Editing Web Application Security Policies

Editing application security policies

You modify application security policies to customize how they protect your web application server. Application security policies can be created in Web Application Security. But more often, they are created on BIG-IP devices and come into the Web Application Security configuration when you discover the devices.

1. Go to Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of a policy you want to edit.

   The policy is placed under administrative lock. Policy objects that you can view or edit are listed on the left.

3. Edit the properties of each policy object as needed.

   Consult the documentation for each policy object to edit it individually.

4. Click Save to save the modifications to each object and unlock the policy.

Changes to the policy object are saved in the working configuration of the BIG-IQ Centralized Management system. Assuming the policy is assigned to a virtual server, the next deployment sends the new configuration to one or more BIG-IP devices.

Manage general property settings

You can manage the general settings of your Application security policy, whether it was imported from managed BIG-IP devices and come into the BIG-IQ Web Application Security configuration when you discover the devices. You can view and modify the properties of individual application security policies.

1. Go to the General Properties screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy to modify, and then on the left click General Properties.

3. Edit the properties as appropriate.

4. Save your changes to the general properties of the policy.

The system saves changes in the working configuration of the BIG-IQ Centralized Management system.

General property settings

These properties are the general configuration options and settings that determine the overall behavior and functionality of the application security policy.

Edit inheritance settings

You use the Inheritance Settings screen to change the properties that are part of a policy by editing the inheritance settings of a child or parent policy.

1. Navigate to the Inheritance Settings screen: click Configuration > SECURITY > Web Application Security > Threat Campaigns.

2. Click the appropriate policy name to display the policy properties screen.

3. Click Inheritance Settings.

4. Review or modify the inheritance settings.

   The contents of this screen differ depending on whether the policy is a parent policy, a child policy, or neither.

5. If the current policy is neither a parent policy nor a child policy, the Parent Policy list is set to None, and no other properties are shown on the screen.

6. If the current policy is a child policy or will be a child policy, do the following.

   1. From the Parent Policy list, review or select a parent policy. By default, the setting is None.

   2. Review the list of properties that are displayed, and where needed, select Accept or Decline.

   3. Optionally, you can add comments about the inheritance settings by clicking the comment icon in the Comments column and then typing text in the space provided.

7. If the current policy is a parent policy, do the following.

   • In the Inheritance column, review or change the inheritance settings for each property in each property row.
     • If the property must be inherited by a child policy, click Mandatory.
     • If the property is optional for a child policy, click Optional.
     • If the property is not available to the child policy, click None.
   • The Accepted, Declined, Unread, and Comments columns show the number of child policies for each category for that property. Optionally, you can click the number to display additional information on the Child Policy Overview screen.

8. Click Save to save your changes.

The inheritance settings for the policy are updated.

Edit child policy overview settings

You can edit the inheritance settings for child policies associated with a parent policy. A parent policy can be associated with multiple child policies.

1. Navigate to the Child Policy Overview screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy you want to review, and click Child Policy Overview.

3. Review the inheritance settings for child policies associated with the parent policy.

   • Click All to view all properties that could be inherited by a child policy.
   • Click Declined to view only the properties that a child policy declined to inherit.

4. Expand each policy section in the list to review the inheritance status (declined or accepted) for each child policy.

5. Indicate whether you have reviewed declined inheritance properties. In the Policy Section row for a child policy property:

   • Click Mark as Read to indicate that you have reviewed a declined property for a child policy.
   • Click Mark as Unread to indicate that you have not reviewed a declined property for a child policy.
   • Click Mark All as Read to indicate that you have reviewed all declined properties within that heading.
   • To enter a comment, click the comment icon in the row. To remove all comments in a section, click Clear All in the heading row for a policy section.

6. Click Save to save your changes.

The child policy overview is updated.

Response page editing

You can review and change the settings on various types of response pages. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

Edit Ajax response page settings

You use the Ajax Response Page screen to view and edit the settings for the Ajax response page, which is one of several response pages. Response page settings specify the content of the response that the system sends to the user when the security policy blocks a client request.

1. Go to the Ajax Response Page screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, and then click RESPONSE PAGES > Ajax.

3. In the AJAX Blocking setting, click the Enabled check box to view and edit settings.

   When this is checked (enabled), the system injects JavaScript code into responses.

   Important: You must enable this check box to configure an ASM Ajax response page which is returned when the system detects an Ajax request that does not comply with the security policy.

4. From the Default Response Page Action list, select an action. Your selection determines the settings.

5. In the Login Page Response Action list, select an action.

   Your selection determines the settings. The actions are the same as those for the Default Response Page Action list.

6. In the Failed Login Honeypot Page Response Action list, select an action.

   Your selection determines the settings. The actions are the same as those for the Default Response Page Action list.

7. When you are finished, save your changes.

The response page settings are updated.

Edit CAPTCHA response page settings

You use the CAPTCHA Response Page screen to view and edit the settings for CAPTCHA responses. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, on the next screen, on the left click Response Pages and then for the Response Pages type, click CAPTCHA Fail.

3. For the Response Type setting, specify whether to use the default or a custom response.

   • To use the displayed response header and response body, select Default Response.
   • To use a modified response header or response body, select Custom Response. Selecting Custom Response makes editing options available.

4. In the Response Header setting, review or change the response header.

   • If you selected the default response type, you can review but not modify the response header.
   • If you selected the custom response type, you can modify the response header by editing the header text.
   • To replace your modifications with the default response header, click Paste Default Response Header.

5. For the Response Body setting, review or change the response body.

   • If you selected the default response type, you can review but not modify the response body.
   • If you selected the custom response type, you can modify the response body by editing the body text directly or by importing a file with that text. To import the response body:
     1. Click Choose File.
     2. In the displayed Open dialog box, select the file to import and click Open. The Open dialog box closes.
     3. Click Upload. The contents of the file are now in the response body text box.
   • To replace your modifications with the default response body, click Paste Default Response Body.

6. For the Preview setting, specify whether to see a preview of the response body.

   • To see a preview of how the response is displayed, click Preview On.
   • To skip the preview, click Preview Off.

7. When you are finished, save your changes.

Edit CAPTCHA fail response page settings

You use the CAPTCHA Fail Response Page screen to view and edit the settings for CAPTCHA Fail responses. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, on the next screen, on the left click Response Pages and then for the Response Pages type, click CAPTCHA Fail.

3. For the Response Type setting, specify whether to use the default or a custom response.

   • To use the displayed response header and response body, select Default Response.
   • To use a modified response header or response body, select Custom Response. Selecting Custom Response makes editing options available.

4. For the Response Header setting, review or change the response header.

   • If you selected the default response type, you can review but not modify the response header.
   • If you selected the custom response type, you can modify the response header by editing the header text.
   • To replace your modifications with the default response header, click Paste Default Response Header.

5. For the Response Body setting, review or change the response body.

   • If you selected the default response type, you can review, but not modify, the response body .
   • If you selected the custom response type, you can modify the response body by editing the body text directly or by importing a file with that text. To import the response body:
     1. Click Choose File.
     2. In the displayed Open dialog box, select the file to import and click Open. The Open dialog box closes.
     3. Click Upload. The contents of the file are now in the response body text box.
   • To replace your modifications with the default response body, click Paste Default Response Body.

6. In the Preview setting, select whether to see a preview of the response body.

   • To see a preview of how the response is displayed, click Preview On.
   • To skip the preview, click Preview Off.

7. When you are finished, save your changes.

Edit default response page settings

You use the Default Response Pages screen to view and edit the settings for the default response page, which is one of several response pages. Response page settings specify the content of the response that the system sends to the user when the security policy blocks a client request.

