Central Policy Building

Transparent

. Specifies that blocking is disabled for the security policy. This disables blocking for all options on the screen, and the

Block

check boxes are unavailable.

Blocking

. Specifies that blocking is enabled for the security policy, and you can enable or disable blocking for individual violations.

Automatic

has the system examine traffic, make suggestions, and enforce most suggestions after sufficient traffic over a period of time from various users make it reasonable to add them. A few suggestions must be enforced manually.

Manual

has the system examine traffic and make suggestions on what to add to the security policy.

Disabled

has the system do no learning for the security policy, and make no suggestions.

To have policy building occur on the local BIG-IP device, select

Local

.

To have policy building occur on a central policy builder device that can take information from multiple BIG-IP devices, select

Central

.

To have the central policy building device chosen automatically, select

Auto Select

.

To manually choose the device to use for central policy building, select the device.

To have learning applied to the policy and deployed as it occurs, select

Real Time

.

To have learning applied to a policy and deployed at a scheduled time, select

Scheduled

, and then specify that time and day.

To have learning applied and deployed at any time during the day, select
All Day
.
To have learning applied and deployed at a certain time during the day, select
Specific Time
and provide that time.
To have learning applied and deployed every day of the week, select
All Week
.
To have learning applied and deployed on selected days of the week, select
Specific Days
and specify the days.

To have the system not apply learning and deploy the security policy, select

Disabled

.

To have the Policy Builder learn traffic from a small number of requests, sessions, and IP addresses, select

Fast

. Using this setting, there is a high chance that the Policy Builder will add false entities to the security policy.

To have the Policy Builder learn traffic from a medium amount of requests, sessions, and IP addresses, select

Medium

. Using this setting, there is a medium chance that the Policy Builder will add false entities to the security policy.

To have the Policy Builder learn traffic from a large number of requests, sessions, and IP addresses, select

Slow

. Using this setting, there is a low chance that the Policy Builder will add false entities to the security policy.

To have the Policy Builder use custom settings in the policy, select

Custom

. The

Custom

option is selected automatically when you customize settings in the policy.

Learn

specifies that when a request triggers this violation, the system learns the request.

Alarm

specifies that if a request triggers this violation, the system records the request.

Block

specifies that if this violation occurs, the system takes these actions:

Records the request.
Blocks the request that triggered the violation.
Returns the blocking response page to the client who sent the request.

Bad HTTP version

. When checked (enabled), the system inspects requests to see whether they request information from a client using a legal HTTP protocol version number (0.9 or higher). The default setting is enabled

Bad host header value

. When checked (enabled), the system inspects requests to see whether they contain a non RFC compliant header value. The default value is enabled.

Bad multipart parameters parsing

. When checked (enabled), the system examines requests to see whether the content-disposition header field matches the format,

name=“param_key”;\r\n

. The default setting is enabled.

Bad multipart/form-data request parsing

. When checked (enabled), the system examines requests to see whether the content-disposition header field contains the required parameters,

name=“param_key”

. The default setting is enabled.

Body in GET or HEAD requests

. When checked (enabled), the system examines requests that use the GET or HEAD methods to see whether the requests contain data in their bodies, which is considered illegal. The default setting is disabled.

CRLF characters before request start

. When checked (enabled), the system examines requests to see whether they begin with the characters CRLF, which is not permitted. The default setting is enabled.

Check maximum number of headers

. When checked (enabled), the system compares the number of headers in the requests against the maximum number you specify here. Type a number in the field to specify how many headers are allowed. The default setting is enabled with a maximum of 20 headers unless the policy is based on an Application-Ready security policy template. In this case, the default value depends on which template you are using.

Check maximum number of parameters

. When checked (enabled), the system compares the number of parameters in the request against the maximum number you specify here. A request that contains more parameters than allowed by the policy should be considered a possible attack on the server. Type a number in the field to specify how many parameters are allowed. The default value is enabled set to a maximum of 500 parameters.

Chunked request with Content-Length header

. When checked (enabled), the system examines chunked requests for a content-length header, which is not permitted. The default setting is enabled.

Content length should be a positive number

. When checked (enabled), the system examines requests to see whether their content length value is greater than zero, which is required. The default setting is enabled.

Header name with no header value

. When checked (enabled), the system checks requests for valueless header names, which are considered illegal. The default setting is enabled.

High ASCII characters in headers

. When checked (enabled), the system inspects request headers for ASCII characters greater than 127, which are not permitted. The default setting is disabled.

Host header contains IP address

. When checked (enabled), the system verifies that the request’s host header value is not an IP address. The default setting is disabled.

Multiple host headers

. When checked (enabled), the system examines requests to ensure that they contain only a single Host header. The default value is enabled.

No Host header in HTTP/1.1 request

. When checked (enabled), the system examines requests sent by a client using HTTP version 1.1 to see whether they contain a host header, which is required. The default setting is enabled.

