1. Go to the General Properties screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy to modify, and then on the left click General Properties.
3. Edit the properties as appropriate.
4. Save your changes to the general properties of the policy.

1. Navigate to the Inheritance Settings screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the appropriate policy name to display the policy properties screen.
3. Click Inheritance Settings.
4. Review or modify the inheritance settings.
   The contents of this screen differ depending on whether the policy is a parent policy, a child policy, or neither.
5. If the current policy is neither a parent policy nor a child policy, the Parent Policy list is set to None, and no other properties are shown on the screen.
6. If the current policy is a child policy or will be a child policy, do the following.
   1. From the Parent Policy list, review or select a parent policy. By default, the setting is None.
   2. Review the list of properties that are displayed, and where needed, select Accept or Decline.
   3. Optionally, you can add comments about the inheritance settings by clicking the comment icon in the Comments column and then typing text in the space provided.
7. If the current policy is a parent policy, do the following.
   • In the Inheritance column, review or change the inheritance settings for each property in each property row.
     • If the property must be inherited by a child policy, click Mandatory.
     • If the property is optional for a child policy, click Optional.
     • If the property is not available to the child policy, click None.
   • The Accepted, Declined, Unread, and Comments columns show the number of child policies for each category for that property. Optionally, you can click the number to display additional information on the Child Policy Overview screen.
8. Click Save to save your changes.

1. Navigate to the Child Policy Overview screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to review, and click Child Policy Overview.
3. Review the inheritance settings for child policies associated with the parent policy.
   • Click All to view all properties that could be inherited by a child policy.
   • Click Declined to view only the properties that a child policy declined to inherit.
4. Expand each policy section in the list to review the inheritance status (declined or accepted) for each child policy.
5. Indicate whether you have reviewed declined inheritance properties. In the Policy Section row for a child policy property:
   • Click Mark as Read to indicate that you have reviewed a declined property for a child policy.
   • Click Mark as Unread to indicate that you have not reviewed a declined property for a child policy.
   • Click Mark All as Read to indicate that you have reviewed all declined properties within that heading.
   • To enter a comment, click the comment icon in the row. To remove all comments in a section, click Clear All in the heading row for a policy section.
6. Click Save to save your changes.

You can review and change the settings on various types of response pages. Response page settings specify the response content that the system sends to the user when the security policy blocks a client request.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to edit, and on the left of the new screen, click POLICY BUILDING > Overview .
3. To review the status of the devices being used for central policy building, expand Devices of Central Policy Building.
   The screen lists the devices and their status. You can click Refresh to update the device information.
4. To review or change enforcement readiness for various policy entities, expand Enforcement Readiness Summary.
   The screen shows a summary list of entities in the security policy that can be enforced, along with their status.
5. For additional information, you can click the links shown in the summary table.
   • In the Entity Type column, click the name of the policy entity type to review a list of suggestions for it, if any exist.
   • In the Learn New Entities column, you can see the learning status for the policy entity.
   • In the Total, Not Enforced, or Not Enforced And Have Suggestions columns, click the number of entities link to be taken to the appropriate policy screen. Entities that are not enforced are in staging, or have wildcard entities configured so that the security policy learns all explicit entities that match them.
   • In the Ready to be Enforced column, review the numbers. To enforce these entities, select the check box to the left in the row and click Enforce Selected Entities.
   • To update the data shown, click Refresh.
6. To review the suggestions used to reduce false positive alerts, expand Suggestions To Reduce Potential False-Positive Alerts.
   In this area, you see three lists: Top Violations, Top Violating Meta Characters, and Top Matched Signatures. You may need to scroll down to see all three. Each list contains suggestions for the entities listed, if there are any.
   • To see the suggestions associated with a listed entity, such as one of the top violations, click the name.
   • To update the data shown, click Refresh.
7. To review suggestions to add to new entries, expand Suggestions To Add New Entries.
   • You can review the new suggestions. These are listed by entity type.
   • To update the data shown, click Refresh.
8. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to edit, and on the left, click POLICY BUILDING > Suggestions .
3. To accept a suggestion, select it, click Actions, and select one of the accept options.
   • To accept a suggestion and have it added to the policy entity, select the Accept action.
   • To accept this suggestion and have it added to the policy entity in staged mode, select the Accept and Stage action.
   • To accept this suggestion and have it added globally at the policy level, select the Accept Globally action.
   Not all options are available for all suggestions. Unsupported options for a suggestion are not selectable. For example, the Accept and Stage option is only available for policy entities that support staging, such as signatures and URLs.
4. To delete a suggestion, select the check box to the left of the suggestion and click Delete.
   The policy builder can suggest a deleted suggestion again.
5. To ignore a suggestion, select the check box to the left of the suggestion and click Ignore.
   Once a suggestion is ignored, the policy builder will not suggest it again.
6. To see additional details about the suggestion, click the name of the suggestion.
   The additional details for the suggestion vary, but may include other related suggestions and the list of samples.
7. To add a comment to a suggestion, click the icon in the Comment column for that suggestion, and type your comment in the text box that opens.
8. To list either all suggestions or only a subset of the suggestions, select one of the options in the filtering area in the upper left of the screen, such as Pending Suggestions or Ignored Suggestions.
9. To perform a simple search of the suggestions, type the text to search for in the search area in the upper right of the screen.
   You cannot use the simple search when looking for a violation or a refinement. You must use an advanced search filter instead and select the violation or refinement.
10. To perform an advanced search using a filter, click the icon to the left of the search area in the upper right of the screen. The filter dialog box opens.
    • To use an existing filter, click the filter name. The filter is applied.
    • To create a new filter, click Create. The New Filter dialog box opens.
      1. In the Filter Name setting, type a name for the filter.
      2. In the Query Parameter area, specify values for the parameters you want to use to create the search filter. As you select parameters, the system creates the query in the Query Expression area.
      3. When you are done, click Save & Apply to save your changes and apply the filter.

