DPtech DPX8000 Series User manual

i
DPX8000 Series Deep Service Switching Gateway
User Configuration Guide
WAF Service Board Module v1.0

ii
Hangzhou DPtech Technologies Co., Ltd. provides full- range technical support.
If you need any help, please contact Hangzhou DPtech Technologies Co., Ltd. and its sale agent,
according to where you purchase their products.
Hangzhou DPtech Technologies Co., Ltd.
Address: 6th floor, zhongcai mansion, 68 tonghelu, Binjiangqu, Hangzhoushi
Address code: 310051

iii
Declaration
Copyright 2013
Hangzhou DPtech Technologies Co., Ltd.
All rights reserved.
No Part of the manual can be extracted or copied by any company or individuals without written
permission, and cannot be transmitted by any means.
Owing to product upgrading or other reasons, information in this manual is subject to change.
Hangzhou DPtech Technologies Co., Ltd. has the right to modify the content in this manual, as it is a
user guides, Hangzhou DPtech Technologies Co., Ltd. made every effort in the preparation of this
document to ensure accuracy of the contents, but all statements, information, and recommendations
in this document do not constitute the warranty of any kind express or implied.

iv
Table of Contents
CHAPTER 1 WEB APPLICATION FIREWALL 9
1.1 OBJECT GROUP CONFIGURATION 9
1.1.1 IPV4OBJECT GROUP CONFIGURATION 9
1.1.2 IPV6OBJECT GROUP CONFIGURATION 9
1.2 SECURITY POLICY 10
1.2.1 DEFAULT PROTECTION POLICY 10
1.2.2 REQUEST NORMALIZATION 11
1.2.3 COOKIE NORMALIZATION 12
1.2.4 REQUEST HEADER FIELD AND ENTITY NORMALIZATION 13
1.2.5 UPLOAD FILES CHECK 14
1.2.6 DOWNLOAD FILE CHECK 14
1.2.7 VULNERABILITY ATTACK PROTECTION 15
1.2.8 INFORMATION DISCLOSURE PROTECTION 16
1.2.9 WEB CRAWLER PROTECTION 16
1.2.10 WEB HOTLINKING PROTECTION 17
1.2.11 SENSITIVE WORD FILTERING 18
1.2.12 URL ACCESS CONTROL 19
1.2.13 USER-AGENT ACCESS CONTROL 20
1.2.14 PARAMETER TAMPERING PROTECTION 20
1.2.15 CSRF PROTECTION 21
1.2.16 HEADER ACCESS CONTROL 21
1.2.17 FILE SCAN PROTECTION 22
1.2.18 PASSWORD CRACK PROTECTION 23
1.2.19 CC ATTACK PROTECTION 23
1.2.20 WEAK PASSWORD PROTECTION 24
1.2.21 COOKIE HIDDEN 24
1.3 WEBSITE PASSIVE LEARN 25
1.4 DATABASE PROTECTION 25
1.5 ANTI-VIRUS PROTECTION 26
1.6 BLACKLIST COOPERATION 26
1.6.1 BLACKLIST COOPERATION 26
1.6.2 BLACKLIST CONFIGURATION 27
1.6.3 IPV6BLACKLIST CONFIGURATION 27
1.6.4 BLACKLIST QUERY 27
1.6.5 BLACKLIST LOG QUERY 27
1.7 WEBPAGE TAMPERING PROTECTION 28
1.7.1 WEBPAGE TAMPERING PROTECTION 28
1.7.2 SERVER INFORMATION CONFIGURATION 28
1.7.3 WEBPAGE TAMPERING LOG 28
1.8 SIGNATURE MANAGEMENT 29
1.8.1 DETAILED SIGNATURE 29
1.8.2 CUSTOMIZED SIGNATURE 30
1.8.3 SIGNATURE WHITELIST 31