1. Go to the Default Response Page screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, and then click RESPONSE PAGES > Default.

3. Select a Response Type from the list. Your selection determines the additional settings.

4. When you are finished, save your changes.

The response page settings are updated.

Edit failed login honeypot response page settings

You use the Failed Login Honeypot screen to view and edit the settings for the Failed Login Honeypot response page. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, on the left of the next screen, click Response Pagesthen for the Response Pages type, click Failed Login Honeypot.

3. For the Response Type setting, specify whether to use the default or a custom response.

   • To use the displayed response header and response body, select Default Response.
   • To use a modified response header or response body, select Custom Response. Selecting Custom Response makes editing options available.

4. For the Response Header setting, review or change the response header.

   • If you selected the default response type, you can review, but not modify the response header.
   • If you selected the custom response type, you can modify the response header by editing the header text.
   • To replace your modifications with the default response header, click Paste Default Response Header.

5. For the Response Body setting, review or change the response body.

   • If you selected the default response type, you can review, but not modify the response body.
   • If you selected the custom response type, you can modify the response body by editing the body text directly or by importing a file with that text. To import the response body:
     1. Click Choose File.
     2. In the displayed Open dialog box, select the file to import and click Open. The Open dialog box closes.
     3. Click Upload. The contents of the file are now in the response body text box.
   • To replace your modifications with the default response body, click Paste Default Response Body.

6. For the Preview setting, specify whether to see a preview of the response body.

   • To see a preview how the response is displayed, click Preview On.
   • To skip a preview, click Preview Off.

7. When you are finished, save your changes.

Edit cookie hijacking response page settings

You use the Cookie Hijacking Response Page screen to view and edit the settings for the Cookie Hijacking response page. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, on the left of the next screen, click Response Pages, and for the Response Pages type, click Cookie Hijacking.

3. For the Response Type setting, specify the type of response to use.

   • To use the default response header and body, select Default Response.
   • To use a modified response header or body, select Custom Response.
   • To use the SOAP fault response header and body, select SOAP Fault.
   • To use the erase cookies response header and body, select Erase Cookies. The response header and body change based on the response type you select. Selecting Custom Response makes editing options available.

4. For the Response Header setting, review or change the response header.

   • If you did not select Custom Response as the response type, you can review but not modify the response header.
   • If you selected Custom Response as the response type, you can modify the response header by editing the header text.
   • To replace your modifications with the default response header, click Paste Default Response Header.

5. For the Response Body setting, review or change the response body.

   • If you did not select Custom Response as the response type, you can review but not modify the response body.
   • If you selected the custom response type, you can modify the response body by editing the body text directly or by importing a file with that text. To import the response body:
     1. Click Choose File.
     2. In the displayed Open dialog box, select the file to import and click Open. The Open dialog box closes.
     3. Click Upload. The contents of the file are now in the response body text box.
   • To replace your modifications with the default response body, click Paste Default Response Body.

6. For the Preview setting, specify whether to see a preview of the response body.

   • To see a preview how the response is displayed, click Preview On.
   • To skip a preview, click Preview Off.

7. When you are finished, save your changes.

Edit mobile application response page settings

You use the Mobile Application Response Page screen to view and edit the settings for the mobile application response page. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, on the left of the next screen click Response Pages and for the Response Pages type, click Mobile Application.

3. for the Response Type setting, specify whether to use the default or a custom response.

   • To use the displayed response header and response body, select Default Response.
   • To use a modified response header or response body, select Custom Response. Selecting Custom Response makes editing options available.

4. For the Response Header setting, review or change the response header.

   • If you selected the default response type, you can review but not modify the response header.
   • If you selected the custom response type, you can modify the response header by editing the header text.
   • To replace your modifications with the default response header, click Paste Default Response Header.

5. For the Response Body setting, review or change the response body.

   • If you selected the default response type, you can review but not modify the response body.
   • If you selected the custom response type, you can modify the response body by editing the body text directly or by importing a file with that text. To import the response body:
     1. Click Choose File.
     2. In the displayed Open dialog box, select the file to import and click Open. The Open dialog box closes.
     3. Click Upload. The contents of the file are now in the response body text box.
   • To replace your modifications with the default response body, click Paste Default Response Body.

6. For the Preview setting, specify whether to see a preview of the response body.

   • To see a preview how the response is displayed, click Preview On.
   • To skip a preview, click Preview Off.

7. When you are finished, save your changes.

Edit login response page settings

You use the Login Pages Response Page screen to view and edit the settings for the login page response page, which is one of several response pages. Response page settings specify the content of the response that the system sends to the user when the security policy blocks a client request.

1. Go to the Login Pages Response Page screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, and then click RESPONSE PAGES > Login Page.

3. Select a Response Type from the list. Your selection determines the additional settings.

4. When you are finished, save your changes.

The response page settings are updated.

Edit XML response page settings

You use the XML Response Page screen to view and edit the settings for the XML response page, which is one of several response pages. Response page settings specify the content of the response that the system sends to the user when the security policy blocks a client request.

1. Go to the XML Response Page screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, and then click RESPONSE PAGES > XML.

3. Select a Response Type from the list. Your selection determines the additional settings.

4. When you are finished, save your changes.

The response page settings are updated.

Add or edit brute force attack prevention settings

You can protect login URLs against brute force attacks. A brute force attack is an outside attempt by hackers to access post login pages of a website by guessing user names and passwords. Brute force attacks are performed when a hacker tries to log in to a URL numerous times, running many combinations of user names and passwords, until he successfully logs in. The Default login URL is used for all defined login URLs that do not have their own brute force configuration.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of a policy, and on the left click ANOMALY DETECTION > Brute Force Attack Prevention.

3. Specify the action to take for brute force attack prevention settings:

   • To add a login URL to the security policy, click Add.
   • To modify the brute force prevention properties for a login URL, click the name of the login URL. The brute force prevention properties display.

4. Supply the general properties for brute force attack prevention for the login URL.

   1. In the Login Page setting, select a login page, or create a login page by clicking Create login page.

   2. In the Configuration Support setting, specify whether to use current or legacy settings. The other available properties differ based on this setting.

      • Select Current when managing a BIG-IP device version later than 13.0.
      • Select 13.0 And Prior when managing a BIG-IP device version 13.0 or earlier.

   3. In the IP Address Whitelist setting, review the settings or add new settings. To add an IP address, click the IP Address Whitelist setting link.

5. In the Source-based Brute Force Protection area, supply the source-based protection settings.

   This area is available only when Configuration Support is set to Current.

   1. In the Detection Period setting, type the number of minutes the detection period should last.

   2. In the Maximum Prevention Duration setting, type the number of minutes the prevention period should last.

   3. For each of the other settings in this section, set the trigger and the action:

      • In the Trigger setting, specify when the trigger for the action occurs by selecting either Never or After a specified value is reached.
      • For the Action setting, select the action that occurs when the trigger is reached.

6. In the Distributed Brute Force Protection area, supply the distributed protection settings.

   This area is available only when Configuration Support is set to Current.

   1. In the Detection Period setting, type the number of minutes for detection.

   2. In the Maximum Prevention Duration setting, type the number of minutes for maximum prevention duration.

   3. In the Detect Distributed Attack setting, select when the distributed attack detection occurs.

      • Select Never to have no distributed brute force attack protection.
      • Select After x failed login attempts to have distributed brute force attacks detected if x failed logins are detected within the Detection Period configured previously.

