Web Application Firewall:Protected objects and protected object groups

Background information

Prerequisites

• A WAF 3.0 instance is purchased. For more information, see Purchase a subscription WAF 3.0 instance and Purchase a pay-as-you-go WAF 3.0 instance.

• Web services are added to WAF on the Website Configuration page. For more information, see Website configuration overview.

• If you want to manually add domain names that are used by CLB instances, ECS instances, or NLB instances, and the domain names are hosted on servers in Chinese Mainland, you must complete ICP filing .

  Note

  When you apply for an ICP filing in the Alibaba Cloud ICP Filing system, the system displays the operations that you must perform based on the website information that you specify.

Manually add protected objects

If you want to configure protection rules for domain names that meet the following conditions, perform the following steps to manually add the domain names as protected objects:

• The domain names are used by ALB instances, CLB instances, ECS instances, or NLB instances that are added to WAF in cloud native mode.

• The domain names are added to WAF in hybrid cloud - SDK integration mode.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Protected Objects.

3. On the Protected Objects tab, click Add Protected Object.

4. In the Add Protected Object dialog box, configure the following parameters based on the Protected Object Type and click OK.

   Cloud service

   If you want to add domain names that are used by ALB instances, CLB instances, ECS instances, or NLB instances as protected objects, set Protected Object Type to Cloud Service and configure the following parameters.

   Parameter	Description
   Domain Name	The domain name that you want WAF to protect. You can enter an exact-match domain name, such as www.aliyundoc.com, or a wildcard domain name, such as *.aliyundoc.com. Note A wildcard domain name cannot match the root domain name. For example, *.aliyundoc.com cannot match aliyundoc.com. A wildcard domain name cannot match domain names that include multiple levels of subdomains. For example, *.aliyundoc.com cannot match www.example.aliyundoc.com. A wildcard domain name can match all subdomains at the same level. For example, *.aliyundoc.com can match www.aliyundoc.com and example.aliyundoc.com. If you enter an exact-match domain name and a wildcard domain name, the protection rules of the exact-match domain name take precedence.
   Cloud Service	Select the cloud product type for the domain name server. Options: ALB: Application Load Balancer (ALB) CLB4: Layer 4 Classic Load Balancer (CLB) CLB7: Layer 7 Classic Load Balancer (CLB) ECS: Elastic Compute Service (ECS) NLB: Network Load Balancer (NLB)
   Instance	The ID of the cloud service instance. This parameter is required only when Cloud Service is set to ALB. Note If no ALB instances are added to WAF, add an ALB instance to WAF. For more information, see Enable WAF protection for an ALB instance.
   Add To Protected Object Group	The protected object group to which you want to add a protected object. You can add multiple protected objects to the protected object group and configure protection rules for the protected objects at the same time. After you add a protected object to a protected object group, you can configure protection rules for the protected object only by configuring protection rules for the protected object group. You cannot separately configure protection rules for the protected object. If you want to separately configure protection rules for the protected object, skip this parameter. Note If no protected object groups exist in the drop-down list, skip this parameter. After you create a protected object group, you can add the protected object to the protected object group. For more information about how to create a protected object group, see Create a protected object group.

   Hybrid cloud - SDK integration

   If you want to add domain names that are added to WAF 3.0 in hybrid cloud - SDK integration mode as protected objects, set Protected Object Type to SDK-based Traffic Mirroring and configure the following parameters.

   Parameter	Description
   Protected Object Name	The name of the protected object that you want to add.
   Domain Name/IP	The domain name that you want to add to WAF. You can enter an exact-match domain name, such as www.aliyundoc.com, or a wildcard domain name, such as *.aliyundoc.com. Note A wildcard domain name cannot match the root domain name. For example, *.aliyundoc.com cannot match aliyundoc.com. A wildcard domain name cannot match domain names that include multiple levels of subdomains. For example, *.aliyundoc.com cannot match www.example.aliyundoc.com. A wildcard domain name can match all subdomains at the same level. For example, *.aliyundoc.com can match www.aliyundoc.com and example.aliyundoc.com. If you enter an exact-match domain name and a wildcard domain name, the protection rules of the exact-match domain name take precedence.
   URL	The URL that you want WAF to protect.
   Add To Protected Object Group	The protected object group to which you want to add the protected object. You can add multiple protected objects to the protected object group and configure protection rules for the protected objects at the same time. After you add a protected object to a protected object group, you can configure protection rules for the protected object only by configuring protection rules for the protected object group. You cannot separately configure protection rules for the protected object. If you want to separately configure protection rules for the protected object, skip this parameter. Note If no protected object groups exist in the drop-down list, skip this parameter. After you create a protected object group, you can add a protected object to the protected object group. For more information about how to create a protected object group, see Create a protected object group.

   After you add a protected object to WAF, you can view and manage the protected object in the protected object list. For more information, see Manage protected objects.

Create a protected object group

You can create protected object groups, associate protected objects with protected object groups, and configure protection rules for multiple protected objects at the same time.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Protected Objects.

3. On the Protected Object Groups tab, click Create Object Group.

4. In the Create Protected Object Group dialog box, enter a Protected Object Group Name, select Associated Protected Objects, add Remarks, and then click OK.