Null in request

. When checked (enabled), the system inspects requests to see whether they contain a Null character, which is not allowed. The default setting is enabled.

POST request with Content-Length 0

. When checked (enabled), the system examines POST method requests for no content-length header, and for a content length of 0. The default setting is disabled.

Several Content-Length headers

. When checked (enabled), the system examines each request to see whether it has more than one content-length header, which is considered illegal. The default setting is enabled.

Unparseable request content

. When checked (enabled), the system examines requests for content that the system cannot parse, which is not permitted. The default setting is enabled.

%u decoding

. Indicates that the system performs %u decoding (%UXXXX where X is a hexadecimal digit). For example, the system turns a%u002fb to a/b. The system performs this action on URI and parameter input.

Apache whitespace

. Indicates that the system discovers the bytes 0x09, 0x0b, or 0x0c (a non-RFC standard of using tab for a space delimiter). The violation applies to URI input. However, for this violation, the system does not change the input.

Bad unescape

. Indicates that the system discovers illegal URL-encoding. For example, if the two bytes after % are not hexadecimal characters, or if the four bytes after %u are not a hexadecimal characters. This violation applies to URI and parameter input. However, for this violation, the system does not change the input.

Bare byte decoding

. Indicates that the system discovers characters higher than ASCII-127. This violation applies to URI input. However, for this violation, the system does not change the input.

Directory traversals

. Indicates that the system clears self references and performs directory traversals so that attackers cannot try to access restricted Web server files residing outside of the Web server’s root directory. For example, the system turns a/b/../c to a/c and a/./b to a/b. The system performs this action on URI input.

IIS Unicode codepoints

. Indicates that, when XXXX is greater than 0x00FF, the system decodes %u according to an ANSI Latin 1 (Windows 1252) code page mapping. For example, the system turns a%u2044b to a/b. The system performs this action on URI and parameter input.

IIS backslashes

. Indicates that the system turns backslashes (\) into slashes (/). The system performs this action on URI input.

Multiple decoding

. Indicates that the system performs multiple decoding. Use the decoding passes drop-down control to specify the number (up to 5) of decoding passes. For example, the system can turn a%252fb to a/b (since %252f becomes %2f after one pass, and / after the second pass). The system performs this action on URI and parameter input. Select a number to specify how many decoding passes the system performs, and the level at which the system responds with the appropriate Alarm or Block action. For example, if you set this to

3

, the system performs two decoding passes, and when it performs the third decoding pass, it takes the action specified by the Learn/Alarm/Block settings of the Evasion technique detected category.

Illegal query string length

. The incoming request contains a query string whose length exceeds the acceptable length specified in the policy.

Illegal POST data length

. The incoming request contains POST data whose length exceeds the acceptable length specified in the policy.

Illegal request length

. The incoming request length exceeds the acceptable length specified in the policy per the requested file type.

Illegal file type

. The incoming request references file types not found in the policy.

Illegal URL length

. The incoming request includes a URL whose length exceeds the acceptable length specified in the policy.

In the

Learn New HTTP URLs

setting, select under which circumstances the Policy Builder adds, or suggests you add, HTTP URLs to the security policy. As you select the setting, additional information about the setting is displayed below it.

In the

Maximum Learned HTTP URLs

setting, type the maximum number. The default value changes based on the value of the

Learn New HTTP URLs

setting.

In the

Learn New WebSocket URLs

setting, select under which circumstances the Policy Builder adds, or suggests you add, WebSocket URLs to the security policy. As you select the setting, additional information about the setting is displayed below it.

In the

Maximum Learned WebSocket URLs

setting, type the maximum number,

In the

Classify Request Content of Learned HTTP URLs

setting, use the

Enabled

check box to specify whether it should be enabled. When enabled, if the Policy Builder detects legitimate XML or JSON data to URLs configured in the security policy, the Policy Builder adds XML or JSON profiles to the security policy and configures their attributes according to the data it detects.

In the

Classify Client Message Payload Format of Learned WebSocket URLs

setting, use the

Enabled

check box to specify whether it should be enabled. When enabled, if the Policy Builder detects legitimate plain text or JSON data to WebSocket URLs configured in the security policy, the Policy Builder adds Plain Text or JSON profiles to the security policy and configures their attributes according to the data it detects.

In the

Learn Allowed Methods on HTTP URLs

setting, use the

Enabled

check box to specify whether it should be enabled. When enabled, if the Policy Builder detects a method used in a request that is not in the security policy’s list of generic methods, the Policy Builder adds the new method to the security policy and associates it to the specific requested URL.

In the

Collapse many common HTTP URLs into one wildcard HTTP URL

setting, use the

Enabled

check box to specify whether it should be enabled. When enabled, the system collapses many common explicit URLs into one wildcard URL with a common prefix and suffix. The Policy Builder collapse only URLs in the same directory (with the same prefix path), and if they have the same file extension. You can also type the number of occurrences and the depth.

In the

File types for which wildcard HTTP URLs will be configured

setting, select which file types to add or delete.

