Policy configuration

Before you configure Web Application Firewall (WAF) policies, you must first create a WAF policy.

Create a WAF policy

1. On the left-hand navigation panel, click Configuration.
2. Select Policies from the list of available features.
3. Click the Create Policy button.
4. Provide a Policy Name, and then ensure you select a WAF profile.
5. Select the checkmark to apply the WAF Profile to the policy.
   1. Optionally, you can enable the usage of the Semicolon Field Separator in URL Queries and Post form bodies, which simply indicate that a semicolon ( ; ) is separation multiple fields.
6. The counter measures section provides a list of common protection types and methods for users to select from. Expand each bot protection techniquesmeasure to configure the required values. Each bot protection techniquesmeasure can be set to one of the following statuses.
   1. Bypass / None – No action will be taken.
   2. Block – Once the threshold limit has been reached, the violating traffic will be blocked.
   3. Log – One or more requests or violations will not be blocked, but details will be logged for review.
   4. Block and Log – One or more requests are blocked and the details are stored.
7. Certain counter measures offer learning and relaxation rules.
   1. Relaxation Rules – You can manually enter the values that allow traffic matching the criteria through. If Learning was enabled, you can click + (plus) to an entry to apply it directly to the Relaxation Rules.
   2. Learning – Learning must be enabled for each bot protection techniquesmeasure before data can begin to be captured. Once traffic is actively being monitored, a list of blocked rules will be returned that you can review for accuracy.
8. To configure the Relaxation Rules, click Add, and then complete the fields that appear in the pop-up window.
9. Click Commit.
   1. Name – Provide a name for the configured Relaxation Rule.
   2. Enabled – Set to either ON or OFF.
   3. Is Name Regex – Set to either ON or OFF.
   4. URL – Provide the URL that is allowed.
   5. Location – Select from the drop-down menu either
      1. Cookie
      2. Form Field,
      3. Header.
10. Value Type – Select from the drop-down menu either 1. Keyword 1. Special String, 1. Wildchar.
    1. Is Value Expression Regex – Set to either ON or OFF?
    2. Value Expression – Provide the value expression for the rule.
11. To enable Learning, select the ON/OFF option for your desired configuration.
12. Click Save.

Configure responder policies

The Responder Policies section provides more flexibility to customers, but does require more detailed and in-depth knowledge of your traffic configurations to properly use and incorporate. When properly used however, the Responder Policies can inspect on any of the fields (values) and operands and then run a selected action.

1. From the Policy Configuration screen, select the Responder Policies tab.
2. Click the Start button to add a Responder Policy.
3. Provide a Name for the Policy.
4. Select the Action type from the drop-down menu.
   1. Drop
   2. Log
   3. Redirect To
   4. Respond With
5. The Response field will be determined by the Action you selected.
   1. Drop. Response is N/A as the traffic are dropped.
   2. Log. Response is N/A as the traffic are stored in your log file.
   3. Redirect To. Provide the URL to be redirected. The URL must start with a backslash (/).
   4. Respond With. Provide the text to display for the response.
6. Select the arrow next to the Matches section to configure exact specifications for your policy. Complete the following fields
   1. Field. Select the field type from the drop-down list of options.
   2. Operand. Select the operand type for the field from the drop-down menu.
   3. Value. Provide the value associated to the Field and Operand combination.
   4. To select more Match criteria, click the Plus icon.
7. To add more Responder Policies, click the Plus icon. Doing so increases the responder policy number in the upper left hand side of each configured policy. Also, if you are using multiple rules, all of the rules have to pass / match before the associated action can be taken.
8. Click Save.

Network controls

The Network Controls section of the Policy allows for Geographical (GEO) blocking of traffic by country type. If however, you want to block an entire country, but allow a specific IP address through, you can configure the Network Controls to do so. Click the Add button to indicate if an IP / CIDR address should be blocked or allowed. Click the Commit button when done.

The Network Controls section of the Policy allows for Geographical (GEO) blocking of traffic by country type. If however, you want to block a country but allow a specific IP address through, you can configure the Network Controls to do so.

1. From the Policy Configuration screen, select the Network Controls tab.
2. Click the Add button to configure an IP address that you want to either block, or allow through
3. Provide an IP Address, and then select Not Blocked (allow the IP Address through) or Blocked (prevent all traffic from the IP Address). Click the Commit button when finished
4. To select an entire country to block traffic from, click in the Blocked Countries drop-down menu. Select all of the countries that you want to block traffic from. Click out of the drop-down menu when you are finished making your selections
5. To allow list an IP Address from a blocked country, first select the Country to block, and then add the IP address from that country to allow through, and select the Not Blocked option. The allow list action happens before a block action is applied.
6. Click Save.

