Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configuring content filtering for a commonly used deployment scenario

September 14, 2021
Contributed by: 
S C

This example provides instructions for using the configuration utility to implement a content filtering policy in which, if a requested URL contains root.exe or cmd.exe, the content filtering policy filter-CF-nimda is evaluated and the connection is reset.

To configure this content filtering policy, you must do the following:

  • Enable content filtering
  • Configure content filtering policy
  • Bind content filtering policy globally or to a virtual server
  • Verify the configuration

Note: Since this example uses a default content filtering action, you do not need to create a separate content filtering action.

Enable content filtering

  1. In the navigation pane, expand System, and click Settings.
  2. In the details pane, under Modes & Features, click Change Basic Features.
  3. In the Configure Basic Features dialog box, select the Content Filtering check box, and then click OK.
  4. In the Enable/Disable feature(s) dialog box, click Yes. A message appears in the status bar, stating that the selected feature is enabled.

Configure the content filtering policy filter-CF-nimda

  1. Navigate to Security > Protection Features > Filter.
  2. In the details pane, click Add. The Create Filter Policy dialog box appears.
  3. In the Create Filter Policy dialog box, in the Filter Name text box, type the name filter-CF-nimda.
  4. Select the Request Action option, and in the drop-down list, select RESET.
  5. In the Expression frame, select Match Any Expression from the drop-down list, and then click Add.
  6. In the Add Expression dialog box, Expression Type drop-down list, select General.
  7. In the Flow Type drop-down list, select REQ.
  8. In the Protocol drop-down list, select HTTP.
  9. In the Qualifier drop-down list, select URL.
  10. In the Operator drop-down list, select CONTAINS.
  11. In the Value text box, type cmd.exe, and then click OK. The expression is added in the Expression text box.
  12. To create another expression, repeat Steps 7 through 11, but in the Value text box, type root.exe. Then click OK, and finally click Close.
  13. Click Create on the Create Filter Policy dialog box. The filter policy filter-CF-nimda appears in the Filter list.
  14. Click Close.

Globally bind the content filtering policy

  1. Navigate to Security > Protection Features > Filter. The Filter page appears in the right pane.
  2. In the details pane, Policies tab, select the policy that you want to bind and click Global Bindings. The Bind/Unbind Filter Policies dialog box appears.
  3. In the Bind/Unbind Filter Policies dialog box, in the Policy Name drop-down list, select the policy filter-CF-nimda, and click Add. The policy is added to the Configured list.
  4. Click OK, and then click Close. The policy you have bound displays a check mark and Yes in the Globally Bound column of the Policies tab.

Bind the content filtering policy to a virtual server

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  2. In the details pane virtual servers list, select vserver-CF-1 to which you want to bind the content filtering policy and click Open.
  3. In the Configure Virtual Server (Load Balancing) dialog box, select the Policies tab.
  4. In the Active column, select the check box for the policy filter-CF-nimda, and then click OK. Your content filtering policy is now active, and must be filtering requests. If it is functioning correctly, the select counter is incremented every time there is a request for a URL containing either root.exe or cmd.exe. This allows you to confirm that your content filtering policy is working. The content filtering policy is bound to the virtual server.

Verify the content filtering configuration by using the command line interface

At the command prompt, type the following command to verify the content filtering configuration:

show filter policy filter-CF-nimda

Example:

sh filter policy filter-CF-nimda
        Name: filter-CF-nimda   Rule: REQ.HTTP.URL CONTAINS cmd.exe || REQ.HTTP.URL CONTAINS root.exe
        Request action: RESET
        Response action:
        Hits: 0
Done
<!--NeedCopy-->

Note

The select counter displays an integer that denotes the number of times the filter-CF-nimda policy is evaluated. In the preceding steps, the select counter is set to zero because no requests for a URL containing either cmd.exe or root.exe has been made yet. If you want to see the counter increment in real time, you can simply request a URL that contains either of these strings.

Verify the content filtering configuration by using the GUI

  1. Navigate to Security > Protection Features > Filter.

  2. In the details pane, select the filter policy filter-CF-nimda. The bottom of the pane must display the following:

    **Request Action:**

    RESET

    **Rule:**

    REQ.HTTP.URL CONTAINS cmd.exe || REQ.HTTP.URL CONTAINS root.exe

    **Hits:**

    0
<!--NeedCopy-->
Configuring content filtering for a commonly used deployment scenario
September 14, 2021
Contributed by: 
S C
September 14, 2021
Contributed by: 
S C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.