config waf profile
Configure Web application firewall configuration.
config waf profile
Description: Configure Web application firewall configuration.
edit <name>
config address-list
Description: Address block and allow lists.
set blocked-address <name1>, <name2>, ...
set blocked-log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
set trusted-address <name1>, <name2>, ...
end
set comment {var-string}
config constraint
Description: WAF HTTP protocol restrictions.
config content-length
Description: HTTP content length in request.
set action [allow|block]
set length {integer}
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config exception
Description: HTTP constraint exception.
edit <id>
set address {string}
set content-length [enable|disable]
set header-length [enable|disable]
set hostname [enable|disable]
set line-length [enable|disable]
set malformed [enable|disable]
set max-cookie [enable|disable]
set max-header-line [enable|disable]
set max-range-segment [enable|disable]
set max-url-param [enable|disable]
set method [enable|disable]
set param-length [enable|disable]
set pattern {string}
set regex [enable|disable]
set url-param-length [enable|disable]
set version [enable|disable]
next
end
config header-length
Description: HTTP header length in request.
set action [allow|block]
set length {integer}
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config hostname
Description: Enable/disable hostname check.
set action [allow|block]
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config line-length
Description: HTTP line length in request.
set action [allow|block]
set length {integer}
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config malformed
Description: Enable/disable malformed HTTP request check.
set action [allow|block]
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config max-cookie
Description: Maximum number of cookies in HTTP request.
set action [allow|block]
set log [enable|disable]
set max-cookie {integer}
set severity [high|medium|...]
set status [enable|disable]
end
config max-header-line
Description: Maximum number of HTTP header line.
set action [allow|block]
set log [enable|disable]
set max-header-line {integer}
set severity [high|medium|...]
set status [enable|disable]
end
config max-range-segment
Description: Maximum number of range segments in HTTP range line.
set action [allow|block]
set log [enable|disable]
set max-range-segment {integer}
set severity [high|medium|...]
set status [enable|disable]
end
config max-url-param
Description: Maximum number of parameters in URL.
set action [allow|block]
set log [enable|disable]
set max-url-param {integer}
set severity [high|medium|...]
set status [enable|disable]
end
config method
Description: Enable/disable HTTP method check.
set action [allow|block]
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config param-length
Description: Maximum length of parameter in URL, HTTP POST request or HTTP body.
set action [allow|block]
set length {integer}
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config url-param-length
Description: Maximum length of parameter in URL.
set action [allow|block]
set length {integer}
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
config version
Description: Enable/disable HTTP version check.
set action [allow|block]
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
end
end
set extended-log [enable|disable]
set external [disable|enable]
config method
Description: Method restriction.
set default-allowed-methods {option1}, {option2}, ...
set log [enable|disable]
config method-policy
Description: HTTP method policy.
edit <id>
set address {string}
set allowed-methods {option1}, {option2}, ...
set pattern {string}
set regex [enable|disable]
next
end
set severity [high|medium|...]
set status [enable|disable]
end
config signature
Description: WAF signatures.
set credit-card-detection-threshold {integer}
config custom-signature
Description: Custom signature.
edit <name>
set action [allow|block|...]
set case-sensitivity [disable|enable]
set direction [request|response]
set log [enable|disable]
set pattern {string}
set severity [high|medium|...]
set status [enable|disable]
set target {option1}, {option2}, ...
next
end
set disabled-signature <id1>, <id2>, ...
set disabled-sub-class <id1>, <id2>, ...
config main-class
Description: Main signature class. Read-only.
edit <id>
set action [allow|block|...]
set log [enable|disable]
set severity [high|medium|...]
set status [enable|disable]
next
end
end
config url-access
Description: URL access list.
edit <id>
config access-pattern
Description: URL access pattern.
edit <id>
set negate [enable|disable]
set pattern {string}
set regex [enable|disable]
set srcaddr {string}
next
end
set action [bypass|permit|...]
set address {string}
set log [enable|disable]
set severity [high|medium|...]
