Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configure a content filtering policy

September 14, 2021
Contributed by: 
S C

To implement content filtering, you must configure at least one policy to tell your Citrix ADC appliance how to distinguish the connections you want to filter. You must first have configured at least one filtering action, because when you configure a policy, you associate it with an action.

Content filtering policies examine a combination of one or more of the following elements to select requests or responses for filtering:

  • URL: The URL in the HTTP request.

  • URL query: Only the query portion of the URL, which is the portion after the query (?) symbol.

  • URL token: Only the tokens in the URL, if any, which are the parts that begin with an ampersand (&) and consist of the token name, followed by an equals sign (=), followed by the token value.

  • HTTP method: The HTTP method used in the request, which is usually GET or POST, but can be any of the eight defined HTTP methods.

  • HTTP version: The HTTP version in the request, which is usually HTTP 1.1.

  • Standard HTTP header: Any of the standard HTTP headers defined in the HTTP 1.1 specification.

  • Standard HTTP header value: The value portion of the HTTP header, which is the portion after the colon and space (: ).

  • Custom HTTP header: A non-standard HTTP header issued by your website or that appears in a user request.

  • Custom header value: The value portion of the custom HTTP header, which (as with the standard HTTP header) is the portion after the colon and space (: ).

  • Client Source IP: The IP from which the client request was sent.

Content filtering policies use the simpler of two Citrix ADC expressions languages, called classic expressions. For a complete description of classic expressions, how they work, and how to configure them manually, see “Policies and Expressions.”

Note: Users who are not experienced in configuring policies at the Citrix ADC command line will usually find using the configuration utility considerably easier.

Configure a content filtering policy by using the CLI

At the command prompt, type the following commands to configure a content filtering policy and verify the configuration:

-  add filter policy <name> -rule <expression> (-reqAction <action> | -resAction <string>
-  show filter policy <name>
<!--NeedCopy-->

Example:

> add filter policy cf-pol -rule "REQ.HTTP.URL CONTAINS http://abc.com" -reqaction DROP
 Done
> show filter policy cf-pol
1)      Name: cf-pol    Rule: REQ.HTTP.URL CONTAINS http://abc.com
        Request action: DROP
        Response action:
        Hits: 0
 Done
<!--NeedCopy-->

Configure a content filtering policy by using the GUI

  1. Navigate to Security > Protection Features > Filter.
  2. Navigate to Protection Features > Filter.
  3. In the details pane, to create a new policy, click Add.
  4. If you are creating a new policy, in the Create Filter Policy dialog box, in the Filter Name text box, type a name for your new policy.
  5. Select either Request Action or Response Action to activate the drop-down list to the right of that item.
  6. Click the down arrow to the right of the drop-down list and select the action to be performed on the request or response. The default choices are RESET and DROP. Any other actions you have created will also appear in this list. Note: You can also click New to create a new Content Filtering action, or Modify to modify an existing Content Filtering action. You can only modify actions you created; the default actions are read-only.
  7. If you want to use a predefined expression (or named expression) to define your policy, choose one from the Named Expressions list.
    1. Click the down arrow to the right of the first Named Expressions drop-down list, and choose the category of named expressions that contains the named expression you want to use.
    2. Click the down arrow to the right of the second Named Expressions drop-down list, and choose the named expression you want. As you choose a named expression, the regular expression definition of that named expression appears in the Preview Expression pane beneath the Named Expression list boxes.
    3. Click Add Expression to add that named expression to the Expression list. Note: You must perform either this step or step 7, but not both.
  8. If you want to create a new expression to define your policy, use the Expression Editor.
    1. Click the Add button. The Add Expression dialog box appears.
    2. In the Add Expression dialog box, choose the type of connection you want to filter. The Flow Type is set to REQ by default, which tells the Citrix ADC appliance to look at incoming connections, or requests. If you want to filter outgoing connections (responses), you click the right arrow beside the drop-down list and choose RES.
    3. If the Protocol is not already set to HTTP, click the down arrow to the right of the Protocol drop-down list and choose HTTP. Note: In the Citrix ADC classic expressions language, “HTTP” includes HTTPS requests, as well.

