Configure protection rules for the scan protection module - Web Application Firewall

After you add your web services to Web Application Firewall (WAF), you can configure protection rules for the scan protection module to identify scanning behavior and scanner characteristics and prevent attackers or scanners from scanning websites on a large scale. This helps reduce the risks of intrusions to web services and block invalid scanning traffic. This topic describes how to configure protection rules for the scan protection module.

Background information

The following types of protection rules can be created:

High-frequency Scanning Blocking: If a source triggers the protection rules of the basic protection rule module configured for the current protected object multiple times within a short period of time, the source is added to the blacklist. WAF blocks or monitors the requests from the source within a specific period of time.
Directory Traversal Blocking: If a source accesses a large number of non-existent directories of a protected object within a short period of time, the source is added to the blacklist. WAF blocks or monitors the requests from the source within a specific period of time.
Scanner Blocking: Common scanners are added to the blacklist. The scanners include sqlmap, Acunetix web vulnerability scanner (AWVS), Nessus, HCL AppScan, WebInspect, Netsparker, Nikto, and RSAS. WAF blocks or monitors the requests from the scanners.

Prerequisites

A WAF 3.0 instance is purchased. For more information, see Purchase a subscription WAF 3.0 instance and Purchase a pay-as-you-go WAF 3.0 instance.
Web services are added to WAF 3.0 as protected objects. For more information, see Configure protected objects and protected object groups.

Create a protection template of the scan protection module

A default protection template is provided. By default, the protection template is enabled. To enable custom protection rules, you must create a protection template and create protection rules for the template. Perform the following steps to create a protection template:

Note

The default protection template is available only for subscription WAF instances that run the Pro, Enterprise, or Ultimate edition.

Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.
In the left-side navigation pane, choose Protection Configuration > Basic Web Protection.
In the IP Address Blacklist section of the Basic Web Protection page, click Create Template.
Note
If this is your first time to create a protection template of the scan protection module, you can also click Configure Now in the IP Address Blacklist card in the upper part of the Basic Web Protection page.

In the Create Template - Scan Protection panel, configure the parameters and click OK. The following table describes the parameters.