next
end
next
end
config waf profile
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
comment |
Comment. |
var-string |
Maximum length: 1023 |
|
||||||
|
extended-log |
Enable/disable extended logging. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
external |
Disable/Enable external HTTP Inspection. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
name |
WAF Profile name. |
string |
Maximum length: 35 |
|
||||||
config address-list
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
blocked-address |
Blocked address. Address name. |
string |
Maximum length: 79 |
|
||||||||
|
blocked-log |
Enable/disable logging on blocked addresses. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Status. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
trusted-address |
Trusted address. Address name. |
string |
Maximum length: 79 |
|
||||||||
config content-length
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
length |
Length of HTTP content in bytes (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
67108864 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config exception
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
address |
Host address. |
string |
Maximum length: 79 |
|
||||||
|
content-length |
HTTP content length in request. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
header-length |
HTTP header length in request. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
hostname |
Enable/disable hostname check. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
id |
Exception ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||
|
line-length |
HTTP line length in request. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
malformed |
Enable/disable malformed HTTP request check. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
max-cookie |
Maximum number of cookies in HTTP request. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
max-header-line |
Maximum number of HTTP header line. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
max-range-segment |
Maximum number of range segments in HTTP range line. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
max-url-param |
Maximum number of parameters in URL. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
method |
Enable/disable HTTP method check. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
param-length |
Maximum length of parameter in URL, HTTP POST request or HTTP body. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
pattern |
URL pattern. |
string |
Maximum length: 511 |
|
||||||
|
regex |
Enable/disable regular expression based pattern match. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
url-param-length |
Maximum length of parameter in URL. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
version |
Enable/disable HTTP version check. |
option |
- |
disable |
||||||
|
|
|
|||||||||
config header-length
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
length |
Length of HTTP header in bytes (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
8192 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config hostname
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config line-length
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
length |
Length of HTTP line in bytes (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
1024 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config malformed
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config max-cookie
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
max-cookie |
Maximum number of cookies in HTTP request (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
16 |
||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config max-header-line
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
max-header-line |
Maximum number HTTP header lines (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
32 |
||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config max-range-segment
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
max-range-segment |
Maximum number of range segments in HTTP range line (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
5 |
||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config max-url-param
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
max-url-param |
Maximum number of parameters in URL (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
16 |
||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config method
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config method
|
Parameter |
Description |
Type |
Size |
Default |
||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
default-allowed-methods |
Methods. |
option |
- |
|
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
|
status |
Status. |
option |
- |
disable |
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
config param-length
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
length |
Maximum length of parameter in URL, HTTP POST request or HTTP body in bytes (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
8192 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config url-param-length
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
length |
Maximum length of URL parameter in bytes (0 to 2147483647). |
integer |
Minimum value: 0 Maximum value: 2147483647 |
8192 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config version
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Enable/disable the constraint. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config method
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
|
log |
Enable/disable logging. |
option |
- |
disable |
|
severity |
Severity. |
option |
- |
medium |
|
status |
Enable/disable the constraint. |
option |
- |
disable |
config method
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
default-allowed-methods |
Methods. |
option |
- |
|
|
log |
Enable/disable logging. |
option |
- |
disable |
|
severity |
Severity. |
option |
- |
medium |
|
status |
Status. |
option |
- |
disable |
config method-policy
|
Parameter |
Description |
Type |
Size |
Default |
||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
address |
Host address. |
string |
Maximum length: 79 |
|
||||||||||||||||||||
|
allowed-methods |
Allowed Methods. |
option |
- |
|
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
|
id |
HTTP method policy ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||||||||||||||
|
pattern |
URL pattern. |
string |
Maximum length: 511 |
|
||||||||||||||||||||
|
regex |
Enable/disable regular expression based pattern match. |
option |
- |
disable |
||||||||||||||||||||
|
|
|
|||||||||||||||||||||||
config signature
|
Parameter |
Description |
Type |
Size |
Default |
|---|---|---|---|---|
|
credit-card-detection-threshold |
The minimum number of Credit cards to detect violation. |
integer |
Minimum value: 0 Maximum value: 128 |
3 |
|
disabled-signature |
Disabled signatures. Signature ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|
|
disabled-sub-class |
Disabled signature subclasses. Signature subclass ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
|
config custom-signature
|
Parameter |
Description |
Type |
Size |
Default |
||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
case-sensitivity |
Case sensitivity in pattern. |
option |
- |
disable |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
direction |
Traffic direction. |
option |
- |
request |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
name |
Signature name. |
string |
Maximum length: 35 |
|
||||||||||||||||||||||||||||
|
pattern |
Match pattern. |
string |
Maximum length: 511 |
|
||||||||||||||||||||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
status |
Status. |
option |
- |
disable |
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
|
target |
Match HTTP target. |
option |
- |
|
||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||||
config main-class
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
allow |
||||||||
|
|
|
|||||||||||
|
id |
Main signature class ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
enable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
|
status |
Status. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
config url-access
|
Parameter |
Description |
Type |
Size |
Default |
||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
action |
Action. |
option |
- |
permit |
||||||||
|
|
|
|||||||||||
|
address |
Host address. |
string |
Maximum length: 79 |
|
||||||||
|
id |
URL access ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||
|
log |
Enable/disable logging. |
option |
- |
disable |
||||||||
|
|
|
|||||||||||
|
severity |
Severity. |
option |
- |
medium |
||||||||
|
|
|
|||||||||||
config access-pattern
|
Parameter |
Description |
Type |
Size |
Default |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
id |
URL access pattern ID. |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||
|
negate |
Enable/disable match negation. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
pattern |
URL pattern. |
string |
Maximum length: 511 |
|
||||||
|
regex |
Enable/disable regular expression based pattern match. |
option |
- |
disable |
||||||
|
|
|
|||||||||
|
srcaddr |
Source address. |
string |
Maximum length: 79 |
|
||||||