Table of Contents
Advertisement
Cloning a Rule
To clone a rule:
1
On the Web Application Firewall > Rules page, click the Edit Rule Chain icon
the rule chain which contains the rule you want to clone. The page for that rule chain opens.
2
Click the Clone icon
3
Click OK in the confirmation dialog box.
You can now edit the rule to customize it. See
Adding or Editing a Rule
To add or edit a rule in a rule chain:
1
Click the Edit Rule Chain icon
a rule. The page for that rule chain opens.
2
Click Add Rule to add a new rule, or click the Edit icon under Configure for the rule you want to edit.
3
In the Add Rule page or the page for the edited rule, select a variable from the Variables drop-down list.
See
About Variables
4
If the chosen variable is a collection of variables, a selection field is displayed to the right of the
Variables field, after the colon. If you wish to make a comparison against a particular member of the
collection, type the name of that item into the selection field.
To test the collection itself against an input, leave the selection field blank. For example, to test
whether a certain parameter exists in the request, you could select the Parameter Names variable and
then type the specific parameter name into the Value field (but not into the variable selection field).
5
Click Plus
To delete a variable, select it in the large text box and click Minus
6
Select a string or arithmetic operator from the Operators drop-down list. To complete the inverse
operation, select Not.
7
In the Value field, type in the value to be compared with the selected variable(s) in the scanned HTTP(S)
input. If you selected the Matches Keyword operator, you can compare the input against multiple
values by typing in each value separated by a space. Each value is compared individually.
8
Select one or more measures from the Anti-Evasive Measures list. Hold Ctrl on your keyboard while
clicking to select multiple measures.
9
Click Accept when finished.
Using Web Application Firewall Monitoring
The Web Application Firewall > Monitoring page provides two tabs: Local and Global. The pages for both tabs
display statistics and graphs for detected/prevented threats over time and top 10 threats. The Local tab also
displays Web server status statistics and graphs of the number of requests and the amount of traffic during the
selected monitoring period.
The monitoring functions of each tab are explained in the following sections:
•
Monitoring on the Local Tab
•
Monitoring on the Global Tab
under Configure for the rule you want to clone.
Adding or Editing a Rule
under Configure for the rule chain on which you want to add or edit
on page
301
for information about the available variables.
to add the variable to the rule. Repeat
on page
309
on page
313
on page 308.
Step 2
through
Step 5
to add more variables.
.
Dell SonicWALL Secure Mobile Access 8.5
Administration Guide
under Configure for
308
Advertisement
Chapters
Table of Contents
Troubleshooting