   Note

   • The Objects To Be Selected list in the Associate Protected Objects section contains only protected objects that are not added to any protected object group and to which only the default mitigation capability or no template is applied.

   • If a protected object already exists in a protected object group, you must remove the protected object from the protected object group before you add the protected object to another protected object group. For more information, see Edit a protected object group.

   After you add a protected object group, you can manage the protected object group on the Protected Object Groups tab. For more information, see Manage protected object groups.

Manage protected objects

You can view and manage protected objects on the Protected Objects tab.

• To configure a protected object, click Settings in the Actions column of the protected object.

  Feature		Description
  WAF Link Settings	Configure Client IP Address	If a Layer 7 proxy is deployed in front of WAF, you can specify the method that you want WAF to use to obtain the IP addresses of clients. Layer 7 proxies include Anti-DDoS Pro, Anti-DDoS Premium, and Alibaba Cloud CDN. This way, WAF can obtain the actual IP addresses of clients, match requests with corresponding protection rules, such as IP address blacklist rules, and display information on security reports, such as source IP addresses. Click Settings in the Actions column of the protected object and configure Layer 7 Proxy (CDN, Anti-DDoS, Etc.) and Client IP Header. For more information, see Layer 7 proxy configuration. Note If you configured this parameter when you added a domain name to WAF in CNAME record mode or when you added a CLB or ECS instance to WAF, you do not need to configure the parameter again. For ALB instances, MSE instances, FC custom domain names, and domains connected in hybrid cloud SDK integration mode, you can apply this configuration as needed.
  	Cookie Settings	Tracking Cookie When you use HTTP flood protection or scan protection, if a request does not contain acw_tc in the cookie, WAF inserts acw_tc into the response to identify and count different client visits. WAF analyzes the cookie information carried by the client, combines the HTTP flood protection rules, scan protection rules with the session statistical object, custom frequency setting rules with the session statistical object, and statistical results to determine whether HTTP flood attacks exist in the service traffic. You can turn on or off Tracking Cookie using the Status switch. If you want the cookie to be delivered only to HTTPS requests, you can enable the Secure Attribute attribute of the cookie. Important We recommend that you turn on the Status switch for tracking cookies. Otherwise, the HTTP flood protection and scan protection features may not function as expected. Protected objects that are added to a protected object group have Tracking Cookie turned on by default. You cannot turn off Tracking Cookie or enable the Secure Attribute attribute. MSE instances and custom domain names in Function Compute do not support the Secure Attribute attribute. Effective rules: If a request matches multiple protected objects and any of the protected objects has Tracking Cookie or the Secure Attribute attribute enabled, all matched protected objects have the same feature enabled. Slider CAPTCHA Cookie After slider verification is passed, WAF delivers the slider cookie acw_sc__v3 by default to mark the verification action. If you want the cookie to be delivered only to HTTPS websites, you can enable the Secure Attribute attribute of the cookie. Important After you enable the Secure Attribute attribute, the slider feature for HTTP websites may not function as expected. Protected objects that are added to a protected object group have the Secure Attribute attribute turned off by default. You cannot enable the attribute. MSE instances and custom domain names in Function Compute do not support the Secure Attribute attribute.
  Account Extraction Settings		After you configure account extraction rules, you can reference the rules in scan protection, bot management, and custom rules. You can configure up to five rules for each protected object. The rules are sorted by priority. You can select one of the following positions for account extraction: Query String Body Cookie Header Account format: Plaintext Authentication: for example, email***@qq.com. JWT Authentication: typically in the Header, which can carry user information. The typical format is Authorization : Bearer {Token}. If the format is JWT, you need to specify the account field after decoding. Basic Authentication: typically in the Header. The typical format is Authorization : Basic {Token}.

• To view the protection rules of a protected object, click View Protection Rule in the Actions column of the protected object. On the Core Web Protection page, you can view the protection rules that are configured for the protected object.

  Note

  • You can also configure more protection rules for the protected object on the Protection Rules page. For more information, see Web core protection.

• Click in the Actions column for the target object.

  Feature	Description
  Add to Protected Object Group	To add multiple protected objects to the same object group, select the protected objects and click Add To Protected Group at the bottom of the list.
  View Logs	Enable log collection for the protected object and query related log data. For more information, see Enable or disable Simple Log Service.

• To delete a protected object, click Delete in the Actions column of the protected object.

  Note

  Only manually added domain name protected objects can be deleted.

  If you want to delete a CLB instance or an ECS instance, go to the Provisioning page, find the target instance or traffic redirection port, click Remove in the Actions column, cancel port redirection, and then delete the protected object.

• To add or remove tags for a protected object, hover over the icon in the Tag column of the target protected object and click Attach. In the Edit Tag dialog box, select or enter a Tag Key and enter a Tag Value.

  Note

  • You can attach up to 20 Tag Keys at a time. The Tag Value can be empty.

  • When you enter a Tag Key and a Tag Value, you can enter up to 128 characters. The key cannot start with aliyun or acs:, and cannot contain http:// or https://.

  • You can add or modify tags on the Protected Objects page or Website Configuration page. The latest tag settings are synchronized between the two pages.

  • You can also select multiple protected objects and then add tags to or remove tags from the protected objects at the same time.

Manage protected object groups

You can view and manage protected object groups on the Protected Object Groups tab.