   4. In the Detect Credential Stuffing setting, select when the detection should occur.

      • Select Never to have no credential stuffing detection.
      • Select After x login attempts that match stole credentials dictionary to have it reported when the configured conditions are met.

   5. In the Mitigation setting, select the distributed brute force protection mitigation option to use.

7. In the Session-based Brute Force Protection area, supply the session-based protection settings.

   This area is available only when the Configuration Support setting is set to 13.0 And Prior.

   • In the Login Attempts from the Same Client setting, type the number of attempts to allow.
   • In the Re-enable Login After setting, type the number of seconds.
   • In the Use Device ID setting, specify whether it is enabled.

8. In the Dynamic Brute Force Protection area, supply the dynamic protection settings.

   This area is available only when the Configuration Support setting is set to 13.0 And Prior.

   • For the Operation Mode setting, select one of the modes: Off, Alarm, or Alarm and Block.
   • In the Measurement Period field, type the number of seconds.
   • In the Detection Criteria field, type the values that define when a problem is detected.
   • For the Prevention Policy setting, select one or of the options to use for the policy. When Source IP-Based Client Side Integrity Defense is selected, the Suspicious Criteria (per IP address) setting is displayed and can be modified.
   • In the Suspicious Criteria (per IP address) setting, type the values that define when failed login attempts become suspicious.
   • In the Prevention Duration setting, select the duration. This setting is displayed only when Source IP-Based Client Side Integrity Defense is selected in the Prevention Policy setting.
     • To have no limit on the duration, select Unlimited.
     • To have a maximum duration, select Maximum and type a value for the number of seconds.

9. Save your work.

Add methods

In the application security policy, you can specify methods that other web applications may use when requesting a URL from another domain. All security policies accept standard HTTP methods by default. If your web application uses HTTP methods other than the default allowed methods (GET, HEAD, and POST), you can add them to the security policy.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the policy name, and then click HEADERS > Methods.

3. Click Add to add a method.

4. From the Method list, select a method.

5. When you are finished, click Save.

   The new method is added to the list on the Methods screen. The method appears in blue, meaning that you can edit it. The check box to the left indicates that you can also delete it.

The system updates the policy to use the new methods.

Add or edit HTTP header settings

In the application security policy, you can specify a list of HTTP request headers that other web applications hosted in different domains can use when requesting this URL.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the policy name.

3. On the left, click HEADERS > HTTP Headers.

   The screen displays a list of HTTP headers. The wildcard header is configured by default.

4. Select whether to add a new HTTP header or view or modify an existing HTTP header.

   • Click Add to add a new header.
   • Click the name of the header to view or modify the properties. Only HTTP headers that are displayed in blue can be modified or viewed.

5. Add a Name. When adding a new header, select the name of the HTTP header from the list. When modifying a header, the name cannot be changed.

6. Select a Type. Specifies explicit or wildcard. The only wildcard header in the system is the default pure wildcard header (*).

7. Enable Mandatory to require this header to appear in requests.

8. Enable Check Signatures to all the system to perform attack signature checks on this header.

9. Base64 Decoding. When enabled, specifies that the security policy checks the parameter’s value for Base64 encoding, and decodes the value. The default is disabled.

10. Normalization. Specifies whether the system normalizes headers. Select the options for which type of normalization the system should perform on headers. There is a performance trade-off when using normalization, so use it only when needed.

    • Percent Decoding: Specifies, when enabled, that the system performs the following actions on header content: %XX and %uXX, bad unescaping, Apache whitespace, IIS Unicode codepoints, and plus to space.
    • URL Normalization and Percent Decoding: Specifies, when enabled, that the system performs the these actions on header content: multiple slashes, directory traversal, backslash replacement, and path parameter removal, and all Percent Decoding checks.
    • HTML Normalization: Specifies, when enabled, that the system performs the following actions on header content: removes all non-printables, whitespaces and the “+” character, skips comments, decodes HTML entities, performs hex decoding, decimal decoding, 0xXX decoding, style sheet escaping, and removes backslashes.

11. Enable Evasion Techniques Violations allowing the system to log and/or suggest learning suggestions for evasion violations detected during the normalization process if there are problems during the normalization of the specific header. The default is disabled.

12. Enable Mask Value in Logs to mask sensitive user header information from your report logs.

13. To customize signature override settings for headers, select from Overridden Security Policy Settings signature overrides from the list and then enable or disable it by clicking Enabled or Disabled.

14. Click Save to save your changes.

The system updates the policy to use the new settings.

Edit host name settings

You can review, add, and delete host names from the policy using the Host Names screen. This list of host names is used by several features of the application security policy.

1. Navigate to the Host Names screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Then click the name of the appropriate policy, and on the left click HEADERS > Host Names.

3. Review the list of host names.

   If no host names are listed, you can add them by clicking the Add.

4. To modify a host name, click the name of the host name.

   The Host Name properties screen opens.

5. Review the Host Name.

6. To allow users to be redirected to a sub-domain of this host name, select the Include Sub-domains check box.

7. To set the policy to transparent mode and forward all responses, select the check box for Policy is always transparent for this host.

8. Click Save to save your changes.

The host name settings for the policy are updated.

Add or edit cookie settings

You can review, add, and remove cookies from a policy, and re-order cookie wildcards using the Cookies screen. You use the same process to modify or add a cookie. The only difference is that when you modify a cookie, the Cookie Name properties already exist and you cannot change them.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left click HEADERS > Cookies.

   The screen displays a list of cookies.

3. To add a new cookie, click Add, or click a cookie name to modify an existing cookie.

   You use the same process to modify or add a cookie. However, you can specify some properties only when adding a cookie, and not modifying an existing cookie.

4. Type or review the Cookie Name, and specify whether it is Explicit or is a Wildcard expression.

   You can specify a cookie name only when adding a new cookie.

5. Specify the Cookie Type:

   • Select Allowed to indicate the client may change the cookie.
   • Select Enforced to indicate that the cookie cannot be changed by the client. Allowed provides additional options.

6. Select the settings for the cookie.

   • For Perform Staging, select the Enabled check box to indicate that the cookie is placed in staging.
   • For Insert HTTPOnly attribute, select the check box to insert the attribute in the domain cookie response header.
   • For Insert SameSite attribute, specify whether the attribute should be set to None, Strict, or Lax. Only None can be selected for BIG-IP devices earlier than version 13.1.
   • For Insert Secure attribute, select the check box to insert the attribute into the domain cookie response header.
   • For Base64 Decoding, select the check box to enable decoding of Base64 strings. (This setting is displayed only if the Cookie Type is set to Allowed.)
   • For Mask Value in Logs, select the Enabled check box to mask sensitive user information in your report logs.
   • For Attack Signatures Check, select the check box to verify attack signatures and display attack signature override settings. (This setting is displayed only if the Cookie Type is set to Allowed.)
   • For Attack Signature Overrides, select a signature from the list, and then click Enabled or Disabled to indicate whether each signature should be overridden. Once you have completed setting configuration, click Save to save your changes.

   Once you save, the screen returns to the policy’s list of cookies.

7. To remove a cookie from staging, select the check box for the cookie and click Enforce Selected.

8. To filter the list of cookies by their enforcement readiness, select an option from the Enforcement Readinesssetting.

   Enforcement readiness is the state of enforcement for each cookie, such as not enforced,, has a suggestion, or is ready to be enforced.

   • To list all cookies, select All.
   • To list cookies that have one or more suggestions, select Has suggestion.
   • To list cookies that are not being enforced, select Not enforced.
   • To list cookies that are ready to be enforced, select Ready to be enforced.