Alert threshold

The Alert Thresholds section allows you to configure a threshold value, that once reached, will send alerts for the violations occurring for a configured rule. To configure an Alert Threshold, click the Add button. Select the Dimension from the drop-down menu, and then configure the corresponding fields.

To further clarify, alerts will not be sent until the Occurrence count has been exceeded within the time frame specified. For example, if the occurrence rate was 3, and the timeframe was 60 seconds, alerts would not be sent until a fourth violation occurred within the 60-second timeframe.

A pop-up help window appears with an explanation of a selected Dimension from the drop-down menu.

The Alert Threshold section allows you to define a threshold that must be reached before Alerts are sent for violations that are relevant to your configured rules. Alert Thresholds are set by Dimension, a KEY, and a designated Count or amount. The threshold alerts can be synced to SLACK, with a link provided directly to the alert page of the Portal, and being sent out in email format. The alert notifications will also be displayed on the UI Portal under the bell (notifications) icon. It is important to note that Alert Thresholds are also set on the WAF Profile section, per bot protection techniquesmeasure.

1. From the Policy Configuration screen, select the Alert Thresholds tab.
2. Click Add.

3. Select the Dimension from the list of drop-down menu options. Each dimension selection provides a brief explanation at the top of the pop-out window.

   1. More fields are determined by the Dimension type you select.
4. Complete any additional fields that appear based on the Dimension type selected.
5. Select the number of Occurrences. This determines the threshold limit that must be reached for a violation to occur, and a notification to be sent.
6. The Timeframe by default stays at 60 seconds.
7. Click the Commit button when you are finished customizing the Application Security Threshold.
8. Click the Save button when you are done adding Alert Thresholds

Trusted sources

The Trusted Sources section helps to configure a list of IPs that can be reliably used for learning traffic data and generate recommendations for relaxation. If Trusted Sources are not configured, traffic from all the sources will be used for learning and not providing appropriate recommendations for relaxation.

1. Click Add to configure a new Trusted Source. Select whether the Trusted Source is going to be Enabled or not, and then provide the IP Address/CIDR. The Description field is an optional field that can be filled using free text.
2. Click Commit when you are done.
3. Click Save.

Assets

The Assets tab displays any asset that this policy is currently assigned to. If there are any associated assets, you can remove them which will cause each asset to undergo a provisioning process in which rules and configurations might be temporarily disabled.

If no Assets are associated with your policy, the Associated Assets drop-down menu displays “0 Selected”. Select an Asset to associate with your policy.

To remove an associated Asset, hover over the drop-down menu and click the Minus button next to the Asset you want to remove, or, click in the drop-down menu and click a highlighted Asset to remove it.

bot protection techniques measure

The counter measures section provides a list of common protection types and methods for users to select from.

1. Expand each bot protection techniquesmeasure to configure the required values. Each bot protection techniquesmeasure can be set to one of the following statuses.

   1. Bypass / None – No action is taken.
   2. Block – Once the threshold limit has been reached, the violating traffic are blocked.
   3. Log – One or more requests or violations are not blocked, but details are logged for review.
   4. Block and Log – One or more requests are blocked and the details are logged.

2. Certain counter measures offer Learning and Relaxation Rules.

   1. Relaxation Rules – You can manually enter the values that allow traffic matching the criteria through. If Learning was enabled, you can click the + (plus) Icon next to an entry to apply it directly to the Relaxation Rules.
   2. Learning – Learning must be enabled for each bot protection techniquesmeasure before data can begin to be captured. Once traffic is actively being monitored, a list of blocked rules will be returned that you can review for accuracy.
3. To configure the Relaxation Rules, click the Add button, and then complete the fields that appear in the pop-up window. Click Commit when finished.
   1. Name – Provide a name for the configured Relaxation Rule.
   2. Enabled – Set to either ON or OFF.
   3. Is Name Regex – Set to either ON or OFF.
   4. URL – Provide the URL that is allowed.
   5. Location – Select from the drop-down menu either
      1. Cookie
      2. Form Field,
      3. Header.
   6. Value Type – Select from the drop-down menu either
      1. Keyword
      2. Special String,
      3. Wildchar.
   7. Is Value Expression Regex – Set to either ON or OFF
   8. Value Expression – Provide the value expression for the rule.
4. To enabled Learning, select the OFF / ON option for your desired configuration.
5. Click Save.

