Skip to content

Commit 99a86fb

Browse files
ADubhlaoichADubhlaoich
committed
feat: Add remaining pages
1 parent 6f43c18 commit 99a86fb

File tree

5 files changed

+384
-3
lines changed

5 files changed

+384
-3
lines changed

‎content/waf/policies/geolocation.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Geolocation"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 1150
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: true
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: reference
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---
14+
15+
Geolocation refers to the process of assessing or determining the geographic location of an object. This feature helps in identifying the geographic location of a client or web application user.
16+
17+
In F5 WAF for NGINX, the Enforcer will look up the client IP address in the Geolocation file included in the app protect package, and extract the corresponding [ISO 3166](https://www.iso.org/obp/ui/#search) two-letter code, representing the country. For instance, "IL" denotes Israel. This information is denoted as "geolocation" in the condition and is also included in the request reporting.
18+
19+
For applications protected by app protect, you can use Geolocation enforcement to restrict or allow application use in specific countries. You can adjust the lists of which countries or locations are allowed or disallowed in a app protect security policy. If the user tries to access the web application from a location that is not allowed, the `VIOL_GEOLOCATION` violation will be triggered. By default, all locations are allowed, and the alarm and block flags are enabled.
20+
21+
Requests from certain locations, such as RFC-1918 addresses or unassigned global addresses, do not include a valid country code. The geolocation is shown as **N/A** in both the request and the list of geolocations. You have the option to disallow N/A requests whose country of origination is unknown.
22+
23+
For example, in the policy provided below, within the "disallowed-geolocations" section, "countryCode": IL and "countryName": Israel have been included. This signifies that requests originating from these locations will raise an alarm, trigger the `VIOL_GEOLOCATION` violation and will be blocked.
24+
25+
26+
```shell
27+
"general": {
28+
"customXffHeaders": [],
29+
"trustXff": true
30+
},
31+
"disallowed-geolocations" : [
32+
{
33+
"countryCode" : "IL",
34+
"countryName" : "Israel"
35+
}
36+
],
37+
"blocking-settings": {
38+
"violations": [
39+
{
40+
"name": "VIOL_GEOLOCATION",
41+
"alarm": true,
42+
"block": true
43+
}
44+
]
45+
}
46+
47+
```
48+
49+
The below example represents a security policy for a web application. The policy named as "override_rule_example" is based on a template called "POLICY_TEMPLATE_NGINX_BASE." The policy is set to operate in "blocking" mode, which means it will prevent certain activities.
50+
51+
There's a specific configuration under "general" that deals with custom headers for cross-origin requests, specifically the "xff" header. The policy is configured to trust this header.
52+
53+
In the "override-rules" section there is one override rule named "myFirstRule." This rule is set up to trigger when the geolocation of a request is identified as 'IL' (Israel). When this condition is met, the action taken is to extend the policy, but with a change in enforcement mode to "transparent."
54+
55+
In simpler terms, when someone tries to access the web application from Israel ('IL'), the security policy will be adjusted to allow the access but in a more transparent manner, meaning it won't block the access but may monitor it differently.
56+
57+
```json
58+
{
59+
"policy": {T
60+
"name": "override_rule_example",
61+
"template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
62+
"enforcementMode": "blocking",
63+
"general": {
64+
"customXffHeaders": ["xff"],
65+
"trustXff": true
66+
},
67+
"override-rules": [
68+
{
69+
"name": "myFirstRule",
70+
"condition": "geolocation == 'IL'",
71+
"actionType": "extend-policy",
72+
"override": {
73+
"policy": {
74+
"enforcementMode": "transparent"
75+
}
76+
}
77+
}
78+
]
79+
}
80+
}
81+
```

‎content/waf/policies/graphql.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "GraphQL protection"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 1190
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: true
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: reference
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---

‎content/waf/policies/ip-address-lists.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: IP Address Lists
3-
weight: 1600
2+
title: IP address lists
3+
weight: 1500
44
toc: true
55
nd-content-type: reference
66
nd-product: NAP-WAF

‎content/waf/policies/ip-intelligence.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "IP intelligence"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 1500
5+
weight: 1600
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: true
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this

0 commit comments

Comments
 (0)