9. Click Save to save your changes.

The cookie settings for the policy are added or updated.

Edit redirection protection settings

You can enable redirection protection and list those domains that are allowed by your security policy, using the Redirection Protection screen. By enabling redirection protection, you can help prevent users from being redirected to questionable, phishing, or malware websites.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left click HEADERS > Redirection Protection.

3. For the Redirection Protection setting, select the Enabled check box.

   The screen displays other property settings.

4. For Domain Name, type the domain name that is allowed by the security policy.

5. To have the security policy also allow sub-domains of the domain, select the Include Sub-Domains check box.

6. To add the domain to the Allowed Redirection Domains list, click Add.

7. To delete a domain from the Allowed Redirection Domains, click the X to the left of that domain name.

   The domain is removed without confirmation.

8. Save your work.

Edit header character set settings

You can configure the security policy to allow or disallow certain characters in the value field of an HTTP header and in uncommon header names.

1. Navigate to the Character Set screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, expand HEADERS and click Character Set.

3. Review the list of characters, and for each, determine whether it should be allowed.

   You can use the View options to select which group of characters are displayed.

   • To allow characters in a header, select the check box in the Allowed column of the table row .
   • For characters that should not be allowed in a header, clear the check box in the Allowed column of the table row.

4. Click Save to save your changes.

Edit IP addresses list settings

You can view and edit configured IP address exceptions and characteristics.

1. Navigate to the IP Address screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Select a policy name, expand IP ADDRESSES, and select IP Addresses List.

3. Click Add.

4. Type an IP Address that you want the system to trust.

   To add a route domain, type %n after the IP address where n is the route domain identification number.

5. Type a Netmask.

   If you omit the netmask value, the system uses a default value of 255.255.255.255.

6. Select whichever of the following options should be enabled.

   • Select the Policy Builder Trusted IP check box to specify that the Policy Builder considers traffic from this IP address to be legitimate. The Policy Builder automatically adds to the security policy data logged from traffic sent from this IP address.
   • Select the Ignore in Anomaly Detection and do not Collect Device ID check box to specify that the system considers traffic from this IP address to be safe. The security policy does not take this IP address into account when performing brute force prevention and web scraping detection.
   • Select the Ignore in Learning Suggestion check box to specify that the system not generate learning suggestions from traffic sent from this IP address.
   • Select the Never log traffic from this IP Address check box to specify that the system not log requests or responses sent from this IP address, even if the security policy is configured to log all traffic.
   • Select the Ignore IP Address Intelligence check box to specify that the system considers traffic from this IP address to be safe even if it matches an IP address in the IP Address Intelligence database.

7. In the Block this IP Address setting, select one of the blocking options.

   • Select Policy Default to use the policy blocking settings.
   • Select Never Block This IP to not block this IP address.
   • Select Always Block This IP to block this IP address. If Always Block This IP is selected, many of the options become invalid and are removed from the screen.

8. Type a brief description for the IP address.

9. When you are finished, click Save to save the modifications and unlock the policy.

The IP Address settings are updated to use the new configured IP address exceptions, and any changes made are put into effect in the working configuration of the BIG-IQ Centralized Management system.

Edit IP address intelligence settings

You can review and modify IP address intelligence settings. An IP intelligence database is a list of IP addresses with questionable reputations. Refer to the ASM documentation or online help for more information on IP address intelligence.

1. Navigate to the IP Address screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Select a policy name, expand IP ADDRESSES, and select IP Address Intelligence.

3. Select the IP Address Intelligence Enabled check box.

   Other properties display; you can review the descriptions of the properties for additional information.

4. For the IP Address White List setting, type the IP address and subnet mask for each IP address that should be whitelisted, and click Add after each addition.

5. In the IP Address Intelligence Categories area, specify the categories that you want to alarm or block.

   • Select the Alarm check box to specify that whenever a request is sent from a source IP address that matches the category, the system logs the IP Intelligence data.

   • Select the Block check box to specify that the system stops requests sent from a source IP address that matches the category.

     Note: In order for the system to block requests, the security policy must be in Blocking mode.

6. Click Save when you are done.

The IP address intelligence settings are updated.

Add or edit HTTP URL settings

You can view, add, modify, and remove HTTP URLs that are either allowed or disallowed in an application security policy. Allowed URLs are URLs that the security policy accepts in traffic to the web application being protected. Disallowed URLs are URLs that the security policy denies.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, then on the left expand URLs, and click HTTP.

   The screen displays the list of HTTP URLs. You can add, delete, or reorder the HTTP URLs that are allowed or disallowed.

3. To add an allowed or disallowed HTTP URL to a policy, click Add for the allowed or disallowed list.

   Allowed HTTP URLs are listed at the top of the screen and disallowed HTTP URLs are listed at the bottom. The Add URL screen displays the properties, which differ between allowed URLs and disallowed URLs.

   • For disallowed HTTP URLs, specify whether the protocol is HTTP or HTTPS, and type the URL name.
   • For allowed HTTP URLs, specify whether the URL is explicit or a wildcard, whether the protocol is HTTP or HTTPS, and type the URL name or wildcard. Specify or modify additional properties for the allowed HTTP URL as needed.

4. Save your work.

5. To review or edit the properties of a URL, click the URL to open the Properties screen.

   Allowed URLs are listed in the Allowed URL column in the upper table of URLs. Disallowed URLs are listed in the Disallowed URL column in the bottom table of URLs.

6. To change the processing order of allowed URLS with the wildcard type, click Wildcards Order.

   The Wildcard Order screen opens, where you can move the wildcard entries in the list to change their sequence, and save your work.

7. To remove an HTTP URL from staging, select the check box for the HTTP URL and click Enforce Selected.

8. To filter the list of HTTP URLs by their enforcement readiness, select a value from the Enforcement Readiness setting.

   • To list all HTTP URLs, select All.
   • To list HTTP URLs that have one or more suggestions, select Has suggestion.
   • To list HTTP URLs that are not being enforced, select Not enforced.
   • To list HTTP URLs that are ready to be enforced, select Ready to be enforced.

9. To delete an allowed or disallowed HTTP URL from the policy, select the check box in the row for that HTTP URL and click Delete in the upper or lower portion of the screen, whichever is appropriate.

Add or edit WebSocket URL settings

You can view, add, modify, and remove WebSocket URLs that are either allowed or disallowed in an application security policy. Allowed URLs are URLs that the security policy accepts in traffic to the web application being protected. Disallowed URLs are URLs that the security policy denies.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, then on the left expand URLs and click WebSocket.

   The WebSocket URLs screen opens where you can add, or edit, WebSocket URLs.

3. To remove the WebSocket URL from staging, select the check box for the WebSocket URL and click Enforce Selected.

4. To edit the properties of a WebSocket URL, click the URL in either the Allowed WebSocket URLs or Disallowed WebSocket URLs column.

   The WebSocket URL properties screen opens, and you can change the properties (as described in the details for adding a URL of that type).

5. To add a WebSocket URL to a policy, determine whether it is an allowed or disallowed WebSocket URL.

   • To add an allowed WebSocket URL, click Add in the upper portion of the screen. This opens the Add Allowed WebSocket URL screen, where you can supply the needed properties.
   • To add a disallowed WebSocket URL, click Add in the lower portion of the screen. This opens the Add Disallowed WebSocket URL screen, where you can supply the needed properties.

