Configuring Bot Defense in Enterprise Service Level

Configuring Bot Defense in Enterprise service level for web

Before configuring Bot Defense you need to configure a Proxy Pool or Shape Protection pool, or select an existing pool during configuration. For more information, refer to BIG-IP Local Traffic Management: Basics - Introduction to pools.

Use this task to configure the Bot Defense in Enterprise service level for protecting web pages.

Note: The screen elements described here are for basic configuration. Refer to the help text available in the configuration utility for details about all the fields.

1. On the Main tab, click SaaS Services > Bot Defense > BD Profiles.

   The BD Profiles screen displays the list of Bot Defense profiles on the system.

2. In the General Properties section, enter the following details:

   • In the Name field, enter a unique name for the Bot Defense profile.

   • In the Parent Profile field, select the Bot Defense parent profile from which this profile will inherit settings.

   • For the Service Level field, select Enterprise.

   • For the Applications in Scope field, check Web.

3. In the API Request Settings section, in the Import API Settings field, check Upload File and click the Choose File button to import a JSON file with predefined values or check Paste Text to enter the JSON file content. The contents of the file must be in a valid JSON format.

4. In the JS Injection Configuration section, the BIG-IP Handles JS Injections field is checked by default, if you uncheck the field then follow the Note given in the Web UI.

5. In the Shape Endpoints Configuration section, enter the following details:

   Note: The GET (Document) field is checked only when the Bot Defense is required for web scraping.

   • In the Mitigation Handler field, select BIG-IP if you want to handle the mitigation actions or select Shape Policy to let the system handle the mitigation of malicious HTTP requests.

   • In the Shape Protected URIs field, enter the following details and click the Add button:

     • In the Host field, enter the hostname or IP address of the web page to be protected by the Bot Defense.

     • In the Endpoint field, enter the path to the web page.

     • Check the ANY Method field to protect the path when it has any method.

       Note: You must check (enable) at least one of the methods or ANY Method field, else, the HTTP requests will not be routed.

     • Check the GET (XHR/Fetch) field to protect the path when it has a GET method.

     • Check the POST field to protect the path when it has a POST method.

     • Check the PUT field to protect the path when it has a PUT method.

     • In the Mitigation Action field, choose the mitigation action you want the BIG-IP to take if a malicious HTTP request is detected on the endpoint.

       Note: The Mitigation Action field is available only when BIG-IP is selected in the Mitigation Handler field.

     Click the Add button to add the URI. You can add multiple URIs, use the Edit and Delete buttons to update or delete a URI from the list.

6. In the Advanced Features section, select Advanced, enter the following details:

   • Check the Use Proxy field if you want the data to be routed through a proxy server, else uncheck this field to send data directly from the BIG-IP to the Bot Defense backend server.

   • In the Proxy Pool field, select an existing pool or click the + button to add a new pool.

     Note: The Proxy Pool field is displayed when the Use Proxy field is checked.

   • In the Proxy Shape Endpoint URL field, enter the web URL that is used to redirect HTTP requests to the Bot Defense backend server.

     Note: The Proxy Shape Endpoint URL field is displayed when the Use Proxy field is checked.

   • In the Shape Protection Pool field, select an existing pool or click the + button to add a new pool.

     Note: The Shape Protection Pool field is displayed when the Use Proxy field is unchecked.

   • In the SSL Profile field, select the server-side SSL profile.

   • In the Allow IP addresses field, enter the IP addresses that do not need to be checked by the Bot Defense.

   • In the Allow Headers field, enter the name and value for a header in an HTTP request that does not need to be checked by the Bot Defense.

7. Click the Finished button.

   The Bot Defense profile is created.

Assign the Bot Defense profile to Virtual Server, refer to Assigning a Bot Defense profile to Virtual Server.

Configuring Bot Defense in Enterprise service level for web scraping

Before configuring the Bot Defense for web scraping (interstitial), configure the Bot Defense profile in Enterprise service level for web and update the Shape Protected URIs field, refer to Configuring Bot Defense in Enterprise service level for web.

Use this task to configure the Bot Defense in Enterprise service level for protecting traffic from web scraping.

1. On the Main tab, click SaaS Services > Bot Defense > BD Profiles.

   The BD Profiles screen displays the list of Bot Defense profiles on the system.

2. Click the Bot Defense profile for which web scraping is configured.

3. In the Shape Endpoints Configuration section, enter the following details:

   • In the Mitigation Handler field, select BIG-IP if you want to handle the mitigation actions or select Shape Policy to let the system handle the mitigation of malicious HTTP requests.

   • In the Shape Protected URIs field, enter the following details and click the Add button:

     • In the Endpoint field, enter the path to the web page.

     • Check the GET (Document) field to protect the path from web scrapping.

