Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configure bot signature setting

February 14, 2024
Contributed by: 
B

You can configure the following settings in the bot signature settings:

  • Configure bot allow list

  • Configure bot block list

  • Configure CAPTCHA for IP reputation

  • Bot Transactions Per second (TPS)

Configure bot allow list by using NetScaler GUI

This detection technique enables you to bypass the URLs that you configure as allowed URLs. Complete the following step to configure an allow list URL:

  1. Navigate to Security > NetScaler Bot Management and Profiles.
  2. On the NetScaler Bot Management Profiles page, select a file and click Edit.
  3. On the NetScaler Bot Management Profile page, go to the Signature Settings section and click Allow List.
  4. In the Allow List section, set the following parameters:
    1. Enabled. Select the checkbox to validate the allow list URLs as part of the detection process.
    2. Configure Types. Configure an allow list URL. The URL is bypassed during bot detection. Click Add to add a URL to the bot allow list.
    3. In the Configure NetScaler Bot Management Profile allowlist Binding page, set the following parameters:
      1. Type. URL type can be an IPv4 address, subnet IP address, or an IP address matching a policy expression.
      2. Enabled. Select the checkbox to validate the URL.
      3. Value. URL address.
      4. Log. Select the checkbox to store log entries.
      5. Log Message. Brief description of the log.
      6. Comments. Brief description about the allow list URL.
      7. Click OK.

    Configure bot allow list

  5. Click Update.
  6. Click Done.

Configure bot block list by using NetScaler GUI

This detection technique enables you to drop the URLs that you configure as blocked URLs. Complete the following step to configure a block list URL.

  1. Navigate to Security > NetScaler Bot Management and Profiles.
  2. On the NetScaler Bot Management Profiles page, select a signature file and click Edit.
  3. On the NetScaler Bot Management Profile page, go to the Signature Settings section and click Block List.

  4. In the Block List section, set the following parameters:

    1. Enabled. Select the checkbox to validate block list URLs as part of the detection process.
    2. Configure Types. Configure a URL to be part of the bot block list detection process. These URLs are dropped during bot detection. Click Add to add a URL to the bot block list

    3. In the Configure NetScaler Bot Management Profile Blocklist Binding page, set the following parameters.

      1. Type. URL type can be an IPv4 address, subnet IP address, or IP address.
      2. Enabled. Select the checkbox to validate the URL.
      3. Value. URL address.
      4. Log. Select the checkbox to store log entries.
      5. Log Message. Brief description of the login.
      6. Comments. Brief description about the block list URL.
      7. Click OK.

    Configuring bot block list

  5. Click Update.
  6. Click Done.

Configure CAPTCHA for IP reputation

CAPTCHA helps to block automated bots that cause security violations to web applications. In the NetScaler, CAPTCHA uses the challenge-response module to identify if the incoming traffic is from a human user and not an automated bot.

How CAPTCHA works in NetScaler bot management

In NetScaler bot management, CAPTCHA validation is configured as a policy action to be run after bot policy is evaluated. The CAPTCHA action is available only for IP reputation and device fingerprint detection techniques. Following are the steps to understand how CAPTCHA works:

  1. If a security violation is observed during IP reputation or device fingerprint bot detection, the ADC appliance sends a CAPTCHA challenge.
  2. The client sends the CAPTCHA response.
  3. The appliance validates the CAPTCHA response and if the CAPTCHA is valid, the request is allowed and it is forwarded to the back-end server.
  4. If the CATCHA response is invalid, the appliance sends a new CAPTCHA challenge until the maximum number of attempts is reached.
  5. If the CAPTCHA response is invalid even after the maximum number of attempts, the appliance drops or redirects the request to the configured error URL.
  6. If you have configured log action, then the appliance stores the request details in the ns.log file.

Configure CAPTCHA settings by using the NetScaler GUI

The bot management CAPTCHA action is supported only for IP reputation and device fingerprint detection techniques. Complete the following steps to configure the CAPTCHA settings.

  1. Navigate to Security > NetScaler Bot Management and Profiles.
  2. On the NetScaler Bot Management Profiles page, select a profile and click Edit.
  3. On the NetScaler Bot Management Profile page, go to the Signature Settings section and click CAPTCHA.
  4. In the CAPTCHA Settings section, click Add to configure CAPTCHA settings to the profile:
  5. In the Configure NetScaler Bot Management CAPTCHA page, set the following parameters.

    1. URL. Bot URL for which the CAPTCHA action is applied during IP reputation and device fingerprint detection techniques.

