View PDF
Web Application Firewall profile settings
Following are the general application firewall profile settings that you must configure on the appliance.
At the command prompt, type:
add appfw profile <name> [-invalidPercentHandling <invalidPercentHandling>] [-checkRequestHeaders ( ON | OFF )] [-URLDecodeRequestCookies ( ON | OFF )] [-optimizePartialReqs ( ON | OFF )]
Example:
add appfw profile profile1 [-invalidPercentHandling secure_mode] [-checkRequestHeaders ON] [-URLDecodeRequestCookies OFF] [-optimizePartialReqs OFF]
Where,
invalidPercentHandling. Configure the method that the application firewall uses to handle percent-encoded names and values.
Available settings function as follows:
asp_mode - Strips and Parses Invalid Percent for Parsing. Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is stripped of and rest of the content is inspected and action taken for SQLInjection check.
secure_mode - We detect the Invalid Percent coded value and ignore it . Example:- curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is detected, counters are incremented and content is passed as is to the server.
apache_mode - This mode works as same as the secure mode.
Possible values: apache_mode, asp_mode, secure_mode
Default value: secure_mode
optimizePartialReqs. When OFF /ON (without safe object), a Citrix ADC appliance sends partial request to the back-end server. This partial response sent back to client. OptimizePartialReqs makes more sense when Safe object is configured. The appliance sends requests for full response from server when OFF, requests only partial response when ON.
Available settings are as follows:
ON - Partial requests by the client result in partial requests to the back-end server. OFF - Partial requests by the client are changed to full requests to the back-end server Possible values: ON, OFF Default value: ON
URLDecodeRequestCookies. URL Decode request cookies before subjecting them to SQL and cross-site scripting checks.
Possible values: ON, OFF Default value: OFF
optimizePartialReqs. Optimize handle of HTTP partial requests with range headers.
Available settings are as follows: ON - Partial requests by the client result in partial requests to the back-end server. OFF - Partial requests by the client are changed to full requests to the back-end server. Possible values: ON, OFF Default value: ON
Signature Post Body Limit (Bytes). Limits the request payload (in bytes) inspected for signatures with location specified as ‘HTTP_POST_BODY’.
Default value: 8096 Minimum value: 0 Maximum Value: 4294967295
checkRequestQueryNonHtml = ON/OFF (Check request query parameters as well as web forms for injected SQL and cross-site scripts irrespective of content-type)
set appfw profile <name> -checkRequestQueryNonHtml (ON|OFF)
For appfw profile basic type, this is turned off by default. For appfw profile advanced type, this is turned on by default.
Note:
After you upgrade your appliance, you can see an increase in number of violations to advanced Web Application Firewall profiles if the option turned on, by default. Make sure you explicitly turn off the option if it is not required.