6. For disallowed WebSocket URLs:

   1. Specify whether the protocol is WS or WSS.

   2. Type the URL name.

7. For allowed WebSocket URLs, supply the needed properties.

   1. In the Properties area, supply or modify the overall properties for the WebSocket URL.

   2. In the Message Handling area, supply or modify the message handling properties for the WebSocket URL.

   3. For wildcard URLs, expand the Meta Characters area to specify how meta characters are handled.

      • For Check Signatures on this URL, select the Enabled check box.
      • For Check characters on this URL, select the meta characters from the list and then click Allow or Disallow as needed.

   4. In the HTML5 Cross-Domain Request Enforcement area, supply or modify the HTML5 cross-domain request enforcement properties for the WebSocket URL.

8. To filter the list of WebSocket URLs by their enforcement readiness, select an option from the Enforcement Readiness list.

   • To list all WebSocket URLs, select All.
   • To list WebSocket URLs that have one or more suggestions, select Has suggestion.
   • To list WebSocket URLs that are not being enforced, select Not enforced.
   • To list WebSocket URLs that are ready to be enforced, select Ready to be enforced.

9. Save your work.

Edit URL character set settings

You can view and edit how the security policy responds to each character contained in a URL.

1. Navigate to the Character Sets URL screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, on the left expand URLs, and click Character Sets.

3. Review the list of characters, and for each, determine whether it should be allowed.

   You can use the View options to select which group of characters are displayed.

   • To allow characters in a URL, select the check box in the Allowed column of the table row.
   • For characters that should not be allowed in a URL, clear the check box in the Allowed column of the table row.

4. Click Save to save your changes.

Add or edit file types settings

You can add and configure settings for file types that are allowed (or disallowed) in traffic to the web application being protected. These settings determine how the security policy reacts to requests referring to files with these extensions.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy to change, and on the left, click File Types.

   The screen displays a list of file types.

3. To remove the file type from staging, select the check box for the file type and click Enforce Selected.

4. To add a file type to the policy, click Add in either the Allowed File Types area at the top of the screen, or in the Disallowed File Types area at the bottom of the screen.

   • Use the Allowed File Types area to add file types that the security policy considers legal, and to view information about each file type.
   • Use the Disallowed File Types area to add file types that the security policy considers illegal, and to exclude file types that are included in allowed wildcard file types. The screen displays fields applicable to your selection.

5. If you chose to add Disallowed File Types, fill in the name.

6. If you chose to add Allowed File Types, fill in these settings.

   1. For File type, select whether the file type is a wildcard or is explicit, and type a wildcard name or an explicit name.

   2. For Perform Staging, select the Enabled check box to have the system perform staging.

   3. For URL Length, type the maximum acceptable length, in bytes, of a URL containing this file type.

   4. For Request Length, type the maximum acceptable length, in bytes, of the request containing this file type.

   5. For Query String Length, type the maximum acceptable length, in bytes, for the query string portion of a URL that contains this file type.

   6. For POST Data Length, type the maximum acceptable length, in bytes, for the POST data of an HTTP request that contains the file type.

   7. For Apply Response Signature Staging, select the check box to apply response signature staging.

7. To filter the list of file types by their enforcement readiness, select an option from the Enforcement Readinesssetting.

   • To list all file types, select All.
   • To list file types that have one or more suggestions, select Has suggestion.
   • To list file types that are not being enforced, select Not enforced.
   • To list file types that are ready to be enforced, select Ready to be enforced.

8. When you are finished, save your work.

The file types settings are updated to use the new settings, and any changes you made are put into effect in the working configuration of the BIG-IQ Centralized Management system.

Edit or add JSON content profile settings

You use JSON content profile properties to define what the application security policy enforces and considers legal when it detects traffic that contains JSON data.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy you want to modify, then on the left expand CONTENT PROFILES, and click JSON Profiles.

3. Click the name of the JSON profile to modify, or click Add to create a new one.

4. Review the existing name, or type a Profile Name for the new profile.

5. Revise or type an optional Description for the profile.

6. In the Maximum Total Length Of JSON Data field, type or revise the longest length, in bytes, allowed by the security policy of the request payload, or parameter value, where the JSON data was found.

   To have no length restriction, you can leave this field blank.

7. In the Maximum Value Length field, type or revise the maximum acceptable length, in bytes, of the longest JSON element value in the document allowed by the security policy.

   To have no length restriction, you can leave this field blank.

8. For Maximum Structure Depth, type or revise the greatest nesting depth found in the JSON structure allowed by the security policy.

   To have no depth restriction, you can leave this field blank.

9. In the Maximum Array Length field, type or revise the largest number of elements allowed for arrays.

   To have no array length restriction, you can leave this field blank.

10. For Tolerate JSON Parsing Warnings, specify whether to enable response signature staging.

    • Select the Enabled check box to specify that the system does not report when the security enforcer encounters warnings while parsing JSON content.
    • Clear the check box to specify that the security policy reports when the security enforcer encounters warnings while parsing JSON content.

11. For Parse Parameters, specify whether to enable parameter parsing.

    • To enable parsing, select the Enabled check box.
    • When this setting is disabled, the system displays more main areas (such as Attack Signature Overrides, Meta Characters, and Sensitive Data Configuration) with additional properties for review and modification.

12. Expand the Attack Signatures Overrides area to select any signature overrides. (This area is displayed only when Parse Parameters is disabled.)

    • For the Attack Signatures Check setting, select the Enabled check box.
    • For the Attack Signatures Overrides setting, select the signature from the list and then click Enabled or Disabled as needed for that signature.

13. Expand the Meta Characters area to select how meta characters are handled. (This area is displayed only when Parse Parameters is disabled.)

    • For the Check Characters setting, select the Enabled check box.
    • For the Overrides setting, select the meta characters from the list and then click Allowed or Disallowed as needed.

14. Expand the Sensitive Data Configuration area to select how sensitive data is handled. (This area is displayed only when Parse Parameters is disabled.)

    1. In the Sensitive Data setting, type an element name within the JSON data whose values the system should consider sensitive.

    2. Click Add to add the element name to the sensitive data list.

15. Click Save to save your changes.

Edit or add XML content profile settings

You use XML content profile properties to define what the application security policy enforces and considers legal when it detects traffic that contains XML data.

1. Navigate to the XML Profiles screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy you want to work with, then, on the left, expand CONTENT PROFILES, and click XML Profiles.

3. Click the name of the XML profile to modify, or click Add to create a new one.

4. Review the existing name or type a Profile Name for the new profile.

5. Review, revise, or type an optional Description for the profile.

6. For the Use XML Blocking Response Page property, select the type of response page to send when the security policy blocks a client request that contains URL XML content that does not comply with the settings of this XML profile.

   • To have the system send an XML response page, select the Enabled check box.
   • To have the system send the default response page, do not select the Enabled check box.

7. To configure the validation and defense settings of an XML profile, expand the XML Firewall Configuration area and modify those settings as needed.

8. To configure the system to perform attack signature checks on the XML profile, expand the Attack Signatures area and modify those settings as needed.

9. To change the security policy settings for specific meta characters in XML values on the XML profile, expand the Meta Characters area and modify those settings as needed.

10. Expand the Sensitive Data Configuration area to program the system to mask sensitive data that appears in an XML document, as shown in the BIG-IP device configuration interface and internal Application Security logs.

11. Click Save to save your changes.

Edit or add plain text content profile settings

You use plain text content profile properties to define what the application security policy enforces and considers legal when it detects traffic that contains plain text data.

1. Navigate to the Plain Text Profiles screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy you want to modify, at the left, expand CONTENT PROFILES, and click Plain Text Profiles.