    2. Enabled. Set this option to enable CAPTCHA support.
    3. Grace time. Duration until when no new CAPTCHA challenge is sent after the current valid CAPTCHA response is received.
    4. Wait time. Duration taken for the ADC appliance to wait until the client sends the CAPTCHA response.
    5. Mute Period. Duration for which the client which sent an incorrect CAPTCHA response must wait until allowed to try next. During this mute period, the ADC appliance does not allow any requests. Range: 60–900 seconds, Recommended: 300 seconds
    6. Request Length limit. Length of the request for which the CAPTCHA challenge is sent to the client. If the length is greater than the threshold value, the request is dropped. Default value is 10–3000 bytes.
    7. Retry Attempts. Number of attempts the client is allowed to retry to solve the CAPTCHA challenge. Range: 1–10, Recommended: 5.
    8. No Action/Drop/Redirect action to be taken if the client fails the CAPTCHA validation.
    9. Log. Set this option to store request information from the client when response CAPTCHA fails. The data is stored in ns.log file.
    10. Comment. A brief description about the CAPTCHA configuration.
  6. Click OK and Done.
  7. Navigate to Security > NetScaler Bot Management > Signatures.
  8. On the NetScaler Bot Management Signatures page, select a signature file and click Edit.
  9. On the NetScaler Bot Management Signature page, go to the Signature Settings section and click Bot Signatures.

  10. In the Bot Signatures section, set the following parameters:

  11. Configure Static Signatures. Select a bot static signature record and click Edit to assign a bot action to it.
  12. Click OK.
  13. Click Update Signature.
  14. Click Done.

Bot Transactions Per second (TPS)

The Transactions Per Second (TPS) bot technique detects incoming traffic as a bot if the number of requests per second (RPS) and percentage increase in RPS exceeds the configured threshold value. The detection technique protects your web applications from automated bots that can cause web scraping activities, brute forcing login, and other malicious attacks.

Note:

The bot technique detects an incoming traffic as bot only if both the parameters are configured and if both values increase beyond the threshold limit. Let us consider a scenario, where the appliance receives many requests coming from a specific URL and you want the NetScaler bot management to detect if there is a bot attack. The TPS detection technique examines the number of requests (configured value) coming from the URL within 1 second and the percentage increase (configured value) in the number of requests received within 30 minutes. If the values exceed the threshold limit, the traffic is considered as bot and the appliance runs the configured action.

To configure TPS, you must complete the following steps:

  1. Enable bot TPS
  2. Bind TPS settings to bot management profile

Configure bot transactions per second (TPS) using CLI

Enable bot transaction per second (TPS)

Before you can begin, you must ensure that the bot TPS feature is enabled on the appliance. At the command prompt, type:

set bot profile profile1 –enableTPS ON

Bind TPS settings to bot management profile

Once you enable the bot TPS feature, you must bind the TPS settings to the bot management profile.

At the command prompt, type:

bind bot profile <name>… (-tps [-type ( SourceIP | GeoLocation | RequestURL | Host )] [-threshold <positive_integer>] [-percentage <positive_integer>] [-action ( none | log | drop | redirect | reset | mitigation )] [-logMessage <string>])

Example:

bind bot profile profile1 -tps -type RequestURL -threshold 1 -percentage 100000 -action drop -logMessage log

Configure bot transactions per second (TPS) by using the NetScaler GUI

Complete the following steps to configure bot transactions per second:

  1. Navigate to Security > NetScaler Bot Management > Profiles.
  2. In the NetScaler Bot Management Profiles page, select a profile and click Edit.
  3. In the Create NetScaler Bot Management Profile page, click TPS under Signature Settings section.
  4. In the TPS section, enable the feature and click Add.

  5. In Configure NetScaler bot Management Profile TPS Binding page, set the following parameters.

    1. Type - Input types allowed by the detection technique. Possible values: SOURCE IP, GEOLOCATION, HOST, URL.

      SOURCE_IP – TPS based on client IP address.

      GEOLOCATION – TPS based on the client’s geographic location.

      HOST - TPS based on client requests forwarded to a specific back-end server IP address.

      URL – TPS based on client requests coming from a specific URL.

    2. Fixed Threshold - Maximum number of requests allowed from a TPS input type within 1 second time interval.

    3. Percentage Threshold - Maximum percentage increase in requests from a TPS input type within 30 minute time interval.

    4. Action - Action to be taken for bot detected by TPS binding.

    5. Log - Enable or disable logging for TPS binding.

    6. Log Message. Message to log for bot detected by TPS binding. Maximum Length: 255.

    7. Comments - A brief description about the TPS configuration. Maximum Length: 255

  6. Click OK and then Close.
Configure bot signature setting
February 14, 2024
Contributed by: 
B
February 14, 2024
Contributed by: 
B

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.