1. Go to the Blocking Settings screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of a policy, and from the list on the left select POLICY BUILDING > Settings .
3. Click the arrows to open or close each category and display specific violation types available to configure for that category.
4. Edit the settings to meet your requirements.
5. When you are finished, save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of a policy, and on the left, click POLICY BUILDING > Settings .
3. Scroll to near the bottom of the settings properties screen, expand the Policy Building Process area, and specify settings as needed.
4. In the Trust IP Addresses setting, you specify IP addresses that the Policy Builder considers safe.
   • Select All IP Addresses to indicate that all IP addresses are safe.
   • Select Address List to indicate that all IP addresses in the displayed list are safe.
   • Click Edit IP Addresses to add IP addresses to the list.
5. For the Loosen Policy setting, you specify the number of sources that the system must detect during a specified time period, in order for the Policy Builder to accept and learn a policy change from traffic.
   For example, when the Policy Builder detects the same file type, URL, parameter, or cookie from enough different user sessions and IP addresses over time, it adds the entity to the security policy. You can configure values for both untrusted traffic and for trusted traffic.
6. For the Tighten Policy (stabilize) setting, you specify the number of requests and the amount of time that must pass for the Policy Builder to stabilize the policy element.
   Stabilizing the policy element may mean tightening it by deleting wildcard entities, removing entities from staging mode, and enforcing violations that did not occur, depending on the element.
7. For the Minimize false positives (Track Site Changes) setting, you specify whether, after stabilizing the policy, the Policy Builder remains enabled, and if enabled, how it handles trusted and untrusted traffic to minimize false positives.
   • Select Enable to specify that after the Policy Builder stabilizes the policy, the Policy Builder remains enabled, and may still make changes to the policy by loosening it, usually as a result of changes to the web application. Specifies, when cleared (disabled), that after the Policy Builder stabilizes the policy, it disables itself and makes no more changes to the policy, even if it detects that changes were made to the web application.
   • Select From Trusted and Untrusted Traffic to specify that the Policy Builder loosens the policy based on traffic from trusted and not trusted sources. This setting is available only if Enable is selected.
   • Select Only from Trusted Traffic to specify that the Policy Builder loosens the policy based on traffic from trusted sources. Click IP Address Exceptions to define a trusted IP addresses. This setting is available only if Enable is selected.
   You configure values for trusted and untrusted traffic separately.
8. For the Options setting, you can establish options that determine what type of entities the Policy Builder adds to the policy.
   • When enabled, Learn from responses specifies that the Policy Builder adds elements found in responses to the policy, when either of the following circumstances is true:
     • The Policy Builder trusts the request IP address (because the request IP address appears in the Trusted IP Addresses list).
     • The Policy Builder does not trust the request IP address (because the request IP address does not appear in the Trusted IP Addresses list), but the request is legal and fully enforced. Legal means that the request does not trigger any violations, suggestions to learn explicit entities, and staging suggestions. Fully enforced means that the system is not currently determining whether URLs and parameters found in the request are to be parsed as JSON or XML and should be assigned to content profiles.

     If the Policy Builder learns from responses, it uses the trusted traffic thresholds configured on this screen. This does not include learning from violations in responses. In that case, the thresholds are determined by whether the client IP address is trusted or untrusted.

     Specifies, when Learn from responses is cleared (disabled), that the Policy Builder never adds elements found in responses to the policy. Violations occurring in responses are learned according to the learn flag of each violation and do not depend on this setting.

     Note: This setting applies only to what can be learned from the response content such as occurrences of URLs and parameters. It does not apply to learning from violations that occur in responses, such as Data Guard leakage. Learning from these violations is determined by the Learn flag of the respective violation.
   • When enabled, Suggest to delete policy entity if it was not observed in traffic for more than specifies that a suggestion to delete a policy entity should be made if that entity hasn't been observed in traffic for the specified number of days.
   • Select Full Policy Inspection to specify that the Policy Builder learns all policy elements. Specifies, when cleared (disabled), that you are limiting the number of entities the Policy Builder learns.
     Note: Do not disable this check box unless F5 Support advises it.
   • In the HTTP Response Status Codes used to learn traffic setting, you can specify that the Policy Builder extracts information from traffic based on transactions that return specific HTTP response status codes. In the field type the response code that must be returned in order for the Policy Builder to extract information from that traffic.

     Click Add to add the response status code to the response status codes list. You may enter either a specific response code number from 0 to 599, or a generic code, for example, 4xx. The response status codes list displays the response codes allowed by the Policy Builder and in the policy.

     Click the X to the left of the response code to remove the selected response status code from the response status codes list and to make it disallowed by the Policy Builder.

9. When you are finished, save the modifications.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to edit, then on the next screen, on the left, click Server Technologies.
3. Select the server technology from the list.
   A confirmation dialog box opens listing the changes that will be made to the policy.
4. Confirm that you want to add the server technology by clicking OK in the dialog box.
   The technologies are added to the list of selected server technologies.
5. To remove a server technology entry, click the X to the left of that entry.
6. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click a policy name, and on the left click Data Guard.
3. In the Data Guard setting, select Enabled so that you can modify the other settings.
   When this setting is disabled, the system sends the response, including the sensitive information, to the user.
4. Modify the settings as needed to specify how the system treats sensitive data:

   Option	Description
   Protect credit card numbers	Specifies that the system considers credit card numbers as sensitive data. The system returns asterisks to the client instead of the sensitive data.
   Protect U.S. security card numbers	When selected, the system considers U.S. security card numbers as sensitive data.
   Mask sensitive data	When selected, the system masks sensitive data returned by the web server by returning asterisk ( * ) characters to the client instead of the sensitive data.
   Custom Patterns	When selected, specifies that the system recognizes customized patterns as sensitive data. In the field, type a pattern that you want the system to consider as sensitive data, and click Add. Use PCRE regular expression syntax for the pattern, for example, 999-[/d][/d]-[/d][/d][/d][/d]. To delete a selected pattern, click X.
   Exception Patterns	When selected, the system recognize exception patterns as not being sensitive data. In the field, type a pattern that you want the system to consider as an exception to sensitive data, and click Add. Use PCRE regular expression syntax for the pattern, for example, 999-[/d][/d]-[/d][/d][/d][/d]. To delete a selected pattern, click X.
   File Content Detection	When this is selected, you specify the possible types of content the system could consider as sensitive data. The system checks responses for the selected file content, and if it finds it, that content is not returned,
   Enforcement Mode	Specify whether the listed URLs should be enforced or ignored by Data Guard. Select Enforce URLs in List to have Data Guard protect these URLs even if they are not in the policy. Select Ignore URLs in List to have Data Guard protect all URLS except those in this list. Add a URL to the list by typing it in the field and clicking Add. Note: When adding URLs, you can type either explicit (/index.html) or wildcard (*xyz.html) URLs.

