This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF Exceptions

Has anyone tested WAF exceptions? I have a certain page I would like to exclude from checks. When I put in an exception the WAF rules still apply and the page fails. If i do not put in any WAF checks globally the page works properly.

This thread was automatically locked due to age.

Parents

0 Evianne over 8 years ago

Hi,

could you please provide more information?
Which features are enabled in the Application Protection Policy?
How did you configure the exception?

Sabine
Cancel
Vote Up 0 Vote Down

Cancel
0 EdDe Sousa over 8 years ago in reply to Evianne

on the main policy I know which ones to turn off to get it to work but I have attached the currently configured version.

the error i get is

Inbound Anomaly Score Exceeded (Total Score: 13, SQLi=6, XSS=): La

with status code 403
Cancel
Vote Up 0 Vote Down

Cancel
0 Evianne over 8 years ago in reply to EdDe Sousa

Sorry for the late response.

Could you please also post the complete log lines (with blackened domain name and IP addresses)?
Cancel
Vote Up 0 Vote Down

Cancel
0 EdDe Sousa over 8 years ago in reply to Evianne

2015-12-24 09:21:24

some.domain.com:9443

84.22.101.37

/sabnzbd/api

WAF Anomaly

Inbound Anomaly Score Exceeded (Total Score: 8, SQLi=1, XSS=): Last Matched Message: Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded

403

772

3355

17071

7
Cancel
Vote Up 0 Vote Down

Cancel
0 Evianne over 8 years ago in reply to EdDe Sousa

Hi,

please put an asterisk at the end of your exception path:
'/sabnzbd/api*'

Please try again.

Sabine
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Evianne over 8 years ago in reply to EdDe Sousa

Hi,

please put an asterisk at the end of your exception path:
'/sabnzbd/api*'

Please try again.

Sabine
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 EdDe Sousa over 8 years ago in reply to Evianne

seems to have worked. Thank you!
Cancel
Vote Up 0 Vote Down

Cancel
0 Evianne over 8 years ago in reply to EdDe Sousa

You're welcome.

It should be also enough if you only skip 'SQL Injection Attacks' in your exception.
Cancel
Vote Up 0 Vote Down

Cancel