How to create a WAF rule set

Create rule sets on Web Application Firewall (WAF).

View as Markdown

Web Application Firewall (WAF) allows you to create rule sets regarding possible threat types. You can set these rule sets on Rules Engine for Firewall to execute their behaviors.

This guide will create a rule set to block threats from the SQL Injection family to prevent attacks that attempt a select query, for example. After creating an firewall and activating the WAF module, follow the steps described next.

  1. Access Azion Console > WAF Rules.
  2. Click the + WAF Rule button.
  3. On the Name field, give your WAF rule set a unique and easy-to-remember name. In this case, SQL Injection rule set.
  4. On the Threat Type Configuration section, look for the SQL Injection option.
  5. Choose the Sensitivity option High for this threat so WAF doesn’t allow requests considered as an SQL Injection threat.
  6. Make sure the Active switch is enabled.
  7. Click the Save button.

Repeat this process with other types of threats to which you want to create a rule set.

Now, you need to apply the rule set you’ve created in Rules Engine. To do so:

  1. Still on Azion Console, go to Firewall.
  2. Select the firewall you want to apply the new rule.
  3. Select the Rules Engine tab.
  4. Click the + Rule button.
  5. Give your rule a name and, optionally, a description.
  6. In the Criteria section, select the Request Args variable.
  7. As a comparison operator, select matches.
  8. As an argument, add content-type=select.
  9. In the Behaviors section, select Set WAF Rule Set.
  10. As arguments:
    • On the first dropdown menu, select the rule set you want to use. In this case, SQL Injection rule set.
    • On the second dropdown menu, select the mode you want Firewall to operate on: Learning or Blocking. In this case, Blocking.
  11. Click the Save button.