5. When you are finished, save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of a policy, and from the list on the left, select CSRF Protection.
3. For the CSRF Protection setting, select the Enabled check box.
   The screen displays the other property settings.
4. For the SSL Only setting, select the Enabled check box.
5. For the Expiration Time setting, select the Enabled check box, then provide the expiration time in seconds in the area provided.
6. Use the CSRF URLs area to add, remove, or modify CSRF URLs to be protected.
   Existing URLs are listed in their evaluation order at the bottom of the screen.
   For BIG-IP^® device versions earlier than 13.1, URLs added to the CSRF URLs list must have the following settings:

   • Specify the Method setting as Any.
   • Specify the Enforcement Action setting as Verify CSRF Token.
   • Specify the Required Parameters setting as At Least One.
7. To add a new URL to the list:
   1. In the Method setting, select the method type.
   2. In the URL setting, type the URL to be protected.
   3. In the Enforcement Action setting, select the type of enforcement.
   4. In the Required Parameters setting, specify whether there are any required parameters, and if needed, provide them.
   5. Click Add.
8. To edit existing CSRF URLs:
   • To modify a URL, change the required parameters or enforcement action in the list at the bottom of the screen.
   • To change the evaluation order of a URL, drag the URL row to a new position in the list.
   • To delete a URL from the list, click the X to the left of the URL.
9. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of a policy, and on the left click ANOMALY DETECTION > Brute Force Attack Prevention .
3. Specify the action to take for brute force attack prevention settings:
   • To add a login URL to the security policy, click Add.
   • To modify the brute force prevention properties for a login URL, click the name of the login URL.
   The brute force prevention properties display.
4. Supply the general properties for brute force attack prevention for the login URL.
   1. In the Login Page setting, select a login page, or create a login page by clicking Create login page.
   2. In the Configuration Support setting, specify whether to use current or legacy settings. The other available properties differ based on this setting.
      • Select Current when managing a BIG-IP^® device version later than 13.0.
      • Select 13.0 And Prior when managing a BIG-IP device version 13.0 or earlier.
   3. In the IP Address Whitelist setting, review the settings or add new settings. To add an IP address, click the IP Address Whitelist setting link.
5. In the Source-based Brute Force Protection area, supply the source-based protection settings.
   This area is available only when Configuration Support is set to Current.
   1. In the Detection Period setting, type the number of minutes the detection period should last.
   2. In the Maximum Prevention Duration setting, type the number of minutes the prevention period should last.
   3. For each of the other settings in this section, set the trigger and the action:
      • In the Trigger setting, specify when the trigger for the action occurs by selecting either Never or After a specified value is reached.
      • For the Action setting, select the action that occurs when the trigger is reached.
6. In the Distributed Brute Force Protection area, supply the distributed protection settings.
   This area is available only when Configuration Support is set to Current.
   1. In the Detection Period setting, type the number of minutes for detection.
   2. In the Maximum Prevention Duration setting, type the number of minutes for maximum prevention duration.
   3. In the Detect Distributed Attack setting, select when the distributed attack detection occurs.
      • Select Never to have no distributed brute force attack protection.
      • Select After x failed login attempts to have distributed brute force attacks detected if x failed logins are detected within the Detection Period configured previously.
   4. In the Detect Credential Stuffing setting, select when the detection should occur.
      • Select Never to have no credential stuffing detection.
      • Select After x login attempts that match stole credentials dictionary to have it reported when the configured conditions are met.
   5. In the Mitigation setting, select the distributed brute force protection mitigation option to use.
7. In the Session-based Brute Force Protection area, supply the session-based protection settings.
   This area is available only when the Configuration Support setting is set to 13.0 And Prior.
   • In the Login Attempts from the Same Client setting, type the number of attempts to allow.
   • In the Re-enable Login After setting, type the number of seconds.
   • In the Use Device ID setting, specify whether it is enabled.
8. In the Dynamic Brute Force Protection area, supply the dynamic protection settings.
   This area is available only when the Configuration Support setting is set to 13.0 And Prior.
   • For the Operation Mode setting, select one of the modes: Off, Alarm, or Alarm and Block.
   • In the Measurement Period field, type the number of seconds.
   • In the Detection Criteria field, type the values that define when a problem is detected.
   • For the Prevention Policy setting, select one or of the options to use for the policy. When Source IP-Based Client Side Integrity Defense is selected, the Suspicious Criteria (per IP address) setting is displayed and can be modified.
   • In the Suspicious Criteria (per IP address) setting, type the values that define when failed login attempts become suspicious.
   • In the Prevention Duration setting, select the duration. This setting is displayed only when Source IP-Based Client Side Integrity Defense is selected in the Prevention Policy setting.
     • To have no limit on the duration, select Unlimited.
     • To have a maximum duration, select Maximum and type a value for the number of seconds.
9. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the policy name, and then click HEADERS > Methods .
3. Click Add to add a method.
4. From the Method list, select a method.
5. When you are finished, click Save.
   The new method is added to the list on the Methods screen. The method appears in blue, meaning that you can edit it. The check box to the left indicates that you can also delete it.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the policy name, and then on the left, click HEADERS > HTTP Headers .
3. Select whether to add a new HTTP header or view or modify an existing HTTP header.
   • Click Add to add a new header.
   • Click the name of the header to view or modify the properties.
   Only HTTP headers that are displayed in blue can be modified or viewed.
4. Provide or modify the header settings as appropriate.
   • Name. When adding a new header, select the name of the HTTP header from the list. When modifying a header, the name cannot be changed.
   • Type. Specifies explicit or wildcard. The only wildcard header in the system is the default pure wildcard header (*).
   • Mandatory. If enabled, requires this header to appear in requests.
   • Check Signatures. If this is enabled, the system performs attack signature checks on this header.
   • Base64 Decoding. When enabled, specifies that the security policy checks the parameter’s value for Base64 encoding, and decodes the value. The default is disabled.
   • Normalization. Specifies whether the system normalizes headers. Select the options for which type of normalization the system should perform on headers. There is a performance trade-off when using normalization, so use it only when needed.
     • Percent Decoding: Specifies, when enabled, that the system performs the following actions on header content: %XX and %uXX, bad unescaping, Apache whitespace, IIS Unicode codepoints, and plus to space.
     • URL Normalization and Percent Decoding: Specifies, when enabled, that the system performs the these actions on header content: multiple slashes, directory traversal, backslash replacement, and path parameter removal, and all Percent Decoding checks.
     • HTML Normalization: Specifies, when enabled, that the system performs the following actions on header content: removes all non-printables, whitespaces and the “+” character, skips comments, decodes HTML entities, performs hex decoding, decimal decoding, 0xXX decoding, style sheet escaping, and removes backslashes.
   • Evasion Techniques Violations. Specifies, when enabled, that the system logs and/or suggests learning suggestions for evasion violations detected during the normalization process if there are problems during the normalization of the specific header. The default is disabled.
   • Overridden Security Policy Settings. If used, select the signature override from the list and then enable or disable it by clicking Enabled or Disabled.
5. When you are finished, click Save.