v
1.9 AGENT FIELD CONFIGURATION 31
CHAPTER 2 PROTECTION LOG 32
1.10 SEVER SECURITY LOG 32
1.10.1 LATEST LOG 32
1.10.2 LOG QUERY AND DELETE 32
1.11 WEB AUDIT 32
1.11.1 WEB AUDIT CONFIGURATION 32
CHAPTER 3 HIGH AVAILABILITY 34
3.1 VRRP 34
3.1.1 INTRODUCTION TO VRRP GROUP 34
3.1.2 MONITORING 36
3.1.3 BFD OPTION 36
3.2 HOT STANDBY 37
3.2.1 HOT STANDBY 37
3.2.2 MANUAL SYNCHRONIZATION 37

vi
List of Figures
Figure 1-1 IPv4 object group configuration .............................................................................................................. 9
Figure 1-2 IPv6 object group configuration ............................................................................................................ 10
Figure 1-3 Default policy configuration.................................................................................................................. 10
Figure 1-4 Agent configuration............................................................................................................................... 10
Figure 1-5 Push configuration................................................................................................................................. 11
Figure 1-6 Request normalization ........................................................................................................................... 11
Figure 1-7 Request normalization configuration..................................................................................................... 12
Figure 1-8 Cookie normalization............................................................................................................................. 12
Figure 1-9 Cookie normalization configuration ...................................................................................................... 12
Figure 1-10 Request header field and entity normalization..................................................................................... 13
Figure 1-11 Request header field and entity normalization..................................................................................... 13
Figure 1-12 Upload files check................................................................................................................................ 14
Figure 1-13 Upload files check................................................................................................................................ 14
Figure 1-14 Download file check ............................................................................................................................ 14
Figure 1-15 Download file configuration................................................................................................................ 15
Figure 1-16 Vulnerability attack protection............................................................................................................. 15
Figure 1-17 Vulnerability attack protection............................................................................................................. 15
Figure 1-18 Information disclosure protection........................................................................................................ 16
Figure 1-19 Information disclosure protection........................................................................................................ 16
Figure 1-20 Web crawler protection........................................................................................................................ 16
Figure 1-21 Web crawler protection........................................................................................................................ 17
Figure 1-22 Web hotlinking protection ................................................................................................................... 17
Figure 1-23 Web hotlinking protection configuration............................................................................................. 18
Figure 1-24 Sensitive word filtering........................................................................................................................ 18
Figure 1-25 Sensitive word filtering........................................................................................................................ 19
Figure 1-26 URL access control.............................................................................................................................. 19
Figure 1-27 URL access control configuration........................................................................................................ 19
Figure 1-28 User-Agent access control ................................................................................................................... 20
Figure 1-29 User-Agent access control configuration............................................................................................. 20
Figure 1-30 Parameter tampering protection........................................................................................................... 20
Figure 1-31 Parameter tampering protection........................................................................................................... 21
Figure 1-32 CSRF protection................................................................................................................................... 21
Figure 1-33 CSRF protection configuration............................................................................................................ 21

