Dell PowerEdge 4200 Series, Руководство администратора

Страница: 263 / 440

Web Application Firewall Configuration | 263
The Disabled option allows you to temporarily deactivate a rule chain without deleting its
configuration.
Step 5
In the Description field, type a short description of what the rule chain will match or other
information.
Step 6
Select a category for this threat type from the Category drop-down list. This field is for
informational purposes, and does not change the way the rule chain is applied.
Step 7
Under Counter Settings , to enable tracking the rate at which the rule chain is being matched
and to configure rate limiting, select the Enable Hit Counters check box. Additional fields are
displayed.
Step 8
In the Max Allowed Hits field, enter the number of matches for this rule chain that must occur
before the selected action is triggered.
Step 9
In the Reset Hit Counter Period field, enter the number of seconds allowed to reach the Max
Allowed Hits number. If Max Allowed Hits is not reached within this time period, the selected
action is not triggered and the hits counter is reset to zero.
Step 10
Select the Track Per Remote Address check box to enforce rate limiting against rule chain
matches coming from the same IP address. Tracking per remote address uses the remote
address as seen by the SRA appliance. This covers the case where different clients sit behind
a firewall with NAT enabled, causing them to effectively send packets with the same source IP.
Step 11
Select the Track Per Session check box to enable rate limiting based on an attacker’s browser
session. This method sets a cookie for each browser session. Tracking by user session is not
as effective as tracking by remote IP if the attacker initiates a new user session for each attack.
Step 12
Click Accept to save the rule chain. A Rule Chain ID is automatically generated.
Step 13
Next, add one or more rules to the rule chain. See “Configuring Rules in a Rule Chain” on
page 265 for detailed information.
Cloning a Rule Chain
To clone a rule chain:
Step 1
On the Web Application Firewall > Rules page, click its Clone Rule Chain icon under
Configure .
Step 2
Click OK in the confirmation dialog box.
You can now edit the rule chain to customize it. See “Adding or Editing a Rule Chain” on
page 262 .
Deleting a Rule Chain
Note Deleting a rule chain also deletes all the associated rules.
To delete a rule chain:
Step 1
On the Web Application Firewall > Rules page, click the Delete Rule Chain icon under
Configure for the rule chain you want to delete.
Step 2
Click OK in the confirmation dialog box.
Step 3
Click Accept .