1. Navigate to the Host Names screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Then click the name of the appropriate policy, and on the left click HEADERS > Host Names .
3. Review the list of host names.
   If no host names are listed, you can add them by clicking the Add.
4. To modify a host name, click the name of the host name.
   The Host Name properties screen opens.
5. Review the Host Name.
6. To allow users to be redirected to a sub-domain of this host name, select the Include Sub-domains check box.
7. To set the policy to transparent mode and forward all responses, select the check box for Policy is always transparent for this host.
8. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left click HEADERS > Cookies .
   The screen displays a list of cookies.
3. To add a new cookie, click Add, or click a cookie name to modify an existing cookie.
   You use the same process to modify or add a cookie. However, you can specify some properties only when adding a cookie, and not modifying an existing cookie.
4. Type or review the Cookie Name, and specify whether it is Explicit or is a Wildcard expression.
   You can specify a cookie name only when adding a new cookie.
5. Specify the Cookie Type:
   • Select Allowed to indicate the client may change the cookie.
   • Select Enforced to indicate that the cookie cannot be changed by the client.
   Allowed provides additional options.
6. Select the settings for the cookie.
   • For Perform Staging, select the Enabled check box to indicate that the cookie is placed in staging.
   • For Insert HTTPOnly attribute, select the check box to insert the attribute in the domain cookie response header.
   • For Insert SameSite attribute, specify whether the attribute should be set to None, Strict, or Lax. Only None can be selected for BIG-IP^® devices earlier than version 13.1.
   • For Insert Secure attribute, select the check box to insert the attribute into the domain cookie response header.
   • For Base64 Decoding, select the check box to enable decoding of Base64 strings. (This setting is displayed only if the Cookie Type is set to Allowed.)
   • For Attack Signatures Check, select the check box to verify attack signatures and display attack signature override settings. (This setting is displayed only if the Cookie Type is set to Allowed.)
   • For Attack Signature Overrides, select a signature from the list, and then click Enabled or Disabled to indicate whether each signature should be overridden.
7. To remove a cookie from staging, select the check box for the cookie and click Enforce Selected.
8. To filter the list of cookies by their enforcement readiness, select an option from the Enforcement Readinesssetting.
   Enforcement readiness is the state of enforcement for each cookie, such as not enforced,, has a suggestion, or is ready to be enforced.
   • To list all cookies, select All.
   • To list cookies that have one or more suggestions, select Has suggestion.
   • To list cookies that are not being enforced, select Not enforced.
   • To list cookies that are ready to be enforced, select Ready to be enforced.
9. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left click HEADERS > Redirection Protection .
3. For the Redirection Protection setting, select the Enabled check box.
   The screen displays other property settings.
4. For Domain Name, type the domain name that is allowed by the security policy.
5. To have the security policy also allow sub-domains of the domain, select the Include Sub-Domains check box.
6. To add the domain to the Allowed Redirection Domains list, click Add.
7. To delete a domain from the Allowed Redirection Domains, click the X to the left of that domain name.
   The domain is removed without confirmation.
8. Save your work.

1. Navigate to the Character Set screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, expand HEADERS and click Character Set.
3. Review the list of characters, and for each, determine whether it should be allowed.
   You can use the View options to select which group of characters are displayed.
   • To allow characters in a header, select the check box in the Allowed column of the table row .
   • For characters that should not be allowed in a header, clear the check box in the Allowed column of the table row.
4. Click Save to save your changes.

1. Navigate to the IP Address screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Select a policy name, expand IP ADDRESSES, and select IP Addresses List.
3. Click Add.
4. Type an IP Address that you want the system to trust.
   To add a route domain, type %n after the IP address where n is the route domain identification number.
5. Type a Netmask.
   If you omit the netmask value, the system uses a default value of 255.255.255.255.
6. Select whichever of the following options should be enabled.
   • Select the Policy Builder Trusted IP check box to specify that the Policy Builder considers traffic from this IP address to be legitimate. The Policy Builder automatically adds to the security policy data logged from traffic sent from this IP address.
   • Select the Ignore in Anomaly Detection and do not Collect Device ID check box to specify that the system considers traffic from this IP address to be safe. The security policy does not take this IP address into account when performing brute force prevention and web scraping detection.
   • Select the Ignore in Learning Suggestion check box to specify that the system not generate learning suggestions from traffic sent from this IP address.
   • Select the Never log traffic from this IP Address check box to specify that the system not log requests or responses sent from this IP address, even if the security policy is configured to log all traffic.
   • Select the Ignore IP Address Intelligence check box to specify that the system considers traffic from this IP address to be safe even if it matches an IP address in the IP Address Intelligence database.
7. In the Block this IP Address setting, select one of the blocking options.
   • Select Policy Default to use the policy blocking settings.
   • Select Never Block This IP to not block this IP address.
   • Select Always Block This IP to block this IP address.
   If Always Block This IP is selected, many of the options become invalid and are removed from the screen.
8. Type a brief description for the IP address.
9. When you are finished, click Save to save the modifications and unlock the policy.

