Order of domains in WAF rules

Hello Martijn,

you mean the list of domains within a WAF rule..?

This is the list of domains the rule should respond to.

The order of the domains doesn't matter at all.

Yes, i know that, but it is rather annoying that its not alphabetical but apparently its "time" based. As in, whichever name got added first will always stay on top, no matter if you delete it, add 5 other domains and then later add it again, it will again be on top.

So when we have to scroll trough it to find one in particular, its annoying.

I know its a minor issue, but we are having other problems right now which has a lot of impact on what is the TOP domain listed in a WAF rule, as the WAF rule seems to default to the top listed domain when something goes wrong, thus changing the requested url from one domain to another one.

Case: 07051005 (sophos.com)

Hi Martijin,

Thank you for reaching out to Sophos Community.

Upon checking your case update. The Case handler is requesting a schedule for a remote session.

For the Plan of Action. kindly see below.

• Please take the pcap screenshot for the working and nonworking scenarios to confirm the WAF rule.
• Har file when for working and non-working scenarios.
• Need to collect working and non-working WAF PCAP and WAF debug logs.
• Need to check if it’s working with the DNAT rule or not.

Hi,

As per the update on the case. The case handler's Plan of Action is the following:

"Triage with GES to apply the workaround."

Hi, 

As per the update on the case, this was resolved upon change with a Firewall Rule.

"Change of the specific table entry related to fwrule id 25, which includes a WAF service restart afterward."

Hi, 

As per the update on the case, this was resolved upon change with a Firewall Rule.

"Change of the specific table entry related to fwrule id 25, which includes a WAF service restart afterward."