    4. Click the down arrow to the right of the Qualifier drop-down list, and then choose a qualifier for your expression. Your choices are:

      • METHOD: The HTTP method used in the request.

      • URL: The contents of the URL header.

      • URLTOKENS: The URL tokens in the HTTP header.

      • VERSION: The HTTP version of the connection.

      • HEADER: The header portion of the HTTP request.

      • URLLEN: The length of the contents of the URL header.

      • URLQUERY: The query portion of the contents of the URL header.

      • URLQUERYLEN: The length of the query portion of the URL header. The contents of the remaining list boxes change to the choices appropriate to the Qualifier you pick. For example, if you choose HEADER, a text field labeled Header Name* appears below the Flow Type list box.

    5. Click the down arrow to the right of the Operator drop-down list, and choose an operator for your expression. Your choices will vary depending on the Protocol you chose in the preceding step. The following list includes all of the operators:

      • ==: Matches the following text string exactly.

      • !=: Does not exactly match the following text string.

      • >: Is greater than the following integer.

      • CONTAINS: Contains the following text string.

      • CONTENTS: The contents of the designated header, URL, or URL query.

      • EXISTS: The specified header or query exists.

      • NOTCONTAINS: Does not contain the following text string.

      • NOTEXISTS: The specified header or query does not exist.

    6. If the Value text box is visible, type the appropriate string or number. If you are testing a string in any way, type the string into the Value text box. If you are testing an integer in any way, type the integer into the Value text box.
    7. If you chose HEADER as the Protocol, type the header you want in the Header Name* text box.
    8. Click OK to add your expression to the Expressions list.
    9. Repeat steps B through H to create any additional expressions you want for your profile.
    10. Click Close to close the Expressions Editor.
  9. If you created a new expression, in the Expression frame select an option from the Match Any Expression drop-down list. Your choices are:
    • Match Any Expression. If a request matches any expression in the Expressions list, the request matches this policy.
    • Match All Expressions If a request matches all expressions in the Expressions list, the request matches this policy. If it does not match all of them, it does not match this policy.
    • Tabular Expression Switches the Expressions list to a tabular format with three columns. In the first column you can place a BEGIN [(] operator. The second column contains the expressions you have selected or created. In the third column, you can place any of the other operators in the following list, to create complex policy groups in which each group can be configured for match any expression or match all expressions.
    • The AND [&&] operator tells the appliance to require that a request match both the current expression and the following expression.
    • The OR [||] operator tells the appliance to require that a request match either the current expression or the following expression, or both. Only if the request does not match either expression does it not match the policy.
    • The END [)] operator tells the appliance that this is the last expression in this expression group or policy. Note: The Tabular format allows you to create a complex policy that contains both “Match Any Expression” and “Match All Expressions” on a per-expression basis. You are not limited to just one or the other.
    • Advanced Free-Form Switches off the Expressions Editor entirely and modifies the Expressions list into a text area. In the text area, you can type the PCRE-format regular expression of your choice to define this policy. This is both the most powerful and the most difficult method of creating a policy, and is recommended only for those thoroughly familiar with the Citrix ADC appliance and PCRE-format regular expressions. Caution: If you switch to Advanced Free Form expression editing mode, you cannot switch back to any of the other modes. Do not choose this expression editing mode unless you are sure that is what you want.
  10. Repeat steps 6 through 8 to add any additional expressions you want to the Expressions list. You can mix named expressions and expressions created in the Expressions Editor. To the Citrix ADC appliance, they are all the same.
  11. Click Create to create your new policy. Your new policy appears in the Policies pane list.
  12. Click Close. To create additional Content Filtering policies, repeat the previous procedure. To remove a Content Filtering policy, select the policy in the Policies tab and click Remove.
Configure a content filtering policy
September 14, 2021
Contributed by: 
S C
September 14, 2021
Contributed by: 
S C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.