1. Navigate to the IP Address screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Select a policy name, expand IP ADDRESSES, and select IP Address Intelligence.
3. Select the IP Address Intelligence Enabled check box.
   Other properties display; you can review the descriptions of the properties for additional information.
4. For the IP Address White List setting, type the IP address and subnet mask for each IP address that should be whitelisted, and click Add after each addition.
5. In the IP Address Intelligence Categories area, specify the categories that you want to alarm or block.
   • Select the Alarm check box to specify that whenever a request is sent from a source IP address that matches the category, the system logs the IP Intelligence data.
   • Select the Block check box to specify that the system stops requests sent from a source IP address that matches the category.
     Note: In order for the system to block requests, the security policy must be in Blocking mode.
6. Click Save when you are done.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, then on the left expand URLs, and click HTTP.
   The screen displays the list of HTTP URLs. You can add, delete, or reorder the HTTP URLs that are allowed or disallowed.
3. To add an allowed or disallowed HTTP URL to a policy, click Add for the allowed or disallowed list.
   Allowed HTTP URLs are listed at the top of the screen and disallowed HTTP URLs are listed at the bottom. The Add URL screen displays the properties, which differ between allowed URLs and disallowed URLs.
   • For disallowed HTTP URLs, specify whether the protocol is HTTP or HTTPS, and type the URL name.
   • For allowed HTTP URLs, specify whether the URL is explicit or a wildcard, whether the protocol is HTTP or HTTPS, and type the URL name or wildcard. Specify or modify additional properties for the allowed HTTP URL as needed.
4. Save your work.
5. To review or edit the properties of a URL, click the URL to open the Properties screen.
   Allowed URLs are listed in the Allowed URL column in the upper table of URLs. Disallowed URLs are listed in the Disallowed URL column in the bottom table of URLs.
6. To change the processing order of allowed URLS with the wildcard type, click Wildcards Order.
   The Wildcard Order screen opens, where you can move the wildcard entries in the list to change their sequence, and save your work.
7. To remove an HTTP URL from staging, select the check box for the HTTP URL and click Enforce Selected.
8. To filter the list of HTTP URLs by their enforcement readiness, select a value from the Enforcement Readiness setting.
   • To list all HTTP URLs, select All.
   • To list HTTP URLs that have one or more suggestions, select Has suggestion.
   • To list HTTP URLs that are not being enforced, select Not enforced.
   • To list HTTP URLs that are ready to be enforced, select Ready to be enforced.
9. To delete an allowed or disallowed HTTP URL from the policy, select the check box in the row for that HTTP URL and click Delete in the upper or lower portion of the screen, whichever is appropriate.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, then on the left expand URLs and click WebSocket.
   The WebSocket URLs screen opens where you can add, or edit, WebSocket URLs.
3. To remove the WebSocket URL from staging, select the check box for the WebSocket URL and click Enforce Selected.
4. To edit the properties of a WebSocket URL, click the URL in either the Allowed WebSocket URLs or Disallowed WebSocket URLs column.
   The WebSocket URL properties screen opens, and you can change the properties (as described in the details for adding a URL of that type).
5. To add a WebSocket URL to a policy, determine whether it is an allowed or disallowed WebSocket URL.
   • To add an allowed WebSocket URL, click Add in the upper portion of the screen. This opens the Add Allowed WebSocket URL screen, where you can supply the needed properties.
   • To add a disallowed WebSocket URL, click Add in the lower portion of the screen. This opens the Add Disallowed WebSocket URL screen, where you can supply the needed properties.
6. For disallowed WebSocket URLs:
   1. Specify whether the protocol is WS or WSS.
   2. Type the URL name.
7. For allowed WebSocket URLs, supply the needed properties.
   1. In the Properties area, supply or modify the overall properties for the WebSocket URL.
   2. In the Message Handling area, supply or modify the message handling properties for the WebSocket URL.
   3. For wildcard URLs, expand the Meta Characters area to specify how meta characters are handled.
      • For Check Signatures on this URL, select the Enabled check box.
      • For Check characters on this URL, select the meta characters from the list and then click Allow or Disallow as needed.
   4. In the HTML5 Cross-Domain Request Enforcement area, supply or modify the HTML5 cross-domain request enforcement properties for the WebSocket URL.
8. To filter the list of WebSocket URLs by their enforcement readiness, select an option from the Enforcement Readiness list.
   • To list all WebSocket URLs, select All.
   • To list WebSocket URLs that have one or more suggestions, select Has suggestion.
   • To list WebSocket URLs that are not being enforced, select Not enforced.
   • To list WebSocket URLs that are ready to be enforced, select Ready to be enforced.
9. Save your work.

1. Navigate to the Character Sets URL screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, on the left expand URLs, and click Character Sets.
3. Review the list of characters, and for each, determine whether it should be allowed.
   You can use the View options to select which group of characters are displayed.
   • To allow characters in a URL, select the check box in the Allowed column of the table row.
   • For characters that should not be allowed in a URL, clear the check box in the Allowed column of the table row.
4. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy to change, and on the left, click File Types.
   The screen displays a list of file types.
3. To remove the file type from staging, select the check box for the file type and click Enforce Selected.
4. To add a file type to the policy, click Add in either the Allowed File Types area at the top of the screen, or in the Disallowed File Types area at the bottom of the screen.
   • Use the Allowed File Types area to add file types that the security policy considers legal, and to view information about each file type.
   • Use the Disallowed File Types area to add file types that the security policy considers illegal, and to exclude file types that are included in allowed wildcard file types.
   The screen displays fields applicable to your selection.
5. If you chose to add Disallowed File Types, fill in the name.
6. If you chose to add Allowed File Types, fill in these settings.
   1. For File type, select whether the file type is a wildcard or is explicit, and type a wildcard name or an explicit name.
   2. For Perform Staging, select the Enabled check box to have the system perform staging.
   3. For URL Length, type the maximum acceptable length, in bytes, of a URL containing this file type.
   4. For Request Length, type the maximum acceptable length, in bytes, of the request containing this file type.
   5. For Query String Length, type the maximum acceptable length, in bytes, for the query string portion of a URL that contains this file type.
   6. For POST Data Length, type the maximum acceptable length, in bytes, for the POST data of an HTTP request that contains the file type.
   7. For Apply Response Signature Staging, select the check box to apply response signature staging.
7. To filter the list of file types by their enforcement readiness, select an option from the Enforcement Readiness setting.
   • To list all file types, select All.
   • To list file types that have one or more suggestions, select Has suggestion.
   • To list file types that are not being enforced, select Not enforced.
   • To list file types that are ready to be enforced, select Ready to be enforced.
8. When you are finished, save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to modify, then on the left expand CONTENT PROFILES, and click JSON Profiles.
3. Click the name of the JSON profile to modify, or click Add to create a new one.
4. Review the existing name, or type a Profile Name for the new profile.
5. Revise or type an optional Description for the profile.
6. In the Maximum Total Length Of JSON Data field, type or revise the longest length, in bytes, allowed by the security policy of the request payload, or parameter value, where the JSON data was found.
   To have no length restriction, you can leave this field blank.
7. In the Maximum Value Length field, type or revise the maximum acceptable length, in bytes, of the longest JSON element value in the document allowed by the security policy.
   To have no length restriction, you can leave this field blank.
8. For Maximum Structure Depth, type or revise the greatest nesting depth found in the JSON structure allowed by the security policy.
   To have no depth restriction, you can leave this field blank.
9. In the Maximum Array Length field, type or revise the largest number of elements allowed for arrays.
   To have no array length restriction, you can leave this field blank.
10. For Tolerate JSON Parsing Warnings, specify whether to enable response signature staging.
    • Select the Enabled check box to specify that the system does not report when the security enforcer encounters warnings while parsing JSON content.
    • Clear the check box to specify that the security policy reports when the security enforcer encounters warnings while parsing JSON content.
11. For Parse Parameters, specify whether to enable parameter parsing.
    • To enable parsing, select the Enabled check box.
    • When this setting is disabled, the system displays more main areas (such as Attack Signature Overrides, Meta Characters, and Sensitive Data Configuration) with additional properties for review and modification.
12. Expand the Attack Signatures Overrides area to select any signature overrides. (This area is displayed only when Parse Parameters is disabled.)
    • For the Attack Signatures Check setting, select the Enabled check box.
    • For the Attack Signatures Overrides setting, select the signature from the list and then click Enabled or Disabled as needed for that signature.
13. Expand the Meta Characters area to select how meta characters are handled. (This area is displayed only when Parse Parameters is disabled.)
    • For the Check Characters setting, select the Enabled check box.
    • For the Overrides setting, select the meta characters from the list and then click Allowed or Disallowed as needed.
14. Expand the Sensitive Data Configuration area to select how sensitive data is handled. (This area is displayed only when Parse Parameters is disabled.)
    1. In the Sensitive Data setting, type an element name within the JSON data whose values the system should consider sensitive.
    2. Click Add to add the element name to the sensitive data list.
15. Click Save to save your changes.

