Web Application Firewall (WAF) keeps web services stable and secure. It examines all HTTP and HTTPS requests to detect and block the following attacks: Structured Query Language (SQL) injection, cross-site scripting (XSS), web shells, command and code injections, file inclusion, sensitive file access, third-party vulnerability exploits, Challenge Collapsar (CC) attacks, malicious crawlers, and cross-site request forgery (CSRF).
-
After you enable a WAF instance, add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.
+
After you enable a WAF instance,you still need to add your website domain to the WAF instance on the WAF console. All public network traffic for your website then goes to WAF first. WAF identifies and filters out the illegitimate traffic, and routes only the legitimate traffic to your origin server to ensure site security.
How WAF Works (Dedicated Mode)
After applying for WAF, add the website to WAF on the WAF console. After a website is connected to WAF, all website access requests are forwarded to WAF first. WAF detects and filters out malicious attack traffic, and returns normal traffic to the origin server to ensure that the origin server is secure, stable, and available.
-
Figure 1 How WAF Works
+
Figure 1 How WAF Works
The process of forwarding traffic from WAF to origin servers is called back-to-source. WAF uses back-to-source IP addresses to send client requests to the origin server. When a website is connected to WAF, the destination IP addresses to the client are the IP addresses of WAF, so that the origin server IP address is invisible to the client.
-
Figure 2 Back-to-source IP address
+
Figure 2 Back-to-source IP address
How WAF Works (ELB Access Mode)
If you connect a website to WAFELB access mode, WAF works as follows:
- In this mode, WAF is integrated into the gateway of an ELB load balancer through an SDK module. WAF extracts traffic through the SDK module embedded in the gateway for inspection.
- WAF synchronizes the inspection result to the load balancer, and the load balancer determines whether to forward client requests to the origin server based on the inspection result.
- In this method, WAF does not forward traffic. This reduces compatibility and stability problems.
-
Figure 3 How WAF in ELB load balancer access mode works
+
Figure 3 How WAF in ELB load balancer access mode works
What WAF Protects
Objects WAF can protect: domain names or IP addresses of web applications on the cloud
diff --git a/docs/wafd/umn/waf_01_0054.html b/docs/wafd/umn/waf_01_0054.html
index cea114498..6a9eb9732 100644
--- a/docs/wafd/umn/waf_01_0054.html
+++ b/docs/wafd/umn/waf_01_0054.html
@@ -3,18 +3,18 @@
Configuring Information Leakage Prevention Rules to Protect Sensitive Information from Leakage
You can add two types of information leakage prevention rules.
- Sensitive information filtering: prevents disclosure of sensitive information, such as ID numbers, phone numbers, and email addresses.
- Response code interception: blocks the specified HTTP status codes.
-
Prerequisites
You have added the website you want to protect to WAF or added a new protection policy.
+
Constraints
- It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.
-
Configuring an Information Leakage Prevention Rule
- Log in to the management console.
- Click
in the upper left corner of the management console and select a region or project. - Click
in the upper left corner and choose Web Application Firewall (Dedicated) under Security. - In the navigation pane on the left, click Policies.
- Click the name of the target policy to go to the protection configuration page.
- Click the Information Leakage Prevention configuration area and toggle it on or off if needed.
: enabled.
: disabled.
+Configuring an Information Leakage Prevention Rule
- Log in to the management console.
- Click
in the upper left corner and select a region or project. - Click
in the upper left corner and choose Web Application Firewall (Dedicated) under Security. - In the navigation pane on the left, click Policies.
- Click the name of the target policy to go to the protection configuration page.
- Click the Information Leakage Prevention configuration area and toggle it on or off if needed.
: enabled.
: disabled.
- In the upper left corner above the Information Leakage Prevention rule list, click Add Rule.
- In the dialog box displayed, add an information leakage prevention rule by referring to Table 1. Figure 1 and Figure 2 show the examples.
Information leakage prevention rules prevent sensitive information (such as ID numbers, phone numbers, and email addresses) from being disclosed. This type of rule can also block specified HTTP status codes.
-Sensitive information filtering: Configure rules to mask sensitive information, such as phone numbers and ID numbers, from web pages. For example, you can set the following protection rules to mask sensitive information, such as ID numbers, phone numbers, and email addresses:
Figure 1 Sensitive information leakage
+
Sensitive information filtering: Configure rules to mask sensitive information, such as phone numbers and ID numbers, from web pages. For example, you can set the following protection rules to mask sensitive information, such as ID numbers, phone numbers, and email addresses:
Figure 1 Sensitive information leakage
-
Response code interception: An error page of a specific HTTP response code may contain sensitive information. You can configure rules to block such error pages to prevent such information from being leaked out. For example, you can set the following rule to block error pages of specified HTTP response codes 404, 502, and 503.
Figure 2 Blocking response codes
+
Response code interception: An error page of a specific HTTP response code may contain sensitive information. You can configure rules to block such error pages to prevent such information from being leaked out. For example, you can set the following rule to block error pages of specified HTTP response codes 404, 502, and 503.
Figure 2 Response code interception
-
Table 1 Rule parametersParameter
+Table 1 Parameter descriptionParameter
|
Description
|
@@ -66,13 +66,16 @@
|---|
- Click Confirm. The added information leakage prevention rule is displayed in the list of information leakage prevention rules.
+- Click Confirm. The added information leakage prevention rule is displayed in the list of information leakage prevention rules.
- After the configuration is complete, you can view the added rule in the protection rule list. Rule Status is Enabled by default.
- If you do not want the rule to take effect, click Disable in the Operation column of the rule.
- To delete or modify a rule, click Delete or Modify in the Operation column of the rule.
+
-Related Operations- To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
- To modify a rule, click Modify in the row containing the rule.
- To delete a rule, click Delete in the row containing the rule.
+ Protection VerificationTo verify that WAF is protecting your domain name (www.example.com) according to the protection rule configured by referring to example values in Table 1, take the following steps:
+ - Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.
+
- Clear the browser cache and access the http://www.example.com/admin page. If the sensitive information on the page is masked, the rule takes effect.
- Return to the WAF console. In the navigation pane on the left, click Events. On the displayed page, check event logs.
- Configuration Example — Masking Sensitive InformationTo verify that WAF is protecting your domain name www.example.com against an information leakage prevention rule:
- - Add an information leakage prevention rule.
Figure 3 Sensitive information leakage
- - Enable information leakage prevention.
Figure 4 Information Leakage Prevention configuration area
+Configuration Example: Masking Sensitive InformationYou can take the following steps to verify that WAF is protecting your website domain name (www.example.com) based on the information leakage prevention rule you configure.
+ - Add an information leakage prevention rule.
Figure 3 Sensitive information leakage
+ - Enable information leakage prevention.
Figure 4 Information Leakage Prevention configuration area
- Clear the browser cache and access http://www.example.com/admin/.
The email address, phone number, and identity number on the returned page are masked.
WAF Operations Recorded by CTS
CTS provides records of operations on WAF. With CTS, you can query, audit, and backtrack these operations. For details, see the Cloud Trace Service User Guide.
- Table 1 WAF Operations Recorded by CTSOperation
+Table 1 WAF Operations Recorded by CTSOperation
|
-Resource Type
+ | Resource Type
|
-Trace Name
+ | Trace Name
|
|---|
-Creating a WAF instance
+ | Creating a WAF instance
|
-instance
+ | instance
|
-createInstance
+ | createInstance
|
-Deleting a WAF instance
+ | Deleting a WAF instance
|
-instance
+ | instance
|
-deleteInstance
+ | deleteInstance
|
-Modifying a WAF instance
+ | Modifying a WAF instance
|
-instance
+ | instance
|
-alterInstanceName
+ | alterInstanceName
|
-Modifying the protection status of a WAF instance
+ | Modifying the protection status of a WAF instance
|
-instance
+ | instance
|
-modifyProtectStatus
+ | modifyProtectStatus
|
-Modifying the connection status of a WAF instance
+ | Modifying the connection status of a WAF instance
|
-instance
+ | instance
|
-modifyAccessStatus
+ | modifyAccessStatus
|
-Creating a WAF policy
+ | Creating a WAF policy
|
-policy
+ | policy
|
-createPolicy
+ | createPolicy
|
-Applying a WAF policy
+ | Applying a WAF policy
|
-policy
+ | policy
|
-applyToHost
+ | applyToHost
|
-Modifying a policy
+ | Modifying a policy
|
-policy
+ | policy
|
-modifyPolicy
+ | modifyPolicy
|
-Deleting a WAF policy
+ | Deleting a WAF policy
|
-policy
+ | policy
|
-deletePolicy
+ | deletePolicy
|
-Uploading a certificate
+ | Uploading a certificate
|
-certificate
+ | certificate
|
-createCertificate
+ | createCertificate
|
-Changing the name of a certificate
+ | Changing the name of a certificate
|
-certificate
+ | certificate
|
-modifyCertificate
+ | modifyCertificate
|
-Deleting a certificate from WAF
+ | Deleting a certificate from WAF
|
-certificate
+ | certificate
|
-deleteCertificate
+ | deleteCertificate
|
-Adding a CC attack protection rule
+ | Adding a CC attack protection rule
|
-policy
+ | policy
|
-createCc
+ | createCc
|
-Modifying a CC attack protection rule
+ | Modifying a CC attack protection rule
|
-policy
+ | policy
|
-modifyCc
+ | modifyCc
|
-Deleting a CC attack protection rule
+ | Deleting a CC attack protection rule
|
-policy
+ | policy
|
-deleteCc
+ | deleteCc
|
-Adding a precise protection rule
+ | Adding a precise protection rule
|
-policy
+ | policy
|
-createCustom
+ | createCustom
|
-Modifying a precise protection rule
+ | Modifying a precise protection rule
|
-policy
+ | policy
|
-modifyCustom
+ | modifyCustom
|
-Deleting a precise protection rule
+ | Deleting a precise protection rule
|
-policy
+ | policy
|
-deleteCustom
+ | deleteCustom
|
-Adding an IP address blacklist or whitelist rule
+ | Adding an IP address blacklist or whitelist rule
|
-policy
+ | policy
|
-createWhiteblackip
+ | createWhiteblackip
|
-Modifying an IP address blacklist or whitelist rule
+ | Modifying an IP address blacklist or whitelist rule
|
-policy
+ | policy
|
-modifyWhiteblackip
+ | modifyWhiteblackip
|
-Deleting an IP address blacklist or whitelist rule
+ | Deleting an IP address blacklist or whitelist rule
|
-policy
+ | policy
|
-deleteWhiteblackip
+ | deleteWhiteblackip
|
-Creating/updating a web tamper protection rule
+ | Creating/updating a web tamper protection rule
|
-policy
+ | policy
|
-createAntitamper
+ | createAntitamper
|
-Deleting a web tamper protection rule
+ | Deleting a web tamper protection rule
|
-policy
+ | policy
|
-deleteAntitamper
+ | deleteAntitamper
|
-Creating a global protection whitelist rule
+ | Creating a global protection whitelist rule
|
-policy
+ | policy
|
-createIgnore
+ | createIgnore
|
-Deleting a global protection whitelist rule
+ | Deleting a global protection whitelist rule
|
-policy
+ | policy
|
-deleteIgnore
+ | deleteIgnore
|
-Adding a data masking rule
+ | Adding a data masking rule
|
-policy
+ | policy
|
-createPrivacy
+ | createPrivacy
|
-Modifying a data masking rule
+ | Modifying a data masking rule
|
-policy
+ | policy
|
-modifyPrivacy
+ | modifyPrivacy
|
-Deleting a data masking rule
+ | Deleting a data masking rule
|
-policy
+ | policy
|
-deletePrivacy
+ | deletePrivacy
|
diff --git a/docs/wafd/umn/waf_01_0060.html b/docs/wafd/umn/waf_01_0060.html
index f9b7fd550..2d17b03d0 100644
--- a/docs/wafd/umn/waf_01_0060.html
+++ b/docs/wafd/umn/waf_01_0060.html
@@ -1,20 +1,20 @@
Viewing CTS Traces in the Trace List
-ScenariosAfter you enable CTS and the management tracker is created, CTS starts recording operations on cloud resources. Cloud Trace Service (CTS) stores operation records (traces) generated in the last seven days.
+ ScenariosAfter you enable Cloud Trace Service (CTS) and the management tracker is created, CTS starts recording operations on cloud resources. CTS stores operation records (traces) generated in the last seven days.
- Viewing Real-Time Traces in the Trace List- Log in to the management console.
- Click
 in the upper left corner and choose Management & Deployment > Cloud Trace Service. The CTS console is displayed. - Choose Trace List in the navigation pane on the left.
- Set filters to search for your desired traces, as shown in Figure 1. The following filters are available.
Figure 1 Filters
+Viewing Real-Time Traces in the Trace List- Log in to the management console.
- Click
 in the upper left corner and choose Management & Deployment > Cloud Trace Service. The CTS console is displayed. - Choose Trace List in the navigation pane on the left.
- Set filters to search for your desired traces, as shown in Figure 1. The following filters are available.
Figure 1 Filters
- Trace Type, Trace Source, Resource Type, and Search By: Select a filter from the drop-down list.
- If you select Resource ID for Search By, specify a resource ID.
- If you select Trace name for Search By, specify a trace name.
- If you select Resource name for Search By, specify a resource name.
- - Operator: Select a user.
- Trace Status: Select All trace statuses, Normal, Warning, or Incident.
- Time range: Select Last 1 hour, Last 1 day, or Last 1 week, or specify a custom time range within the last seven days.
+ - Operator: Select a user.
- Trace Status: Select All trace statuses, Normal, Warning, or Incident.
- Time range: Select Last 1 hour, Last 1 day, or Last 1 week, or specify a custom time range within the last seven days.
- Click Query.
- On the Trace List page, you can also export and refresh the trace list.
- Click Export to export all traces in the query result as a CSV file. The file can contain up to 5,000 records.
- Click
 to view the latest information about traces.
- - Click
 on the left of a trace to expand its details.
-
-
+ - Click Query.
- On the Trace List page, you can also export and refresh the trace list.
- Click Export to export all traces in the query result as a CSV file. The file can contain up to 5,000 records.
- Click
 to view the latest information about traces.
+ - Click
 on the left of a trace to expand its details.
+
+
- - Click View Trace in the Operation column. The trace details are displayed.
- - For details about key fields in the trace structure, see Trace Structuresection "Trace References" > "Trace Structure" and Example Tracessection "Trace References" > "Example Traces" in the CTS User Guide.
+ - Click View Trace in the Operation column. The trace details are displayed.
+ - For details about key fields in the trace structure, see Trace Structuresection "Trace References" > "Trace Structure" and Example Tracessection "Trace References" > "Example Traces" in the CTS User Guide.
diff --git a/docs/wafd/umn/waf_01_0061.html b/docs/wafd/umn/waf_01_0061.html
index 0d343d8af..e1d965bcc 100644
--- a/docs/wafd/umn/waf_01_0061.html
+++ b/docs/wafd/umn/waf_01_0061.html
@@ -2,9 +2,9 @@
Adding Rules to One or More Policies
This topic describes how to add rules to one or more policies.
- Adding Rules to One or More Policies- Log in to the management console.
- Click in the upper left corner of the management console and select a region or project.
- Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
- In the navigation pane on the left, click Policies.
- In the upper left corner of the policy list, click View Rules.
Figure 1 View Rules
- - In the upper left corner above a list of a type of rule, click Add Rule.
Figure 2 Adding a rule to one or more policies
- - Select one or more policies from the Policy Name drop-down list.
Figure 3 Adding a rule to one or more policies
+Adding Rules to One or More Policies- Log in to the management console.
- Click in the upper left corner and select a region or project.
- Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
- In the navigation pane on the left, click Policies.
- In the upper left corner of the policy list, click View Rules.
Figure 1 View Rules
+ - In the upper left corner above a list of a type of rule, click Add Rule.
Figure 2 Adding a rule to one or more policies
+ - Select one or more policies from the Policy Name drop-down list.
Figure 3 Adding a rule to one or more policies
- Set other parameters in addition to Policy Name.
- To add a CC attack protection rule, see Table 1.
- To add a precise protection rule, see Table 1.
- To add a blacklist or whitelist rule, see Table 1.
- To add a geolocation access control rule, see Table 1.
- To add a WTP rule, see Table 1.
- To add an information leakage prevention rule, see Table 1.
- To add a global protection whitelist rule, see Table 1.
- To add a data masking rule, see Table 1.
- Click Confirm.
What Is Error Code 404, 502, or 504 Returned to Visitors After My Website or Application Is Connected to WAF?
If an error, such as 404 Not Found, 502 Bad Gateway, or 504 Gateway Timeout, occurs after your website or application is connected to WAF, use the following methods to locate the cause and remove the error:
- 404 Not FoundScenario 1: When a visitor accesses your website, the page shown in Figure 1 is displayed. Figure 1 404 page
+ 404 Not FoundScenario 1: When a visitor accesses your website, the page shown in Figure 1 is displayed. Figure 1 404 page
- Cause: The port added to a URL is incorrect. - A non-standard port is configured when a domain name is connected to WAF. No port is added or the origin server port instead of the non-standard port is used to access the website. For example, use https://www.example.com or https://www.example.com:80 to access the website. Figure 2 shows an example.
Figure 2 Configuration of a non-standard port
+Cause: The port added to a URL is incorrect. - A non-standard port is configured when a domain name is connected to WAF. No port is added or the origin server port instead of the non-standard port is used to access the website. For example, use https://www.example.com or https://www.example.com:80 to access the website. Figure 2 shows an example.
Figure 2 Configuration of a non-standard port
Solution: Add the non-standard port to the URL and access the origin server again, for example, https://www.example.com:8080.
- - No non-standard port is configured when a domain name is added to WAF. A non-standard port or the origin server port is used to access the website. For example, use https://www.example.com:8080 to access the website. Figure 3 shows an example.
Figure 3 Non-standard port not configured
+ - No non-standard port is configured when a domain name is added to WAF. A non-standard port or the origin server port is used to access the website. For example, use https://www.example.com:8080 to access the website. Figure 3 shows an example.
Figure 3 Non-standard port not configured
 If no non-standard port is configured, WAF protects services on port 80/443 by default. To protect services on other ports, re-configure domain settings.
Solution: The domain name needs to be accessed directly. For example, https://www.example.com.
@@ -22,7 +22,7 @@
Possible causes are as follows:
|
|---|
|
|---|
in the upper left corner of the management console and select a region or project.
in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
