BODY in the signatures, in bytes. The changes in value can impact CPU and latency profile. Default value: 2048. Minimum value: 0 Maximum Value: 4294967295
fileUploadMaxNum - Maximum allowed number of file uploads per form-submission request. The maximum setting (65535) allows an unlimited number of uploads. Default value: 65535 Minimum value: 0 Maximum value: 65535
canonicalizeHTMLResponse - Perform HTML entity encoding for any special characters in responses sent by your protected websites. Possible values: ON, OFF Default value: ON
percentDecodeRecursively - Configure whether the application firewall should use percentage recursive decoding. Possible values: ON, OFF Default value: ON
multipleHeaderAction - One or more multiple header actions. Available settings function as follows:
- Block. Block connections that have multiple headers.
- Log. Log connections that have multiple headers.
- KeepLast. Keep only the last header when multiple headers are present.
inspectContentTypes – One or more InspectContentType lists.
- application/x-www-form-urlencoded
- multipart/form-data
- text/x-gwt-rpc
Possible values: none, application/x-www-form-urlencoded, multipart/form-data, text/x-gwt-rpc
semicolonFieldSeparator - Allow ‘;’ as a form field separator in URL queries and POST form bodies. Possible values: ON, OFF Default value: OFF
Share
Share
In this article
This Preview product documentation is Cloud Software Group Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Cloud Software Group Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Cloud Software Group product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.