1. Navigate to the XML Profiles screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to work with, then, on the left, expand CONTENT PROFILES, and click XML Profiles.
3. Click the name of the XML profile to modify, or click Add to create a new one.
4. Review the existing name or type a Profile Name for the new profile.
5. Review, revise, or type an optional Description for the profile.
6. For the Use XML Blocking Response Page property, select the type of response page to send when the security policy blocks a client request that contains URL XML content that does not comply with the settings of this XML profile.
   • To have the system send an XML response page, select the Enabled check box.
   • To have the system send the default response page, do not select the Enabled check box.
7. To configure the validation and defense settings of an XML profile, expand the XML Firewall Configuration area and modify those settings as needed.
8. To configure the system to perform attack signature checks on the XML profile, expand the Attack Signatures area and modify those settings as needed.
9. To change the security policy settings for specific meta characters in XML values on the XML profile, expand the Meta Characters area and modify those settings as needed.
10. Expand the Sensitive Data Configuration area to program the system to mask sensitive data that appears in an XML document, as shown in the BIG-IP device configuration interface and internal Application Security logs.
11. Click Save to save your changes.

1. Navigate to the Plain Text Profiles screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to modify, at the left, expand CONTENT PROFILES, and click Plain Text Profiles.
3. Click the name of the plain text profile to modify, or click Add to create a new one.
4. Review the existing, or type a Profile Name for the new profile.
5. Review, revise, or type an optional Description for the profile.
6. In the Maximum Total Length field, type the longest length, in bytes, allowed by the security policy.
   You can leave this field blank to have no length restriction.
7. In the Maximum Line Length field, type the longest line length, in bytes, allowed by the security policy.
   You can leave this field blank to have no length restriction.
8. If you want the system to perform percent decoding, select the Perform Percent Decoding Enabled check box.
9. To configure attack signature overrides, expand Attack Signatures Overrides and supply the needed values.
   1. In the Attack Signatures Check setting, select the Enabled check box.
   2. In the Attack Signatures Overrides setting, select one or more attack signatures to override.
   3. For each attack signature, select whether the override is enabled or disabled.
10. To change the security policy settings for specific meta characters in values on the plain text profile, expand Meta Characters and supply the needed values.
    1. In the Check Characters setting, select the Enabled check box.
    2. In the Overrides setting, select one or more meta characters to override.
    3. For each meta character, select whether the override is allowed or disallowed.
11. Click Save to save your changes.

1. Navigate to the JSON screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy you want to work with, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click JSON.
3. Review the list of characters, and for each, determine whether it should be allowed or not.
   • To allow characters, select the check box in the Allowed column of the table row.
   • For characters that should not be allowed, clear the check box in the Allowed column of the table row.
   Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.
   • Click Allowed to display only characters that are marked as allowed.
   • Click Disallowed to display only characters that are not allowed.
4. Click Save to save your changes.

1. Navigate to the Plain Text screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click Plain Text.
3. Review the list of characters, and for each, determine whether it should be allowed or not.
   • To allow characters, select the check box in the Allowed column of the table row.
   • For characters that should not be allowed, clear the check box in the Allowed column of the table row.
   Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.
   • Click Allowed to display only characters that are marked as allowed.
   • Click Disallowed to display only characters that are not allowed.
4. Click Save to save your changes.

