Dell SMA 200, Руководство администратора

Страница: 308 / 514

Dell SonicWALL Secure Mobile Access 8.5
Administration Guide
308
Cloning a Rule
To clone a rule:
1 On the Web Application Firewall > Rules page, click the Edit Rule Chain icon under Configure for
the rule chain which contains the rule you want to clone. The page for that rule chain opens.
2 Click the Clone icon under Configure for the rule you want to clone.
3 Click OK in the confirmation dialog box.
You can now edit the rule to customize it. See Adding or Editing a Rule on page 308 .
Adding or Editing a Rule
To add or edit a rule in a rule chain:
1 Click the Edit Rule Chain icon under Configure for the rule chain on which you want to add or edit
a rule. The page for that rule chain opens.
2 Click Add Rule to add a new rule, or click the Edit icon under Configure for the rule you want to edit.
3 In the Add Rule page or the page for the edited rule, select a variable from the Variables drop-down list.
See About Variables on page 301 for information about the available variables.
4 If the chosen variable is a collection of variables, a selection field is displayed to the right of the
Variables field, after the colon. If you wish to make a comparison against a particular member of the
collection, type the name of that item into the selection field.
To test the collection itself against an input, leave the selection field blank. For example, to test
whether a certain parameter exists in the request, you could select the
Parameter Names variable and
then type the specific parameter name into the Value field (but not into the variable selection field).
5 Click Plus to add the variable to the rule. Repeat Step 2 through Step 5 to add more variables.
To delete a variable, select it in the large text box and click Minus .
6 Select a string or arithmetic operator from the Operators drop-down list. To complete the inverse
operation, select Not .
7 In the Value field, type in the value to be compared with the selected variable(s) in the scanned HTTP(S)
input. If you selected the Matches Keyword operator, you can compare the input against multiple
values by typing in each value separated by a space. Each value is compared individually.
8 Select one or more measures from the Anti-Evasive Measures list. Hold Ctrl on your keyboard while
clicking to select multiple measures.
9 Click Accept when finished.
Using Web Application Firewall Monitoring
The Web Application Firewall > Monitoring page provides two tabs: Local and Global . The pages for both tabs
display statistics and graphs for detected/prevented threats over time and top 10 threats. The Local tab also
displays Web server status statistics and graphs of the number of requests and the amount of traffic during the
selected monitoring period.
The monitoring functions of each tab are explained in the following sections:
• Monitoring on the Local Tab on page 309
• Monitoring on the Global Tab on page 313