I have gone through the steps in the documentation for configuring WAF and the rule's traffic count increases accordingly when the web server is accessed.
However, I can't seem to be able to verify that it is actually being protected. Almost all protection and IPS settings are enabled and the filter strength is set to 4 (most restrictive). Yet when I make a directory traversal request (e.g. mysite.com/?q=../../etc/passwd) it doesn't get blocked.
How can I verify that the WAF is doing its job?
This thread was automatically locked due to age.