Parameter	Description
Template Name	Specify a name for the template. The name of the template must be 1 to 255 characters in length and can contain letters, digits, periods (.), underscores (_), and hyphens (-).
Save as Default Template	Specify whether to set the template as the default template for the protection module. You can specify only one default template for a protection module. If you turn on Save as Default Template, you do not need to configure the Apply To parameter. The default template is applied to all protected objects and protected object groups to which no custom templates are applied.
Rule Configuration	Configure rule settings. A protection template of the scan protection module supports only one set of rules. A rule set consists of the following types of rules: High-frequency Scanning Blocking If you turn on High-frequency Scanning Blocking, the following configurations automatically take effect: If an IP address (Statistical and Blocked Object) triggers the protection rules of the basic protection rule module configured for the current protected object more than 20 times (Trigger Threshold) and triggers more than 2 (Maximum Number of Triggered Rules) protection rules in 60 seconds (Time Range), the IP address is added to the blacklist and remains in the blacklist for 1,800 seconds (Blocking Period). WAF blocks or monitors requests that are sent from the IP address. To modify the rule configurations, click Advanced Settings. Statistical and Blocked Object IP: collects the frequency at which attacks are initiated from the same client IP address. Session: collects the frequency at which attacks are initiated over the same client session. Note WAF uses the `setcookie()` function to insert cookies that start with `acw_tc` in responses. This way, sessions of different clients are easy to identify. Custom: collects the frequency at which attacks are initiated by objects that have the same request characteristics. To specify request characteristics, you can use one of the following methods: Custom Header: collects the frequency of attack requests that contain a specified header. Custom Parameter: collects the frequency of attack requests that contain a specified parameter. Custom Cookie: collects the frequency of attack requests that contain a specified cookie. Rule details You can change the values of the following parameters: Time Range, Trigger Threshold, Blocking Period, and Maximum Number of Triggered Rules. Directory Traversal Blocking If you turn on Directory Traversal Blocking, the following configurations automatically take effect: If an IP address (Statistical and Blocked Object) is used to request a protected object more than 50 times (Maximum Number of Requests) and access more than 50 (Maximum Number of Non-existent Directories) non-existent directories in 10 seconds (Time Range), and HTTP 404 status codes comprise of 70% (Maximum HTTP 404 Status Code Percentage) of the status codes that are returned in responses, the IP address is added to the blacklist. WAF blocks or monitors requests that are sent from the IP address. Note The statistics for directory scanning exclude static web file types such as .js and .png. To modify the rule configurations, click Advanced Settings. Statistical and Blocked Object IP: collects the frequency at which attacks are initiated from the same client IP address. Session: collects the frequency at which attacks are initiated over the same client session. Note WAF uses the `setcookie()` function to insert cookies that start with `acw_tc` in responses. This way, sessions of different clients are easy to identify. Custom: collects the frequency at which attacks are initiated by objects that have the same request characteristics. To specify request characteristics, you can use one of the following methods: Custom Header: collects the frequency of attack requests that contain a specified header. Custom Parameter: collects the frequency of attack requests that contain a specified parameter. Custom Cookie: collects the frequency of attack requests that contain a specified cookie. Rule details You can change the values of the following parameters: Time Range, Maximum Number of Requests, Maximum HTTP 404 Status Code Percentage, Blocking Period, and Maximum Number of Non-existent Directories. Scanner Blocking If you turn on Scanner Blocking, common scanners are added to the blacklist. The scanners include sqlmap, AWVS, Nessus, HCL AppScan, WebInspect, Netsparker, Nikto, and RSAS. WAF blocks or monitors requests from the scanners.
Action	Select the action that you want WAF to perform when a request matches the rule. Valid values: Block: blocks a request that matches the rule and returns a block page to the client that initiated the request. Note By default, WAF returns a preconfigured block page. You can use the custom response feature to configure a custom block page. For more information, see Configure protection rules for the custom response module to configure custom block pages. Monitor: records a request that matches the rule in logs without blocking the request. You can query logs about the requests that match the rule and analyze the protection performance. For example, you can check whether normal requests are blocked based on logs. Important You can query logs only when the Simple Log Service for WAF feature is enabled. For more information, see Enable or disable the Simple Log Service for WAF feature. If you select Monitor, you can perform a dry run on the rule to check whether the rule blocks normal requests. If the rule passes the dry run, you can set the Action parameter to Block. Note On the Security Reports page, you can view the details of matched rules in Monitor or Block mode. For more information, see Security reports.
Apply To	Select items to which you want to apply the template on the Protected Objects and Protected Object Group tabs. You can apply only one template of a protection module to a protected object or protected object group. For more information about how to add protected objects and create protected object groups, see Configure protected objects and protected object groups.

By default, a newly created protection template is enabled. You can perform the following operations on the protection template in the template list:

View the number of Protected Object/Group that are associated with the template.
Turn on or turn off the switch in the Status column to enable or disable the template.
Click Edit or Delete in the Actions column to modify or delete the template.
Click the icon to the left of the template name to view and manage the rules in the template.
- Find a rule and click Unblock IP Addresses to unblock the IP addresses that are blocked by the rule.
  Important
  - You can unblock only IP addresses that are blocked by the High-frequency Scanning Blocking or Directory Traversal Blocking protection rule.
  - You can unblock IP addresses only when the related rule and template are enabled.

What to do next

On the Scan Protection tab of the Security Reports page, you can view the protection details of the configured protection rules. For more information, see IP address blacklist, custom rule, scan protection, HTTP flood protection, and region blacklist modules.

References

For more information about the protection objects, protection modules, and protection process of WAF 3.0, see Protection configuration overview.
For more information about how to create a protection template by calling an API operation, see CreateDefenseTemplate.
For more information about how to create a protection rule by calling an API operation, see CreateDefenseRule.