vii
Figure 1-34 Header access control........................................................................................................................... 22
Figure 1-35 Header access control configuration.................................................................................................... 22
Figure 1-36 File scan protection.............................................................................................................................. 22
Figure 1-37 File scan protection configuration........................................................................................................ 23
Figure 1-38 Password crack protection ................................................................................................................... 23
Figure 1-39 Password crack protection ................................................................................................................... 23
Figure 1-40 CC attack protection ............................................................................................................................ 23
Figure 1-41 CC attack protection configuration...................................................................................................... 24
Figure 1-42 Weak password protection................................................................................................................... 24
Figure 1-43 Weak password protection configuration............................................................................................. 24
Figure 1-44 Cookie hidden...................................................................................................................................... 25
Figure 1-45 Cookie configuration ........................................................................................................................... 25
Figure 1-46 Website passive learn........................................................................................................................... 25
Figure 1-47 Database protection.............................................................................................................................. 26
Figure 1-48 Database protection configuration ....................................................................................................... 26
Figure 1-49 Anti-virus protection............................................................................................................................ 26
Figure 1-50 Blacklist cooperation ........................................................................................................................... 27
Figure 1-51 Blacklist configuration......................................................................................................................... 27
Figure 1-52 IPv6 blacklist configuration................................................................................................................. 27
Figure 1-53 Blacklist query..................................................................................................................................... 27
Figure 1-54 Blacklist log query............................................................................................................................... 28
Figure 1-55 Webpage tampering protection............................................................................................................ 28
Figure 1-56 Server information configuration......................................................................................................... 28
Figure 1-57 Webpage tampering log....................................................................................................................... 29
Figure 1-58 Detailed signature ................................................................................................................................ 30
Figure 1-59 Customized signature........................................................................................................................... 30
Figure 1-60 Signature whitelist ............................................................................................................................... 31
Figure 1-61 Agent field configuration..................................................................................................................... 31
Figure2-1 Latest log................................................................................................................................................. 32
Figure2-2 Log query and delete............................................................................................................................... 32
Figure2-3 Web audit configuration.......................................................................................................................... 33
Figure2-4 Web audit log.......................................................................................................................................... 33
Figure2-5 File update log......................................................................................................................................... 33
Figure3-1 High availability...................................................................................................................................... 34
Figure3-2 VRRP configuration................................................................................................................................ 34
Figure3-3 Monitoring .............................................................................................................................................. 36
Figure3-4 BFD option ............................................................................................................................................. 37
Figure3-5 Hot standby............................................................................................................................................. 37
Figure3-6 Manual synchronization.......................................................................................................................... 37

8
List of Tables
Table3-1 VRRP configuration items ....................................................................................................................... 35

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
9
Chapter 1 Web Application Firewall
Web application firewall has the following features:
Object group configuration
Security policy
Web passive learn
Database protection
Anti-virus policy
Blacklist cooperation
Web tempering protection
Signature management
Agent field configuration
1.1 Object group configuration
Object group configuration has the IPv4 object group configuration and IPv6 object group configuration.
1.1.1 IPv4 object group configuration
To enter the IPv4 object group configuration page, you choose WAF module> Service > Web application
firewall > Object group configuration > IPv4 object group configuration, as shown in Figure1-4.
Figure 1-1 IPv4 object group configuration
1.1.2 IPv6 object group configuration
To enter the IPv4 object group configuration page, you choose WAF module> Service > Web application
firewall > Object group configuration > IPv4 object group configuration, as shown in Figure1-4.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
10
Figure 1-2 IPv6 object group configuration
1.2 Security policy
1.2.1 Default protection policy
Default protection policy includes the policy configuration, agent configuration and push configuration
1.2.1.1 Policy configuration
To enter the policyconfiguration page, you choose WAF module> Service > Web application firewall > Security
policy > Default policy configuration > Policy configuration, as shown in Figure1-4.
Figure 1-3 Default policy configuration
1.2.1.2 Agent configuration
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Default policy configuration > Agent configuration, as shown in Figure1-4.
Figure 1-4 Agent configuration

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
11
1.2.1.3 Push configuration
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Default policy configuration > Push configuration, as shown in Figure 1-5.
Figure 1-5 Push configuration
1.2.2 Request normalization
Request normalization module can add or delete the request normalization configuration.
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Request normalization, as shown in Figure 1-6.
Figure 1-6 Request normalization
Click the name of normalization configuration to modify the normalization configuration, as shown in Figure
1-7.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
12
Figure 1-7 Request normalization configuration
1.2.3 Cookie normalization
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Cookie normalization, as shown in Figure 1-8.
Figure 1-8 Cookie normalization
Click the name of the normalization configuration then you configure the normalization configuration in the
right column, as shown in Figure 1-9.
Figure 1-9 Cookie normalization configuration

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
13
1.2.4 Request header field and entity normalization
To enter the agent configuration page, you choose WAF module> Service > Web application firewall > Security
policy > Request header field and entity normalization, as shown in Figure 1-10.
Figure 1-10 Request header field and entity normalization
Click the request header field and entity normalization to modify the configuration of the request header field and
entity normalization, as shown in Figure 1-11.
Figure 1-11 Request header field and entity normalization