3. Click the name of the plain text profile to modify, or click Add to create a new one.

4. Review the existing, or type a Profile Name for the new profile.

5. Review, revise, or type an optional Description for the profile.

6. In the Maximum Total Length field, type the longest length, in bytes, allowed by the security policy.

   You can leave this field blank to have no length restriction.

7. In the Maximum Line Length field, type the longest line length, in bytes, allowed by the security policy.

   You can leave this field blank to have no length restriction.

8. If you want the system to perform percent decoding, select the Perform Percent Decoding Enabled check box.

9. To configure attack signature overrides, expand Attack Signatures Overrides and supply the needed values.

   1. In the Attack Signatures Check setting, select the Enabled check box.

   2. In the Attack Signatures Overrides setting, select one or more attack signatures to override.

   3. For each attack signature, select whether the override is enabled or disabled.

10. To change the security policy settings for specific meta characters in values on the plain text profile, expand Meta Characters and supply the needed values.

    1. In the Check Characters setting, select the Enabled check box.

    2. In the Overrides setting, select one or more meta characters to override.

    3. For each meta character, select whether the override is allowed or disallowed.

11. Click Save to save your changes.

Edit character set JSON settings

You can configure the security policy to allow or disallow certain characters if they appear in JSON values.

1. Navigate to the JSON screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy you want to work with, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click JSON.

3. Review the list of characters, and for each, determine whether it should be allowed or not.

   • To allow characters, select the check box in the Allowed column of the table row.

   • For characters that should not be allowed, clear the check box in the Allowed column of the table row. Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.

   • Click Allowed to display only characters that are marked as allowed.

   • Click Disallowed to display only characters that are not allowed.

4. Click Save to save your changes.

Edit character set plain text settings

You can configure the security policy to allow or disallow certain characters if they appear in plain text values.

1. Navigate to the Plain Text screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click Plain Text.

3. Review the list of characters, and for each, determine whether it should be allowed or not.

   • To allow characters, select the check box in the Allowed column of the table row.

   • For characters that should not be allowed, clear the check box in the Allowed column of the table row. Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.

   • Click Allowed to display only characters that are marked as allowed.

   • Click Disallowed to display only characters that are not allowed.

4. Click Save to save your changes.

Edit character set XML settings

You can configure the security policy to allow or disallow certain characters if they appear in XML values.

1. Navigate to the XML screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click XML.

3. Review the list of characters, and for each, determine whether it should be allowed or not.

   • To allow characters, select the check box in the Allowed column of the table row .

   • For characters that should not be allowed, clear the check box in the Allowed column of the table row. Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.

   • Click Allowed to display only characters that are marked as allowed.

   • Click Disallowed to display only characters that are not allowed.

4. Click Save to save your changes.

Add or edit parameter settings

You can add or edit settings for parameters that the security policy permits in requests, such as the parameter type and whether the parameter is allowed to contain an empty value. The default parameter is displayed for all policies, and can be edited. It is indicated by * (asterisk).

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click a policy name, and on the left, click PARAMETERS > Parameters.

3. You can add a new, or edit an existing, parameter.

   • To add a new parameter, click Add.
   • To edit an existing parameter, click the parameter name. The properties screen opens for the new or existing parameter.

4. To remove the parameter from staging, select the check box for the parameter and click Enforce Selected.

5. For a new parameter, for the Name setting, select the type, and then type a name for the new parameter.

   • Select explicit if this is a regular named parameter.
   • Select wildcard if any parameter name that matches the wildcard expression is permitted by the security policy. (For example, typing the wildcard * specifies that the security policy allows every parameter.) The syntax for wildcard entities is based on shell-style wildcard characters.
   • Select no name if this parameter does not have a name. The system automatically names the parameter no name and it behaves the same as an explicit parameter. The name setting cannot be changed once the parameter is created.

6. For Level, select the level of parameters to be displayed.

   • Select global to display global parameters not associated with flows or URLs.
   • Select URL to display parameters associated with flows or URLs, select HTTP or HTTPS as the protocol, and then select the URL. If the security policy is configured to differentiate between HTTP and HTTPS URLs, then you can additionally filter URL parameters by the HTTP and HTTPS protocols.

7. To enable or allow any of these settings, click the Enabled check box for the setting:

   • Select Perform Staging to display the staging status on this parameter.
   • Select Allow Empty Value to allow empty values.
   • Select Allow Repeated Occurrences to allow repeated occurrences.
   • Select Sensitive Parameter to, in a validated request, protect sensitive user input, such as a password or a credit card number. The contents of sensitive parameters are not visible in logs or in the user interface.

8. Specify the Value type for the parameter.

   The value type you specify might display additional fields. You cannot change the value type after it is created.

   • Select dynamic-content for parameters whose data is dynamic.

   • Select ignore for parameters whose values the system does not check.

   • Select json for JSON parameters fetched from the server that are not editable.

   • Select static-content for parameters whose data is static. In the Parameter Static values area displayed at the bottom of the screen, supply a value in the Add New Value setting, and click Add. Add or subtract values as needed.

   • Select user-input for parameters whose data is provided by user-input. Use the Data type setting to provided additional information about the user input.

   • ---

     Note:

   • Select xml for XML parameters fetched from the server that are not editable. In the XML Profile area displayed at the bottom of the page, select an XML profile.

9. For the Data type setting, select the data type to use for the user input.

   • Select email to specify that the data must be text in email format only. In the Data type attributes area, specify a value for the Maximum Length setting in bytes.
   • Select alpha-numeric to specify that the data can be any text consisting of letters, digits, and the underscore character.
     • In the Data type attributes area, specify a value for the Maximum Length setting in bytes, and select whether to enable regular expressions or Base64 encoding. When the Regular Exp setting is enabled, it specifies that the parameter value includes the specified parameter pattern. This is a positive regular expression that defines what is legal.
     • In the Value Meta Character area, select the Enabled check box and then select which meta character to allow or disallow as a value.
     • In the Attack Signatures area, select the Enabled check box and then select which attack signature overrides to enable or disable.
   • Select integer to specify that the data must be whole numbers only (no decimals). In the Data type attribute area, specify values for the Minimum Value, Maximum Value, and Maximum Length settings.
   • Select decimal to specify that the data is numbers only and can include decimals. In the Data type attributes area, specify values for the Minimum Value, Maximum Value, and Maximum Length settings.
   • Select phone to specify that the data can be text in telephone number format only. In the Data type attributes area, specify a value for the Maximum Length setting.
   • Select file upload to specify there is no text limit for the data (length checks only). In the Data type attributes area, specify a value for the Maximum Length setting, and specify whether to disallow file uploading or enable Base64 encoding.

10. To filter the list of parameters by their enforcement readiness, select an option from the Enforcement Readiness setting.

    • To list all parameters, select All.
    • To list parameters that have one or more suggestions, select Has suggestion.
    • To list parameters that are not being enforced, select Not enforced.
    • To list parameters that are ready to be enforced, select Ready to be enforced.

11. When you are finished, save your work.

The application security policy is updated to use the new settings.

Add or edit extraction settings

You use extraction settings to manage how the system extracts dynamic values for dynamic parameters from the responses returned by the web application server. An extraction is a subcollection that isolates a parameter from an object. Other subcollections (such as parameters) reference extractions by name (not by URL).

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy and then on the left, click PARAMETERS > Extractions.

3. You can add a new or edit an existing extraction.

   • To add a new extraction, click Add.
   • To edit an existing extraction, click the extraction name. The properties screen opens for the new or existing extraction.

