Bypass WAF for specific URL

Hi Gary, 

show us few more log lines from the reverseproxy.log. Alongside, how about configuring exception for "web request matching this path" and selecting both advance tab options. Does that help?

Thanks

Thanks for a quick response.

Whenever I attempt to connect to this URL, the following two lines are logged in the reverseproxy.log:

reverseproxy: [Tue Feb 21 16:41:28.897685 2017] [proxy_http:error] [pid 35268:tid 3903978352] (-102)Unknown error 4294967194: [client <External Client IP>:50126] AH01095: prefetch request body failed to <Server DMZ IP>:443 (<Server DMZ IP>) from <External Client IP> ()

reverseproxy: id="0299" srcip="<External Client IP>" localip="<UTM External IP>" size="384" user="-" host="<External Client IP>" method="SSTP_DUPLEX_POST" statuscode="413" reason="-" extra="-" exceptions="SkipAntiVirus, SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken, SkipCookieSigning, SkipThreatsFilter" time="123430" url="/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/" server="<public FQDN>" referer="-" cookie="-" set-cookie="-"

I've gone through a few variations of the exception (under Webserver Protection -> Web Application Firewall -> Exceptions), it's current configuration is:

Web clients coming from these source networks:  Any IPv4

Skip these checks:  All except for 'Block clients with bad reputation'

Skip these categories:  All

Advanced:  'Never change HTML during Static URL Hardening or Form Hardening' and 'Accept unhardened form data' both checked.

Hi Gary,

How about configuring DNAT for these applications which need to be exempted from WAF?

Thanks

Wouldn't that affect the other HTTPS sites published through the UTM as well?  Or, can I use a FQDN as the "Going to" condition?

I've confirmed that, I created a DNAT rule with a protocol of HTTPS, a source of Any IPv4, and a destination of the FQDN for this application with the firewall's external address as it's IP.  When in place, it causes other inbound HTTPS traffic through the firewall to fail.

Or, did I miss something in the configuration of the DNAT Rule?

Hi Gary,

Yes, DNAT will affect another HTTPs traffics and the going to condition will not work with the FQDN. An additional WAN IP address to host the application which is not hosted through WAF can do the job. Alongside, looking at the log line: 

reverseproxy: id="0299" srcip="<External Client IP>" localip="<UTM External IP>" size="384" user="-" host="<External Client IP>" method="SSTP_DUPLEX_POST" statuscode="413" reason="-" extra="-" exceptions="SkipAntiVirus, SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken, SkipCookieSigning, SkipThreatsFilter" time="123430" url="/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/" server="<public FQDN>" referer="-" cookie="-" set-cookie="-"

• reason: If the request was not intercepted by WAF, this field contains the value "-". