Web Application Firewall profile settings

Following are the general application firewall profile settings that you must configure on the appliance.

At the command prompt, type:

add appfw profile <name> [-invalidPercentHandling <invalidPercentHandling>] [-checkRequestHeaders ( ON | OFF )] [-URLDecodeRequestCookies ( ON | OFF )] [-optimizePartialReqs ( ON | OFF )]

Example:

add appfw profile profile1 [-invalidPercentHandling secure_mode] [-checkRequestHeaders ON] [-URLDecodeRequestCookies OFF] [-optimizePartialReqs OFF]

Where,

invalidPercentHandling. Configure the method that the application firewall uses to handle percent-encoded names and values.

Available settings function as follows:

asp_mode - Strips and Parses Invalid Percent for Parsing. Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is stripped of and rest of the content is inspected and action taken for SQLInjection check. secure_mode - We detect the Invalid Percent coded value and ignore it . Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is detected, counters are incremented and content is passed as is to the server. apache_mode - This mode works as same as the secure mode. Possible values: apache_mode, asp_mode, secure_mode Default value: secure_mode

optimizePartialReqs. When OFF /ON (without safe object), a Citrix ADC appliance sends partial request to the back-end server. This partial response sent back to client. OptimizePartialReqs makes more sense when Safe object is configured. The appliance sends requests for full response from server when OFF, requests only partial response when ON.

Available settings are as follows:

ON - Partial requests by the client result in partial requests to the back-end server. OFF - Partial requests by the client are changed to full requests to the back-end server Possible values: ON, OFF Default value: ON

URLDecodeRequestCookies. URL Decode request cookies before subjecting them to SQL and cross-site scripting checks.

Possible values: ON, OFF Default value: OFF

optimizePartialReqs. Optimize handle of HTTP partial requests with range headers.

Available settings are as follows: ON - Partial requests by the client result in partial requests to the back-end server. OFF - Partial requests by the client are changed to full requests to the back-end server. Possible values: ON, OFF Default value: ON

Signature Post Body Limit (Bytes). Limits the request payload (in bytes) inspected for signatures with location specified as ‘HTTP_POST_BODY’.

Default value: 8096 Minimum value: 0 Maximum Value: 4294967295

Web Application Firewall profile settings