In the

Learn New Parameters

setting, select under which circumstances the Policy Builder adds, or suggests you add, explicit parameters to the security policy. As you select the setting, additional information about the setting is displayed below it.

In the

Maximum Learned Parameters

setting, type the maximum number of parameters that the security policy allows.

In the

Parameter Level

setting, select how the Policy Builder determines on which level to add, or suggest you add, parameters to the security policy. Select

Global

or

URL

, and review the information displayed about each.

In the

Collapse many common Parameters into one wildcard Parameter

setting, select the check box to specify that the system collapses many common parameters into one wildcard parameter. In the field, type how many explicit parameters the Policy Builder must detect (the number of occurrences) before collapsing them to one wildcard parameter.

In the

Classify Value Content of Learned Parameters

setting, when enabled, specifies that if the Policy Builder detects legitimate XML or JSON data to parameters configured in the security policy, the Policy Builder adds XML or JSON profiles to the security policy and configures their attributes according to the data it detects.

In the

Learn Integer Parameters

setting, specifies, when enabled, that the Policy Builder learns integer parameters.

In the

Learn Dynamic Parameters

setting, you specify the conditions under which the Policy Builder adds dynamic parameters to the security policy.

In the

Learn New Cookies

setting, select the circumstances the Policy Builder adds, or suggests you add, explicit cookies to the security policy. As you select the setting, additional information about the setting is displayed below it.

In the

Maximum Learned Cookies

setting, type the largest number of cookies that the policy allows.

In the

Learn and enforce new unmodified cookies

setting, specify, when the

Enabled

check box is selected, that the system enforces new cookies as long as they were not modified by the client. This option only appears if the

Learn New Cookies

option is set to

Selective

and the * wildcard cookie is of type

Allowed

.

In the

Collapse many common Cookies into one wildcard Cookie

setting, you specify, when the

Enabled

check box is selected, that the system collapses many common cookies into one wildcard cookie. Type in the box how many explicit cookies the Policy Builder must detect (the number of occurrences) before collapsing them to one wildcard cookie.

Certificate Error

. When checked (enabled), the system learns, logs, or blocks responses when the client certificate extracted from the document is invalid. The default setting is enabled. Possible causes include the following instances.

The client certificate structure is invalid, and cannot be parsed.
The client certificate is not found in the keystore.

Certificate Expired

. When checked (enabled), the system learns, logs, or blocks responses when the client certificate extracted from the document has expired. The default setting is enabled. Possible causes include the following instances.

The client certificate structure is invalid and cannot be parsed.
The client certificate is not found in the key-store.

Decryption Error

. When checked (enabled), the system learns, logs, or blocks requests when an encrypted section in the request could not be decrypted. The default setting is enabled. Possible causes include the following instances.

The message could not be decrypted since no key information was found.
The encryption algorithm is not supported.

Encryption Error

. When checked (enabled), the system learns, logs, or blocks responses when the system cannot encrypt a section requested by the user. For example, the message cannot be encrypted if no key information was detected in the request. The default setting is enabled.

Expired Timestamp

. When checked (enabled), the system learns, logs, or blocks requests when the timestamp has expired. The default setting is enabled.

Internal Error

. When checked (enabled), the system learns, logs, or blocks requests and/or responses when the system’s web services security offload engine confronts an unexpected scenario. For example, if a resource fails to allocate. The default setting is enabled.

Invalid Timestamp

. When checked (enabled), the system learns, logs, or blocks requests when the timestamp is not formatted according to the specifications. The default setting is enabled.

Malformed Error

. When checked (enabled), the system learns, logs, or blocks requests and/or responses when the system’s web services security offload engine confronts a malformed document. For example, if the document contains characters that are illegal according to the W3C XML 1.0 recommendation. The default setting is enabled.

Missing Timestamp

. When checked (enabled), the system learns, logs, or blocks requests when the timestamp is missing from the document. The default setting is enabled.

Signing Error

. When checked (enabled), the system learns, logs, or blocks responses when the underlying crypto library failed to digitally sign the document, or the response contains an unknown or unsupported algorithm. The default setting is enabled.

Timestamp expiration is too far in the future

. When checked (enabled), the system learns, logs, or blocks requests when the timestamp lifetime is greater than configured. The default setting is enabled.

UnSigned Timestamp

. When checked (enabled), the system learns, logs, or blocks requests when the timestamp is not digitally signed. The default setting is enabled.

Verification Error

. When checked (enabled), the system learns, logs, or blocks requests when the underlying crypto library failed to perform digital signature verification, or there is information missing in the payload. The default setting is enabled.

CSRF authentication expired

. The incoming request may be a Cross-Site Request Forgery (CSRF) attack. The request may come from a clicked link, embedded malicious HTML, or JavaScript in another application, and may involve transmission of unauthorized commands through an authenticated user.

CSRF attack detected

. The incoming request includes an expired cross-site request forgery (CSRF) session cookie.