       Note: When you check (enable) GET (Document) field, no other method can be enabled.

     • In the Mitigation Action field, choose the mitigation action you want the BIG-IP to take if a malicious HTTP request is detected on the endpoint.

       Note: The Mitigation Action field is available only when BIG-IP is selected in the Mitigation Handler field.

     Click the Add button to add the URI. You can add multiple URIs, use the Edit and Delete buttons to update or delete a URI from the list.

4. Click the Update button.

Configuring Bot Defense in Enterprise service level for mobile

Before configuring Bot Defense you need to configure a Proxy Pool or Shape Protection pool, or select an existing pool during configuration. For more information, refer to BIG-IP Local Traffic Management: Basics - Introduction to pools.

Use this task to configure the Bot Defense in Enterprise service level for mobile applications. If you want to configure Bot Defense for both mobile and web in the same profile, then in Applications in Scope field check Web and Mobile and configure respective screen elements. Use Configuring Bot Defense in Enterprise service level for web task for reference.

Note: The screen elements described here are for basic configuration. Refer to the help text available in the configuration utility for details about all the fields.

1. On the Main tab, click SaaS Services > Bot Defense > BD Profiles.

   The BD Profiles screen displays the list of Bot Defense profiles on the system.

2. Click the Create button.

   The New BD Profile screen opens.

3. In the General Properties section, enter the following details:

   • In the Name field, enter a unique name for the Bot Defense profile.

   • In the Parent Profile field, select the Bot Defense parent profile from which this profile will inherit settings.

   • For the Service Level field, select Enterprise.

   • For the Applications in Scope field, check Mobile. The Web is checked by default, you can uncheck Web if the Bot Defense profile is only used to protect mobile application. You can leave the Web as checked, if the Bot Defense profile is used to protect both web page and mobile application.

4. In the API Request Settings section, in the Import API Settings field, check Upload File and click the Choose File button to import a JSON file with predefined values or check Paste Text to enter the JSON file content. The contents of the file must be in a valid JSON format.

5. In the Mobile Protected Endpoints Configuration section, enter the following details:

   • In the Mitigation Handler field, select BIG-IP if you want to handle the mitigation actions or select Shape Policy to let the system handle the mitigation of malicious HTTP requests for mobile application.

   • In the Mobile Protected URIs field, enter the following details and click the Add button:

     • In the Host field, enter the hostname or IP address of the mobile application to be protected by the Bot Defense.

     • In the Endpoint field, enter the path to the mobile application.

     • Check the ANY Method field to protect path the when it has any method.

       Note: You must check (enable) at least one of the methods or ANY Method field, else, the HTTP requests will not be routed.

     • Check the GET field to protect the path when it has a GET method.

     • Check the POST field to protect the path when it has a POST method.

     • Check the PUT field to protect the path when it has a PUT method.

     • Use the Check Mobile Identifier field if the URL is same for web and mobile, select Header to request the information, or select Skip to ignore.

     • In the Mitigation Action field, choose the mitigation action you want the BIG-IP to take if a malicious HTTP request is detected on the endpoint.

       Note: The Mitigation Action field is available only if the Mitigation Handler field is set to BIG-IP.

     Click the Add button to add the URI. You can add multiple URIs, use the Edit and Delete buttons to update or delete a URI from the list.

   • In the SDK Reload Headername filed, enter the reload header prefix.

   • In the SDK Config Fetch URL - Android, enter the URL to fetch SDK configuration for android.

   • In the SDK Config Fetch URL - iOS, enter the URL to fetch SDK configuration for iOS.

6. In the Advanced Features section, select Advanced, enter the following details:

   • Check the Use Proxy field if you want the data to be routed through a proxy server, else uncheck this field to send data directly from the BIG-IP to the Bot Defense backend server.

   • In the Proxy Pool field, select an existing pool or click the + button to add a new pool.

     Note: The Proxy Pool field is displayed when the Use Proxy field is checked.

   • In the Proxy Shape Endpoint URL - Mobile field, enter the application URL that is used to redirect HTTP requests to the Bot Defense backend server.

     Note: The Proxy Shape Endpoint URL - Mobile field is displayed when the Use Proxy field is checked.

   • In the Shape Protection Pool - Mobile field, select an existing pool or click the + button to add a new pool.

     Note: The Shape Protection Pool - Mobile field is displayed when the Use Proxy field is unchecked.

   • In the SSL Profile field, select the server-side SSL profile.

   • In the Allow IP addresses field, enter the IP addresses that do not need to be checked by the Bot Defense.

   • In the Allow Headers field, enter the name and value for a header in an HTTP request that does not need to be checked by the Bot Defense.

Assign the Bot Defense profile to Virtual Server, refer to Assigning a Bot Defense profile to Virtual Server.