Signatures

The Signatures section allows you to designate specific, configurable rules to simplify the task of protecting your websites against known attacks. A signature represents a pattern that is a component of a known attack on an operating system, web server, website, XML-based web service, or other resource.

Standard signatures

The Standard Signatures section displays a preconfigured set of literal and Perl Compatible Regular Expressions (PCRE) keywords and special strings used to protect against common web vulnerabilities. These configured signatures cannot be edited as they are our default configurations.

1. Select the Signatures tab, and then select the Standard Signatures option.
2. The Configured Signatures section displays any Signatures that have been selected or added to the WAF Profile Policy you are currently viewing or creating.
   1. For a new policy, this section is empty.
3. In the Signatures Pool section, you see the list of pre-configured signatures that we have created for you. You can use the arrows or page number options to view more signatures, or use the Filter option if you are looking for a specific signature.
   1. The filter option searches for your criteria across each field (ID, Category, Description, References), and return the results accordingly.
4. Click the View icon to see a simplified overview of the Signature Pool, or click the Add to Add the Signature Pool to your Configured Signatures section.
5. Click the Save button once you have added your desired signatures

Custom signatures

The Custom Signatures section allows you to craft custom signatures to protect against attacks and vulnerabilities.

1. Select Custom Signatures.
2. Click Add.
3. Select the Action type for the signature.
   1. Block & Log
   2. Log
   3. None
4. Provide the category type for the signature.
5. Provide a description for the custom signature
6. Optionally, you can configure the Request Rules and/or the Response Rules.
   1. Request Rules inspect only on the request, and Response Rules inspect only on the response.
7. For the Request Rules, click the Start button, and then select the Area type from the drop-down menu. This determines the additional fields that you will be required to complete.
   1. You can click the Plus Icon to add another row or entry, or the Minus Icon to remove the selected row
8. For the Response Rules, click Start, and then select the Area type from the drop-down menu. This determines the additional fields that you will be required to complete.
   1. You can click the Plus Icon to add another row or entry, or the Minus Icon to remove the selected row.
9. To cancel the creation of Request or Response Rules, click Allow X next to Response Rules to remove them from your custom signature.
10. Click the Commit button when you are finished configuring your signature.
11. Click the Save button when you have finished configuring your WAF Profile Policy

Associate CWAAP profile to an asset

Once you have created your CWAAP profile, the next step is to apply it to an asset so that your configuration can go into effect.

1. From the Configuration section on the left-hand navigation menu, select Assets.
2. Select the Pencil Icon for the Asset that you want to add the policy to. If you do not have an Asset already created, please see our Guides on how to Create an Asset.
3. Select the Policies tab.
4. From the drop-down menu, select your newly created Policy name. a. If you do not see the policy name listed, please refresh and try again as the provisioning period can take a few minutes.
5. Click the Save button.

Once your CWAAP policy has been applied to a policy, please allow a few minutes for provisioning to occur.

Edit a WAF policy

Once a Policy has been created, you can easily edit any of the existing configurations. However, changes to a Policy that has been associated to an Asset causes a provisioning period to occur which can have a temporary impact on your traffic configuration.

1. From the Configuration section on the left-hand navigation menu, select Policies.
2. Click the Pencil Icon next to the policy you want to edit.
3. Navigate through each of the Policy Configuration tabs to make changes, and click the Save button after making changes on any/all tabs.

Delete a WAF policy

If you need to remove a CWAAP Policy from an Asset, there are several ways in which you can accomplish this.

Note:

1. From the Configuration section on the left-hand navigation menu, select Policies.
2. Click the Pencil Icon next to the policy you want to delete.
3. Click Delete.

Disassociate assets from a WAF policy

From the Policy, you can disassociate the Assets that the policy is assigned to, or disable the WAF Profile.

1. From the Configuration section on the left-hand navigation menu, select Policies.
2. Click Pencil Icon to edit the policy.
3. On the WAF Profile tab, clear the box under the “Apply WAF Profile to Policy?” section to Ignore. This disables the WAF profile.

OR

1. From the Policy Configuration screen, select the Assets tab.
2. Select the Minus Icon to remove the selected Asset.
3. Click Save.

Edit an asset

From the Asset section, you can edit a selected Asset and remove the Policy.

1. From the Configuration section on the left-hand navigation menu, select Assets.
2. Click the Pencil Icon next to the asset you want to edit.
3. Select Policies tab.
4. Hover over the drop-down menu and click Minus Icon to remove the associated Policy.
5. Click Save.