DPtech DPX8000 Series User manual

i
DPX8000 Series Deep Service Switching Gateway
User Configuration Guide
WAF Service Board Module v1.0

ii
Hangzhou DPtech Technologies Co., Ltd. provides full- range technical support.
If you need any help, please contact Hangzhou DPtech Technologies Co., Ltd. and its sale agent,
according to where you purchase their products.
Hangzhou DPtech Technologies Co., Ltd.
Address: 6th floor, zhongcai mansion, 68 tonghelu, Binjiangqu, Hangzhoushi
Address code: 310051

iii
Declaration
Copyright 2013
Hangzhou DPtech Technologies Co., Ltd.
All rights reserved.
No Part of the manual can be extracted or copied by any company or individuals without written
permission, and cannot be transmitted by any means.
Owing to product upgrading or other reasons, information in this manual is subject to change.
Hangzhou DPtech Technologies Co., Ltd. has the right to modify the content in this manual, as it is a
user guides, Hangzhou DPtech Technologies Co., Ltd. made every effort in the preparation of this
document to ensure accuracy of the contents, but all statements, information, and recommendations
in this document do not constitute the warranty of any kind express or implied.

iv
Table of Contents
CHAPTER 1 WEB APPLICATION FIREWALL 9
1.1 OBJECT GROUP CONFIGURATION 9
1.1.1 IPV4OBJECT GROUP CONFIGURATION 9
1.1.2 IPV6OBJECT GROUP CONFIGURATION 9
1.2 SECURITY POLICY 10
1.2.1 DEFAULT PROTECTION POLICY 10
1.2.2 REQUEST NORMALIZATION 11
1.2.3 COOKIE NORMALIZATION 12
1.2.4 REQUEST HEADER FIELD AND ENTITY NORMALIZATION 13
1.2.5 UPLOAD FILES CHECK 14
1.2.6 DOWNLOAD FILE CHECK 14
1.2.7 VULNERABILITY ATTACK PROTECTION 15
1.2.8 INFORMATION DISCLOSURE PROTECTION 16
1.2.9 WEB CRAWLER PROTECTION 16
1.2.10 WEB HOTLINKING PROTECTION 17
1.2.11 SENSITIVE WORD FILTERING 18
1.2.12 URL ACCESS CONTROL 19
1.2.13 USER-AGENT ACCESS CONTROL 20
1.2.14 PARAMETER TAMPERING PROTECTION 20
1.2.15 CSRF PROTECTION 21
1.2.16 HEADER ACCESS CONTROL 21
1.2.17 FILE SCAN PROTECTION 22
1.2.18 PASSWORD CRACK PROTECTION 23
1.2.19 CC ATTACK PROTECTION 23
1.2.20 WEAK PASSWORD PROTECTION 24
1.2.21 COOKIE HIDDEN 24
1.3 WEBSITE PASSIVE LEARN 25
1.4 DATABASE PROTECTION 25
1.5 ANTI-VIRUS PROTECTION 26
1.6 BLACKLIST COOPERATION 26
1.6.1 BLACKLIST COOPERATION 26
1.6.2 BLACKLIST CONFIGURATION 27
1.6.3 IPV6BLACKLIST CONFIGURATION 27
1.6.4 BLACKLIST QUERY 27
1.6.5 BLACKLIST LOG QUERY 27
1.7 WEBPAGE TAMPERING PROTECTION 28
1.7.1 WEBPAGE TAMPERING PROTECTION 28
1.7.2 SERVER INFORMATION CONFIGURATION 28
1.7.3 WEBPAGE TAMPERING LOG 28
1.8 SIGNATURE MANAGEMENT 29
1.8.1 DETAILED SIGNATURE 29
1.8.2 CUSTOMIZED SIGNATURE 30
1.8.3 SIGNATURE WHITELIST 31

v
1.9 AGENT FIELD CONFIGURATION 31
CHAPTER 2 PROTECTION LOG 32
1.10 SEVER SECURITY LOG 32
1.10.1 LATEST LOG 32
1.10.2 LOG QUERY AND DELETE 32
1.11 WEB AUDIT 32
1.11.1 WEB AUDIT CONFIGURATION 32
CHAPTER 3 HIGH AVAILABILITY 34
3.1 VRRP 34
3.1.1 INTRODUCTION TO VRRP GROUP 34
3.1.2 MONITORING 36
3.1.3 BFD OPTION 36
3.2 HOT STANDBY 37
3.2.1 HOT STANDBY 37
3.2.2 MANUAL SYNCHRONIZATION 37