4. For a new extraction, specify the Name of the dynamic parameter for which the system extracts values from responses.

   • For a named parameter, select New and type the name in the field.
   • For the UNNAMED parameter, select no name. The name setting cannot be changed once the extraction is created.

5. In the Extracted Items Configuration area, specify the items from which the system should extract the values for dynamic parameters.

6. In the Extracted Method Configuration area, specify the methods by which the system extracts the values for dynamic parameters.

7. When you are finished, save your work.

The application security policy is updated to use the new settings.

Edit character set parameter name settings

You use character set parameter name settings in the security policy to allow or disallow certain characters in parameter names.

1. Go to the Policies screen: Click Configuration > SECURITY > Web Application Security > Policies.

2. Continue to the parameter name screen: Click the name of the policy and then, on the left, click PARAMETERS > CHARACTER SETS > Parameter Name.

3. Review the list of characters, and for each, determine whether it should be allowed or not.

   • Select the Allowed check box for characters that should be allowed.

   • Clear the Allowed check box for characters that should not be allowed. Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.

   • Click Allowed to display only characters that are marked as allowed.

   • Click Disallowed to display only characters that are not allowed.

4. Click Save to save your changes.

The system updates the security policy to use the new character set parameter name settings.

Edit character set parameter value settings

You use character set parameter value settings in the security policy to determine whether the security policy allows those values in a request.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy and then, on the left, click PARAMETERS > CHARACTER SETS > Parameter Value.

3. Review the list of characters, and for each, determine whether it should be allowed or not.

   • Select the Allowed check box for characters that should be allowed.

   • Clear the Allowed check box for characters that should not be allowed. Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.

   • Click Allowed to display only characters that are marked as allowed.

   • Click Disallowed to display only characters that are not allowed.

4. Click Save to save your changes.

The system updates the security policy to use the new character set parameter value settings.

Add sensitive parameters settings

You can add and delete sensitive parameters used by your security policy. Some requests include sensitive data, such as account numbers, in parameters. If you create sensitive parameters, the data in those parameters is replaced with asterisks (***) in the stored request and in logs.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left click PARAMETERS > Sensitive Parameters.

3. Click Add to add a sensitive parameter.

   The Sensitive Parameter properties screen opens.

4. In the Name setting, type the name of the sensitive parameter.

5. Save your work.

Configure attack signatures

Attack signatures are rules or patterns that identify attacks or classes of attacks on a web application and its components. You can configure aspects of attack signatures to specify whether the signatures should be put into staging before being enforced, and whether or not to apply signatures to responses.

1. Go to the Policies screen: Click Configuration > SECURITY > Web Application Security > Policies.

2. Continue to the Attack Signatures Configuration screen: Click the name of a policy, and on the left click Attack Signatures Configuration.

3. Revise the settings as needed.

   • To enable staging of signatures, select the Signature Staging Enabled check box.
   • To place updated signatures in staging, select the Place updated signatures in staging Enabled check box. New signatures are always placed in staging, regardless of this setting.
   • For Attack Signature Set Assignment, select one or more signature sets from the list to be assigned to the policy, and then select the appropriate options for that signature set.
     • Select or clear the Learn, Alarm, and Block options for each signature set.
       • Select Learn to have the security policy learn all requests that match enabled signatures in the signature set.
       • Select Alarm to have the security policy logs the request data if a request matches a signature in the signature set.
       • Select Block, to have the security policy block all requests that match a signature included in the signature set.
     • From the Actions list, select, if needed, whether to enable or enforce signatures in the signature set.
   • For Apply Response Signatures, select a file type, if needed. The default wildcard character indicates all file types.

4. When you are finished, save your work.

The system updates the application security policy attack signatures settings.

View and modify attack signatures

You can view the list of attack signatures that belong to signature sets assigned to the policy, and specify whether they are enabled or in staging.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of a policy, and on the left click Attack Signatures.

3. To restrict the number of signatures displayed, use the filter field at the upper right of the screen.

   You can select both basic and advanced filter options by clicking the arrow to the left of the field.

4. To specify whether or not the attack signature is enabled, select the check box in the Enabled column of the table for that row.

5. To have an attack signature placed in staging, select the check box in the In Staging column of the table for that row.

6. When you are finished, save your work.

The system updates any modified attack signature settings.

Edit geolocation enforcement settings

You use geolocation enforcement to select which geolocations the policy does not allow.

1. Navigate to the Geolocation Enforcement screen: click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left, click Geolocation Enforcement.

3. Select a geolocation that is not allowed by the policy from the Disallowed Geolocations list.

   Once you have selected the geolocation, it is listed below the drop-down list.

4. You remove a selected geolocation from the list by clicking the X to the left of the geolocation name.

5. Click Save to save your changes.

The system updates the list of geolocations that the policy does not allow.

Add or edit login page settings

You can view and manage login page settings for the security policy to better protect the login page URLs used by your web applications.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy to manage, and on the left click SESSIONS AND LOGINS > Login Pages.

3. You can add new, or edit existing login page settings.

   • Click Add to add a login page and settings.
   • Click the name of the login page to edit the settings. The Login Page Properties screen opens.

4. In the Login URL setting, select the appropriate options for the URL.

   1. Specify whether the URL uses wildcards or is explicitly named. Select Wildcard or Explicit.

   2. Specify the URL protocol. Select HTTP or HTTPS.

   3. Select the URL to use, or select Custom URL and specify the URL.

5. In the Authentication Type setting, select the type of authentication to use.

6. In the Access Validation area, specify how the login page should be validated by typing one or more setting values.

   You define validation criteria on the response of the login URL. You must configure at least one of the validation criteria. If you configure more than one validation criteria, then all the criteria must be fulfilled in order to access the authenticated URL.

7. Save your work.

Add or edit logout page settings

You can view and manage logout page settings for the security policy to better protect the logout page URLs used by your web applications.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left click SESSIONS AND LOGINS > Logout Pages.

3. Specify whether you are adding or editing logout page settings.

   • Click Add to add a logout page and settings.
   • Click the name of the logout page to edit the settings. The Logout Page Properties screen opens.

4. In the Logout URL (explicit only) setting, select the appropriate options for the URL.

   1. Specify the URL protocol. Select HTTP or HTTPS.

   2. Select the URL to use, or select Custom URL and specify the URL.

5. In the A string that should appear in the response setting, type a string that should appear in the request (either the query string or in its payload) to indicate that the request is a logout request.

6. In the A string that should NOT appear in the response setting, type a string that should not appear in the request (either the query string or in its payload) to indicate that the request is a logout request.

7. Save your work.

Add or edit login enforcement settings

You can add and modify login enforcement properties. Login enforcement specifies the authenticated login URLs and logout URLs for the web application.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the appropriate policy, and on the left click SESSIONS AND LOGINS > Login Enforcements.

3. For the Expiration Time setting, specify whether you want the login session to expire.

   • If you do not want the login session to expire, click Disabled.
   • If you want the login URL to be valid for a limited time, click the button to the left of the Seconds field, and type a value, in seconds (1-99999), that indicates how long the session will last. The login session ends after the number of seconds has passed.

4. For the Authenticated URLs setting, specify the target URLs that users can access only by using the login URL.

   1. In the provided field, type the target URL name in the format /private.php.

      Wildcards are allowed.

   2. Click Add to add the URL to the list of authenticated URLs.

   3. Repeat to add as many authenticated URLs as needed.

      You can remove a URL from the list of authenticated URLs by clicking X.

5. Save your work.

Edit session tracking settings

You can enable session hijacking and session tracking to track, enforce, and report on user sessions and IP addresses.