1. Navigate to the XML screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left expand CONTENT PROFILES and CHARACTER SETS, then click XML.
3. Review the list of characters, and for each, determine whether it should be allowed or not.
   • To allow characters, select the check box in the Allowed column of the table row .
   • For characters that should not be allowed, clear the check box in the Allowed column of the table row.
   Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.
   • Click Allowed to display only characters that are marked as allowed.
   • Click Disallowed to display only characters that are not allowed.
4. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click a policy name, and on the left, click PARAMETERS > Parameters .
3. You can add a new, or edit an existing, parameter.
   • To add a new parameter, click Add.
   • To edit an existing parameter, click the parameter name.
   The properties screen opens for the new or existing parameter.
4. To remove the parameter from staging, select the check box for the parameter and click Enforce Selected.
5. For a new parameter, for the Name setting, select the type, and then type a name for the new parameter.
   • Select explicit if this is a regular named parameter.
   • Select wildcard if any parameter name that matches the wildcard expression is permitted by the security policy. (For example, typing the wildcard * specifies that the security policy allows every parameter.) The syntax for wildcard entities is based on shell-style wildcard characters.
   • Select no name if this parameter does not have a name. The system automatically names the parameter no name and it behaves the same as an explicit parameter.
   The name setting cannot be changed once the parameter is created.
6. For Level, select the level of parameters to be displayed.
   • Select global to display global parameters not associated with flows or URLs.
   • Select URL to display parameters associated with flows or URLs, select HTTP or HTTPS as the protocol, and then select the URL.
   If the security policy is configured to differentiate between HTTP and HTTPS URLs, then you can additionally filter URL parameters by the HTTP and HTTPS protocols.
7. To enable or allow any of these settings, click the Enabled check box for the setting:
   • Select Perform Staging to display the staging status on this parameter.
   • Select Allow Empty Value to allow empty values.
   • Select Allow Repeated Occurrences to allow repeated occurrences.
   • Select Sensitive Parameter to, in a validated request, protect sensitive user input, such as a password or a credit card number. The contents of sensitive parameters are not visible in logs or in the user interface.
8. Specify the Value type for the parameter.
   The value type you specify might display additional fields. You cannot change the value type after it is created.
   • Select dynamic-content for parameters whose data is dynamic.
   • Select ignore for parameters whose values the system does not check.
   • Select json for JSON parameters fetched from the server that are not editable.
   • Select static-content for parameters whose data is static. In the Parameter Static values area displayed at the bottom of the screen, supply a value in the Add New Value setting, and click Add. Add or subtract values as needed.
   • Select user-input for parameters whose data is provided by user-input. Use the Data type setting to provided additional information about the user input.
   • Select xml for XML parameters fetched from the server that are not editable. In the XML Profile area displayed at the bottom of the page, select an XML profile.
9. For the Data type setting, select the data type to use for the user input.
   • Select email to specify that the data must be text in email format only. In the Data type attributes area, specify a value for the Maximum Length setting in bytes.
   • Select alpha-numeric to specify that the data can be any text consisting of letters, digits, and the underscore character.
     • In the Data type attributes area, specify a value for the Maximum Length setting in bytes, and select whether to enable regular expressions or Base64 encoding. When the Regular Exp setting is enabled, it specifies that the parameter value includes the specified parameter pattern. This is a positive regular expression that defines what is legal.
     • In the Value Meta Character area, select the Enabled check box and then select which meta character to allow or disallow as a value.
     • In the Attack Signatures area, select the Enabled check box and then select which attack signature overrides to enable or disable.
   • Select integer to specify that the data must be whole numbers only (no decimals). In the Data type attribute area, specify values for the Minimum Value , Maximum Value, and Maximum Length settings.
   • Select decimal to specify that the data is numbers only and can include decimals. In the Data type attributes area, specify values for the Minimum Value , Maximum Value, and Maximum Length settings.
   • Select phone to specify that the data can be text in telephone number format only. In the Data type attributes area, specify a value for the Maximum Length setting.
   • Select file upload to specify there is no text limit for the data (length checks only). In the Data type attributes area, specify a value for the Maximum Length setting, and specify whether to disallow file uploading or enable Base64 encoding.
10. To filter the list of parameters by their enforcement readiness, select an option from the Enforcement Readiness setting.
    • To list all parameters, select All.
    • To list parameters that have one or more suggestions, select Has suggestion.
    • To list parameters that are not being enforced, select Not enforced.
    • To list parameters that are ready to be enforced, select Ready to be enforced.
11. When you are finished, save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies.
2. Click the name of the policy and then on the left, click PARAMETERS > Extractions .
3. You can add a new or edit an existing extraction.
   • To add a new extraction, click Add.
   • To edit an existing extraction, click the extraction name.
   The properties screen opens for the new or existing extraction.
4. For a new extraction, specify the Name of the dynamic parameter for which the system extracts values from responses.
   • For a named parameter, select New and type the name in the field.
   • For the UNNAMED parameter, select no name.
   The name setting cannot be changed once the extraction is created.
5. In the Extracted Items Configuration area, specify the items from which the system should extract the values for dynamic parameters.

   Option	Description
   Extract From	File Types. Specifies, when checked (enabled), that the system extracts the values of dynamic parameters from responses to requests for file types that exist in the security policy. To add a file type to be extracted, select an file type from the list, and click Add. URLs. Specifies, when checked (enabled), that the system extracts the values of dynamic parameters from responses to requests for the listed URLs. To specify the URLs from which the system extracts dynamic parameter values, select either HTTP or HTTPS from the list, type the URL in the adjacent field, and click Add. If you enter a URL that does not yet exist in the security policy, the URL is added to the security policy. RegEx. Specifies, when checked (enabled), that the system extracts the values of dynamic parameters from responses to requests that match the listed pattern (regular expression). Type the regular expression in the field.
   Extract From All Items	Specifies when selected (enabled), that the system extracts the values of the dynamic parameters from all URLs found in the web application. Specifies when cleared (disabled), that the system extracts the values of the dynamic parameters from limited items found in the web application.

6. In the Extracted Method Configuration area, specify the methods by which the system extracts the values for dynamic parameters.

   Option	Description
   Search in Links	Specifies, when checked (enabled), that the system searches for dynamic parameter values within links that appear in the response body.
   Search Entire Form	Specifies, when checked (enabled), that the system searches for dynamic parameter values in the entire form found on a web page.
   Search Within Form	Specifies, when checked (enabled), that the system searches for dynamic parameter values in a specific location within forms found on a web page that contains the dynamic parameter. You must provide all of this information: Form Index. Type the HTML index of the form that contains the dynamic parameter. Parameter Index. Type the HTML index of the input parameter within the form that contains it.
   Search Within XML	Specifies, when checked (enabled), that the system searches for dynamic parameter values within the URL’s XML. Type the XPath specification in the XPath field.
   Search Response Body	Specifies, when checked (enabled), that the system searches for dynamic parameter values in the body of the response. Use the additional options to further refine the search. You can specify one or more of the following options, but you must specify the RegEx value if you enable this setting. Number of Occurrences. All specifies a search for all incidences of the parameter values in the body of the request. Number specifies that the search is restricted to the number you type in the box. Prefix specifies that the system extracts values only if they are preceded by the HTML segment you type in the box. Match Regular Expression Value specifies that the system extract must match the parameter pattern (regular expression) you type in the box. The default is .+?. Suffix specifies that the system extracts values only if they are followed by the HTML segment that you type in the box.