vi
List of Figures
Figure 1-1 IPv4 object group configuration .............................................................................................................. 9
Figure 1-2 IPv6 object group configuration ............................................................................................................ 10
Figure 1-3 Default policy configuration.................................................................................................................. 10
Figure 1-4 Agent configuration............................................................................................................................... 10
Figure 1-5 Push configuration................................................................................................................................. 11
Figure 1-6 Request normalization ........................................................................................................................... 11
Figure 1-7 Request normalization configuration..................................................................................................... 12
Figure 1-8 Cookie normalization............................................................................................................................. 12
Figure 1-9 Cookie normalization configuration ...................................................................................................... 12
Figure 1-10 Request header field and entity normalization..................................................................................... 13
Figure 1-11 Request header field and entity normalization..................................................................................... 13
Figure 1-12 Upload files check................................................................................................................................ 14
Figure 1-13 Upload files check................................................................................................................................ 14
Figure 1-14 Download file check ............................................................................................................................ 14
Figure 1-15 Download file configuration................................................................................................................ 15
Figure 1-16 Vulnerability attack protection............................................................................................................. 15
Figure 1-17 Vulnerability attack protection............................................................................................................. 15
Figure 1-18 Information disclosure protection........................................................................................................ 16
Figure 1-19 Information disclosure protection........................................................................................................ 16
Figure 1-20 Web crawler protection........................................................................................................................ 16
Figure 1-21 Web crawler protection........................................................................................................................ 17
Figure 1-22 Web hotlinking protection ................................................................................................................... 17
Figure 1-23 Web hotlinking protection configuration............................................................................................. 18
Figure 1-24 Sensitive word filtering........................................................................................................................ 18
Figure 1-25 Sensitive word filtering........................................................................................................................ 19
Figure 1-26 URL access control.............................................................................................................................. 19
Figure 1-27 URL access control configuration........................................................................................................ 19
Figure 1-28 User-Agent access control ................................................................................................................... 20
Figure 1-29 User-Agent access control configuration............................................................................................. 20
Figure 1-30 Parameter tampering protection........................................................................................................... 20
Figure 1-31 Parameter tampering protection........................................................................................................... 21
Figure 1-32 CSRF protection................................................................................................................................... 21
Figure 1-33 CSRF protection configuration............................................................................................................ 21

vii
Figure 1-34 Header access control........................................................................................................................... 22
Figure 1-35 Header access control configuration.................................................................................................... 22
Figure 1-36 File scan protection.............................................................................................................................. 22
Figure 1-37 File scan protection configuration........................................................................................................ 23
Figure 1-38 Password crack protection ................................................................................................................... 23
Figure 1-39 Password crack protection ................................................................................................................... 23
Figure 1-40 CC attack protection ............................................................................................................................ 23
Figure 1-41 CC attack protection configuration...................................................................................................... 24
Figure 1-42 Weak password protection................................................................................................................... 24
Figure 1-43 Weak password protection configuration............................................................................................. 24
Figure 1-44 Cookie hidden...................................................................................................................................... 25
Figure 1-45 Cookie configuration ........................................................................................................................... 25
Figure 1-46 Website passive learn........................................................................................................................... 25
Figure 1-47 Database protection.............................................................................................................................. 26
Figure 1-48 Database protection configuration ....................................................................................................... 26
Figure 1-49 Anti-virus protection............................................................................................................................ 26
Figure 1-50 Blacklist cooperation ........................................................................................................................... 27
Figure 1-51 Blacklist configuration......................................................................................................................... 27
Figure 1-52 IPv6 blacklist configuration................................................................................................................. 27
Figure 1-53 Blacklist query..................................................................................................................................... 27
Figure 1-54 Blacklist log query............................................................................................................................... 28
Figure 1-55 Webpage tampering protection............................................................................................................ 28
Figure 1-56 Server information configuration......................................................................................................... 28
Figure 1-57 Webpage tampering log....................................................................................................................... 29
Figure 1-58 Detailed signature ................................................................................................................................ 30
Figure 1-59 Customized signature........................................................................................................................... 30
Figure 1-60 Signature whitelist ............................................................................................................................... 31
Figure 1-61 Agent field configuration..................................................................................................................... 31
Figure2-1 Latest log................................................................................................................................................. 32
Figure2-2 Log query and delete............................................................................................................................... 32
Figure2-3 Web audit configuration.......................................................................................................................... 33
Figure2-4 Web audit log.......................................................................................................................................... 33
Figure2-5 File update log......................................................................................................................................... 33
Figure3-1 High availability...................................................................................................................................... 34
Figure3-2 VRRP configuration................................................................................................................................ 34
Figure3-3 Monitoring .............................................................................................................................................. 36
Figure3-4 BFD option ............................................................................................................................................. 37
Figure3-5 Hot standby............................................................................................................................................. 37
Figure3-6 Manual synchronization.......................................................................................................................... 37

8
List of Tables
Table3-1 VRRP configuration items ....................................................................................................................... 35

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
9
Chapter 1 Web Application Firewall
Web application firewall has the following features:
Object group configuration
Security policy
Web passive learn
Database protection
Anti-virus policy
Blacklist cooperation
Web tempering protection
Signature management
Agent field configuration
1.1 Object group configuration
Object group configuration has the IPv4 object group configuration and IPv6 object group configuration.
1.1.1 IPv4 object group configuration
To enter the IPv4 object group configuration page, you choose WAF module> Service > Web application
firewall > Object group configuration > IPv4 object group configuration, as shown in Figure1-4.
Figure 1-1 IPv4 object group configuration
1.1.2 IPv6 object group configuration
To enter the IPv4 object group configuration page, you choose WAF module> Service > Web application
firewall > Object group configuration > IPv4 object group configuration, as shown in Figure1-4.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
10
Figure 1-2 IPv6 object group configuration
1.2 Security policy
1.2.1 Default protection policy
Default protection policy includes the policy configuration, agent configuration and push configuration
1.2.1.1 Policy configuration
To enter the policyconfiguration page, you choose WAF module> Service > Web application firewall > Security
policy > Default policy configuration > Policy configuration, as shown in Figure1-4.
Figure 1-3 Default policy configuration
1.2.1.2 Agent configuration
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Default policy configuration > Agent configuration, as shown in Figure1-4.
Figure 1-4 Agent configuration