1. Click Configuration > SECURITY > Web Application Security > Policies.

2. Click the name of the policy to work on, and on the left click SESSIONS AND LOGINS > Session Tracking.

3. To enable session hijack detection, for the Detect Session Hijacking by Device ID Tracking setting, select the Enabled check box.

   Review the notes displayed.

4. To configure session tracking, supply values for the following settings.

   1. Select the Session Awareness Enabled check box.

   2. For the Application Username setting, select the form of the username.

      • To use no application username, select None.
      • To use APM usernames and session IDs, select Use APM Usernames and Session ID.
      • To use individual login pages, select Use Individual Login Pages and then select the login page in the area provided.
      • To use all login pages, select Use All Login Pages.

5. To configure violation detection actions, specify additional settings.

   1. For Track Violations and Perform Actions, select the Enabled check box.

   2. For Violation Detection Period, type the number of seconds for the detection period.

6. In the Block All area, specify how the system performs when the Block All action is triggered.

7. In the Log All Requests area, specify how the system performs when the Log All Requests action is triggered.

8. In the Delay Blocking area, specify how the system performs when the Delay Blocking action is triggered.

9. Save your work.

Web Application Security policy templates

Applying Web Application Security policy templates

Use a template to populate the attributes of a new Web Application Security policy. Policy templates allow you to reduce the time required to configure a policy for your applications.

Each new security policy, by default, has a Rapid Deployment Policy template. You can replace the default with a user-defined or system-supplied template, and then modify the policy’s subcollections as needed. Unlike parent policies, if you modify a policy, once a template is configured, it does not affect the original template’s settings.

Whether you are creating, or applying a security policy to an object, keep in mind the BIG-IP device version over which you wish to deploy the policy. Some protection features are not available, or changed from version to version.

Important: System-defined templates (Generic and Application Ready policy templates) are aligned to support devices running versions 13.1 or later. This provides optimal deployment over multiple versions. This can omit certain fields that were added to newer device versions. It is recommended to monitor your security policy’s performance to ensure that your existing policy meets your applications needs. For more information about monitoring Web Application Security, see Modify and Manage Layer 7 Security Objects.

Generic Templates

Generic templates address most aspects of the application security policy suite, while remaining broad enough to protect any application, regardless of its platform. Each template varies based on the level of enforcement and traffic learning settings. For more information about each generic template, its settings, and version limitations, see Generic Web Application Security policy templates.

Application Ready Templates

Application ready security policies are baseline templates designed to secure that specific enterprise application platforms. Similar to generic templates, application ready templates provide a fixed policy that you can adjust settings manually, or configure additional security features. These templates are configured for the following platforms:

• Drupal v8
• Microsoft Outlook Web Access Exchange® 2016
• Sharepoint 2016
• Wordpress v4.9

Custom Policy Templates

Custom templates are created using existing Web Application Security policies. For more information, see Manage and create policy templates.

Note: Templates are ready aligned to support BIG-IP versions 13.1 or later, which allow for optimal deployment over different device versions. If you

Manage and create policy templates

Create, delete, or export Web Application Security policy templates. You can create a custom template by using an existing Web Application Security policy. This allows you to reduce configuration time required for a new protection policy.

Note: The following is the recommended procedure for managing your policy templates. You can create a template directly from the policies list by selecting a policy, clicking More and then Save as Policy Template.

1. Navigate to the Policy Templates screen, Configuration > SECURITY > Web Application Security > Policy Templates

   A list of all policy templates are displayed. Custom templates are marked as Yes in the User Defined column.

2. To add a new template click Add.

   1. (Required) On the New Policy Template screen enter a name to identify your new policy template.

   2. (Optional) Add a policy description to better identify the template’s settings.

   3. From the Template source field you can select Policy to create a template from a policy that is already configured to the system, or you can select File to import a policy from your local files.

   4. Click Save & Close.

      The new template can now be applied to a new Web Application Security policy. Any changes made to the original policy, following template creation, will not affect the template’s settings.

3. To export any template as an XML file, select a template and click Export.

4. To delete a custom template, select a user-defined template, and click Delete.

   The following action deletes the template, but it does not delete the original policy or policies created using the template.

Policy template management is immediately reflected in the list on the Policy Templates screen.

Generic Web Application Security policy templates

The following defines and details the generic policy templates you can apply when creating a new Web Application Security parent or child policy (Configuration > SECURITY > Web Application Security > Policies). These templates automatically populate required fields, based on the most common application protection needs. You can use these templates to pilot your security measure to fine-tune as needed.

Template Overview

Rapid Deployment Policy (RDP)

A moderate protection layer that includes manual learning of false positives. This protection template meets the majority of Web Application Security requirements.

Operational Cost: Low

BIG-IP Version Support*: All versions supported by BIG-IQ centralized management

API Security

A moderate protection layer that follows the same protection as RDP, with additional support for API security features such as: REST API (JSON, XML) and Websocket security.

Operational Cost: Low

BIG-IP Version Support*: Version 13.1.0.2 or later

Fundamental

A high-to-moderate protection layer that includes automatic learning of false positives, and specific entity types. This template includes a blocking enforcement mode.

Operational Cost: Medium

Comprehensive

A high protection layer with automatic learning for all entity types. This template includes a blocking enforcement mode.

Operational Cost: High

BIG-IP Version Support*: All versions supported by BIG-IQ centralized management

Passive Deployment Policy (PDP)

A low protection layer with a high level of automatic learning (similar to comprehensive), but fully transparent protection layer and does not interfere with the traffic. This template is designed to protect as many potential threats as possible, without the risk of affecting traffic with false positives.

Operational Cost: High

BIG-IP Version Support*: Version 13.1 or later

Vulnerability Assessment Baseline

Provides the lowest protection, and is used to create a security baseline by identifying, classifying and reporting security holes or weaknesses in your web site’s code.

Operational Cost: Medium

BIG-IP Version Support*: All versions supported by BIG-IQ centralized management

*General template support does not include all settings. Variations are indicated with the setting and template type.

Full Policy Template Settings

The following provides a list of all fields populated by each policy template, per configuration section. Sections and fields that are not affected are not included in this document.

POLICY BUILDING (Settings)

DATA GUARD

CSRF PROTECTION

ANOMALY DETECTION

HEADERS

Methods

All templates except for Vulnerability Assessment Baseline will include the three HTTP methods: GET, POST and HEAD.

Vulnerability Assessment Baseline includes all available HTTP methods, with their default action as follows

• Methods acting as GET: REPORT, HEAD, CHECKOUT, COPY, LOCK, MOVE, CHECKIN, UNLOCK, GET, OPTIONS, MERGE, X-MS-ENUMATTS, NOTIFY, MKCOL, SUBSCRIBE, POLL, CONNECT, ACL, VERSION_CONTROL, PROPFIND, UNSUBSCRIBE, PROPPATCH.
• Methods acting as POST: MKWORKSPACE, BPROPPATCH, BPROPFIND, BMOVE, RPC_IN_DATA, SEARCH, RPC_OUT_DATA, BCOPY, POST, UNLINK, LINK, PATCH.

URLS

CONTENT PROFILES

PARAMETERS

ATTACK SIGNATURES CONFIGURATION

THREAT CAMPAIGNS

The Threat Campaigns feature is only available to BIG-IP versions 14.0 or later. All templates, except for Vulnerability Assessment Baseline, have the Threat Campaign detected violation, enabled Alarmed and Blocked settings, and Enable Campaign staging disabled. For Vulnerability Assessment Baseline, both are disabled.

SESSIONS AND LOGINS

There are no pre-defined login or logout pages for any generic template.