7. When you are finished, save your work.

1. Go to the Policies screen: Click Configuration > SECURITY > Web Application Security > Policies .
2. Continue to the parameter name screen: Click the name of the policy and then, on the left, click PARAMETERS > CHARACTER SETS > Parameter Name .
3. Review the list of characters, and for each, determine whether it should be allowed or not.
   • Select the Allowed check box for characters that should be allowed.
   • Clear the Allowed check box for characters that should not be allowed.
   Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.
   • Click Allowed to display only characters that are marked as allowed.
   • Click Disallowed to display only characters that are not allowed.
4. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy and then, on the left, click PARAMETERS > CHARACTER SETS > Parameter Value .
3. Review the list of characters, and for each, determine whether it should be allowed or not.
   • Select the Allowed check box for characters that should be allowed.
   • Clear the Allowed check box for characters that should not be allowed.
   Use the View options to select which characters are displayed.

   • Click All Characters to display all characters.
   • Click Allowed to display only characters that are marked as allowed.
   • Click Disallowed to display only characters that are not allowed.
4. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left click PARAMETERS > Sensitive Parameters .
3. Click Add to add a sensitive parameter.
   The Sensitive Parameter properties screen opens.
4. In the Name setting, type the name of the sensitive parameter.
5. Save your work.

1. Go to the Policies screen: Click Configuration > SECURITY > Web Application Security > Policies .
2. Continue to the Attack Signatures Configuration screen: Click the name of a policy, and on the left click Attack Signatures Configuration .
3. Revise the settings as needed.
   • To enable staging of signatures, select the Signature Staging Enabled check box.
   • To place updated signatures in staging, select the Place updated signatures in staging Enabled check box. New signatures are always placed in staging, regardless of this setting.
   • For Attack Signature Set Assignment, select one or more signature sets from the list to be assigned to the policy, and then select the appropriate options for that signature set.
     • Select or clear the Learn, Alarm, and Block options for each signature set.
       • Select Learn to have the security policy learn all requests that match enabled signatures in the signature set.
       • Select Alarm to have the security policy logs the request data if a request matches a signature in the signature set.
       • Select Block, to have the security policy block all requests that match a signature included in the signature set.
     • From the Actions list, select, if needed, whether to enable or enforce signatures in the signature set.
   • For Apply Response Signatures, select a file type, if needed. The default wildcard character indicates all file types.
4. When you are finished, save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of a policy, and on the left click Attack Signatures.
3. To restrict the number of signatures displayed, use the filter field at the upper right of the screen.
   You can select both basic and advanced filter options by clicking the arrow to the left of the field.
4. To specify whether or not the attack signature is enabled, select the check box in the Enabled column of the table for that row.
5. To have an attack signature placed in staging, select the check box in the In Staging column of the table for that row.
6. When you are finished, save your work.

1. Navigate to the Geolocation Enforcement screen: click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left, click Geolocation Enforcement.
3. Select a geolocation that is not allowed by the policy from the Disallowed Geolocations list.
   Once you have selected the geolocation, it is listed below the drop-down list.
4. You remove a selected geolocation from the list by clicking the X to the left of the geolocation name.
5. Click Save to save your changes.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy to manage, and on the left click SESSIONS AND LOGINS > Login Pages .
3. You can add new, or edit existing login page settings.
   • Click Add to add a login page and settings.
   • Click the name of the login page to edit the settings.
   The Login Page Properties screen opens.
4. In the Login URL setting, select the appropriate options for the URL.
   1. Specify whether the URL uses wildcards or is explicitly named. Select Wildcard or Explicit.
   2. Specify the URL protocol. Select HTTP or HTTPS.
   3. Select the URL to use, or select Custom URL and specify the URL.
5. In the Authentication Type setting, select the type of authentication to use.
6. In the Access Validation area, specify how the login page should be validated by typing one or more setting values.
   You define validation criteria on the response of the login URL. You must configure at least one of the validation criteria. If you configure more than one validation criteria, then all the criteria must be fulfilled in order to access the authenticated URL.
7. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left click SESSIONS AND LOGINS > Logout Pages .
3. Specify whether you are adding or editing logout page settings.
   • Click Add to add a logout page and settings.
   • Click the name of the logout page to edit the settings.
   The Logout Page Properties screen opens.
4. In the Logout URL (explicit only) setting, select the appropriate options for the URL.
   1. Specify the URL protocol. Select HTTP or HTTPS.
   2. Select the URL to use, or select Custom URL and specify the URL.
5. In the A string that should appear in the response setting, type a string that should appear in the request (either the query string or in its payload) to indicate that the request is a logout request.
6. In the A string that should NOT appear in the response setting, type a string that should not appear in the request (either the query string or in its payload) to indicate that the request is a logout request.
7. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the appropriate policy, and on the left click SESSIONS AND LOGINS > Login Enforcements .
3. For the Expiration Time setting, specify whether you want the login session to expire.
   • If you do not want the login session to expire, click Disabled.
   • If you want the login URL to be valid for a limited time, click the button to the left of the Seconds field, and type a value, in seconds (1-99999), that indicates how long the session will last. The login session ends after the number of seconds has passed.
4. For the Authenticated URLs setting, specify the target URLs that users can access only by using the login URL.
   1. In the provided field, type the target URL name in the format /private.php.
      Wildcards are allowed.
   2. Click Add to add the URL to the list of authenticated URLs.
   3. Repeat to add as many authenticated URLs as needed.
      You can remove a URL from the list of authenticated URLs by clicking X.
5. Save your work.

1. Click Configuration > SECURITY > Web Application Security > Policies .
2. Click the name of the policy to work on, and on the left click SESSIONS AND LOGINS > Session Tracking .
3. To enable session hijack detection, for the Detect Session Hijacking by Device ID Tracking setting, select the Enabled check box.
   Review the notes displayed.
4. To configure session tracking, supply values for the following settings.
   1. Select the Session Awareness Enabled check box.
   2. For the Application Username setting, select the form of the username.
      • To use no application username, select None.
      • To use APM usernames and session IDs, select Use APM Usernames and Session ID.
      • To use individual login pages, select Use Individual Login Pages and then select the login page in the area provided.
      • To use all login pages, select Use All Login Pages.
5. To configure violation detection actions, specify additional settings.
   1. For Track Violations and Perform Actions, select the Enabled check box.
   2. For Violation Detection Period, type the number of seconds for the detection period.
6. In the Block All area, specify how the system performs when the Block All action is triggered.
7. In the Log All Requests area, specify how the system performs when the Log All Requests action is triggered.
8. In the Delay Blocking area, specify how the system performs when the Delay Blocking action is triggered.
9. Save your work.