Web Application Firewall:Configure scan protection

Prerequisites

• A Web Application Firewall instance has been activated, and the instance edition is Pro or higher.

  Important

  Instances of the Pro edition support only the default scan protection policy and do not support custom scan protection policies. To create custom protection policies for High-frequency Web Attack Blocking and Directory Traversal Prevention, your instance must be of Enterprise or higher.

• Your website has been added to WAF. For more information, see Tutorials.

Background information

The scan protection feature includes the following protection policies:

• High-frequency Web Attack Blocking: Automatically blocks client IPs that launch multiple web attacks within a short period. You can customize protection rules and manually unblock IPs.

• Directory Traversal Prevention: Automatically blocks client IPs that launch multiple directory traversal attacks within a short period. You can customize protection rules and manually unblock IPs.

• Scanner Blocking: Automatically blocks access requests from IPs associated with scanners. Supported scanners include Sqlmap, AWVS, Nessus, Appscan, Webinspect, Netsparker, Nikto, and Rsas.

• Collaborative Protection: Automatically blocks access requests from IPs in Alibaba Cloud's global malicious IP database.

Procedure

1. Log on to the Web Application Firewall console.

2. In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).

3. In the left navigation pane, choose Protection Config > Website Protection.

4. On the Website Protection page, switch to the domain name to configure.

5. Click the Access Control/Throttling tab and locate the Scan Protection section. This section provides switches for four features: Blocking IPs Initiating High-frequency Web Attacks, Directory Traversal Prevention, Scanning Tool Blocking, and Collaborative Defense. For Blocking IPs Initiating High-frequency Web Attacks and Directory Traversal Prevention, you can click Settings to customize rules and Unblock IP Address to remove IP blocks. To complete the scan protection configuration, enable the features you require.

   Note

   After you enable any scan protection feature, scan protection inspects all requests to your website by default. You can configure a whitelist for Access Control/Throttling to allow eligible requests to bypass scan protection. For more information, see Configure a whitelist for Access Control/Throttling.

   • High-frequency Web Attack Blocking: Enable or disable this feature.

     To configure the protection policy:

     1. Turn on the switch for Blocking IPs Initiating High-frequency Web Attacks.

     2. Click Configure Now.

     3. In the Rule Settings dialog box, configure the following parameters: Time Range (seconds), Minimum Attacks (times), and Blocking Duration (seconds). In the Rule Setting dialog box, the default values are 60 seconds for Inspection Time Range, 20 times for The number of attacks exceeds, and 1800 seconds for Blocked IP Addresses.

        Rule description: If the number of web attacks from a client IP address within the specified Time Range exceeds the value set for Minimum Attacks, access requests from the IP address are blocked for the duration set for Blocking Duration.

        Note

        We recommend using the Mode setting. You can select a preset mode (Loose, Strict, or Normal) and then adjust the parameters based on your business requirements.

     4. Click OK.

     To unblock currently blocked IPs, click Unblock IP Address.

   • Directory Traversal Prevention: Enable or disable this feature.

     To configure the protection policy:

     1. Turn on the switch for Directory Traversal Prevention.

     2. Click Configure Now.

     3. In the Rule Settings dialog box, configure the following parameters: Time Range (in seconds), Minimum Requests (count), Minimum Percentage of 404 Status Code (%), Blocking Duration (in seconds), and Directories. In the Rule Setting dialog box, the default values are: Inspection Time Range 10 seconds, The total requests exceed 50, And the percentage of responses with 404 exceeds 70%, Blocked IP Addresses 1800 seconds, and Directory number 20.

        This rule means that if a client IP, within the specified Time Range, initiates requests where Minimum Requests a specified number, Minimum Percentage of 404 Status Code a specified percentage, and where the Directories of accessed directories exceeds a specified value within the specified Time Range, then access requests from that IP are blocked for the duration specified by Blocking Duration.

        Note

        We recommend using the Mode setting. You can select a preset mode (Loose, Strict, or Normal) and then adjust the parameters based on your business requirements.

     4. Click OK.

     To unblock currently blocked IPs, click Unblock IP Address.

   • Scanner Blocking: Enable or disable this feature.

     When enabled, this feature intelligently identifies requests from scanners. If a request matches a known scanning signature, WAF blocks the request. When disabled, WAF no longer intercepts such requests.

   • Collaborative Protection: Enable or disable this feature.

     When enabled, this feature automatically blocks requests from IP addresses in Alibaba Cloud's global malicious IP database.