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
14
1.2.5 Upload files check
To enter the upload files check page, you choose WAF module> Service > Web application firewall > Security
policy > Upload files check, as shown in Figure 1-12.
Figure 1-12 Upload files check
Click the name of the Upload files check to configure the upload files check configuration page, as shown in
Figure 1-13.
Figure 1-13 Upload files check
1.2.6 Download file check
To enter the upload files check page, you choose WAF module> Service > Web application firewall > Security
policy > Download files check, as shown in Figure 1-14.
Figure 1-14 Download file check
Click the name of the download file check to configure the download check file configuration page, as shown in
Figure 1-15.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
15
Figure 1-15 Download file configuration
1.2.7 Vulnerability attack protection
To enter the vulnerability attack protection page, you choose WAF module> Service > Web application
firewall > Security policy > Vulnerability attack protection, as shown in Figure 1-16.
Figure 1-16 Vulnerability attack protection
Click the name of the vulnerability attack protection to configure the vulnerability configuration page, as shown in
Figure 1-18.
Figure 1-17 Vulnerability attack protection

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
16
1.2.8 Information disclosure protection
To enter the vulnerability attack protection page, you choose WAF module> Service > Web application
firewall > Security policy > Information disclosure protection, as shown in Figure 1-18.
Figure 1-18 Information disclosure protection
Click the name of the information disclosure protection to configure the information disclosure protection page, as
shown in Figure 1-19.
Figure 1-19 Information disclosure protection
1.2.9 Web crawler protection
To enter the vulnerability attack protection page, you choose WAF module> Service > Web application
firewall > Security policy > Web crawler protection, as shown in Figure 1-20.
Figure 1-20 Web crawler protection
Click the web crawler protection name to configure the web crawler protection configuration page, as shown in
Figure 1-21.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
17
Figure 1-21 Web crawler protection
1.2.10 Web hotlinking protection
To enter the vulnerability attack protection page, you choose WAF module> Service > Web application
firewall > Security policy > Web hotlinking protection, as shown in Figure 1-22Figure 1-20.
Figure 1-22 Web hotlinking protection
Click the web hotlinking protection name to configure the web hotlinking protection configuration page, as shown
in Figure 1-23.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
18
Figure 1-23 Web hotlinking protection configuration
1.2.11 Sensitive word filtering
To enter the sensitive word filtering page, you choose WAF module> Service > Web application firewall >
Security policy > Sensitive word filtering, as shown in Figure 1-24.
Figure 1-24 Sensitive word filtering
Click the sensitive word filtering name to configure the sensitive word filtering page, as shown in Figure 1-25.

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
19
Figure 1-25 Sensitive word filtering
1.2.12 URL access control
To enter the URL access control page, you choose WAF module> Service > Web application firewall > Security
policy > URL access control, as shown in Figure 1-26.
Figure 1-26 URL access control
Click the Add the configuration button to create a newURLaccess control configuration, as shown in Figure 1-27.
Figure 1-27 URL access control configuration

DPX8000 Series Deep Service Switching Gateway
User Configuration Guide WAF Service Board Module v1.0
20
1.2.13 User-Agent access control
To enter the user-agent access control page, you choose WAF module> Service > Web application firewall >
Security policy > URL access control, as shown in Figure 1-28.
Figure 1-28 User-Agent access control
Click the Add the configuration button to create a new User-Agent access control configuration, as shown in
Figure 1-29.
Figure 1-29 User-Agent access control configuration
1.2.14 Parameter tampering protection
To enter the parameter tampering protection page, you choose WAF module> Service > Web application
firewall > Security policy > Parameter tampering protection, as shown in Figure 1-30.
Figure 1-30 Parameter tampering protection
Click the Add the configuration button to create a new parameter tampering protection configuration, as shown in
Figure 1-31.