array手冊-v8.5新功能培訓(xùn)waf

ArrayNetworksWebApplicationFirewall2013-9-13ByLiuShengIntroductionRuleRuleSetPredefineandCustomRulesetProfileLog&ReportPerformanceConfigurationFlowchartSummaryWhatisWAF?WebApplicationlevelFirewallWhyWAF?Beabletodefendthreatfrom80(443)port.Industrystandard:PCIDSS.VirtualPatchingWhyAPVandWAF?LoadbalancerandWAFmarketismerging:Mostloadbalancermanufacturehasthisproduct/feature.BothneedtoinspectSSLcontent.Bothcanbedeployedattheentrypointofenterprise.IntroductionArrayWAFisdrivenbyrules.Ruleismadeofvariable,operatorandaction.Variable:REQUEST_URL,ARGS,REQUEST_COOKIE,etc.Operator:@rx,@pm,@eq,etc.Action:pass,deny,id,phase,etc.Givenaspecificrule,theWAFenginewillcheckHTTPcontentusingVariableandOperator,ifmatched,triggeraction.Example:SecRuleREQUEST_URI"@pmselect--""id:101,deny"“pass”and“deny”actionsaredisruptive,whichmeansthattheymayimpactwebtraffic.Denymeanslogthisthreat,thensendbackanerrorpage.PassmeanslogthisthreatonlyRuleIngeneral,theremaybe100+,or1000+rulesworktogethertomakeaeffectiveWAF.Forbetterorganization,rulearegroupedintoRuleset.Rulesetisafilecontainsrulesforsamekind.Rulewillbeexecutedintheorderofdefinition,nottheorderofid.Rulesetisexecutedintheorderofpriority.Thehigherprioritygetexecutedfirst.Ifpriorityisthesame,theorderisnotguaranteed.RulesetTheretwokindsofruleset:predefineandcustom.Thereisnoessentialdifference.PredefinerulesetisthoseprovidedbyArray.Currentlythereareonlytwopredefineruleset.OnefordefendingSQLInjection,theotherforCrossSiteScripting.Itonlyprovidesbasicprotection.APVprovideapredefinerulesetupgrademechanism,whichcanupdatethepredefinerulesetwithoutupdatingArrayOS.TheupdatepackageisdistributedbySE.TheupdatecanbeperformedthroughHTTP,FTPandWebUIBrowserUpload.CustomandPredefinerulesetCustomrulesetcontainsruleswrittenbyadministrator,orprovidedby3rdpartyservice.Therearesomefamous3rdpartycompanyprovidingWAFconsultantservice.WritingrulesrequireexpertknowledgeonHTTP,WebThreat,etc.Arrayprovideaguideforwritingcustomruleset.TherearethreewaystoimportcustomrulesetintoAPV:HTTP,FTP,andWebUIBrowserUpload.Inaprofile,Predefineandcustomrulesetareprioritizedinthesamequeue.CustomandPredefinerulesetWhatisprofile?Groupofrulesets.Whyprofile?1.DifferentvirtualservicemaysharesameWAFconfiguration.Inthiscase,profileleadstosimplerconfiguration.2.WAFisbigconsumerforresources.Before8.4.1,APVcansupport4000virtualservice.IfenableWAF,canonlysupportaround100virtualservice(Virtualizationisdonebyapachevirtualhost).Withprofile,APVcansupport4000virtualservice..ProfileTherelationbetweenprofileandvirtualserviceis1tomany.Oneprofilecanbesharedbydifferentvirtualservice.OnevirtualservicecanonlyhaveoneprofileProfileAdmincanconfiguredefaultactionofeachrulesetinprofile.Therelationbetweendefaultrulesetactionandruleactionisasfollows:“block”actionisaplaceholderfordefaultaction.Iftheruleactionis“block”,rulesetdefaultactionwilltakeeffect.Iftheruleactionisnot“block”,ruleactionwilltakeeffect.Mostrulesinpredefinerulesethavethe“block”action,inthisway,administratorcancontroltheeffectiveactionofwholeruleseteasily.Itismendthatcustomrulesetalsouse“block”actiontotakeadvantageofthemechanismillustratedbypredefineruleset.ProfileBesidessettingdefaultactionofeachrulesetsinaprofile,theadministratorcanalsosetthemodeofprofile.Therearetwomodeavailable:“passive”and“active”In“passive”mode,the“deny”actionloseitsoriginalfunctionality,andactsexactlylikea“pass”action.Inotherwords,thisisa“detection”modefortestingnewenvironments,newrules.In“active”mode,the“deny”actionwilldoitsjob.Inotherwords,thisisa“production”mode.ProfileModeArrayWAFsupportreverseproxymode.ArrayWAFsupporttransparentmode.ArrayWAFdoesnotsupporttrianglemode.ArrayWAFdoesnotsupportHTTPturbo.DeploymentmodeFastlog:Beabletooutputfastloglikeothermodules.AuditLog(Remote):Beabletooutputauditlogtoaremotelogserver,whichisa3rdpartylogserverdesignedforMod_security.The3rdpartylogprovidelogfiltering,logexport,etc.The3rdpartylogservercangeneratereport.ArrayWAFitselfdoesnotgeneratereport.TheremoteserverisJ2EEbasedwebserver,andopensource.Arraywillprovideinstallationguideforthisserver.Supportonly1server.AuditLog(Local):BeabletostoreauditlogatAPVharddisk.CannotbeenabledatthesametimewithRemotelog.Supportlogrotation,logexport.Log&ReportAPV8600,32GRAM,10Gbps,version7300rules,128Kbodybuffer,donotwritelogtodisk.WhendoWAFstresstest,itiseasytomeetwithsystemoverload.Performance(TobeupdatedafterQAtesting)CorerulesetResp-buff-sizeAudit-logL7UproxyThroughputL7UproxyRPS(INF-INF)WAFOff10Gbps600kOnOffOn1.8Gbps4KOnOffOff2Gbps10KOn4KOn1.8Gbps4KOn4KOff2Gbps10KOn128KOn850Mbps4KOn128KOff1Gbps10KOn512KOn500Mbps4KOn51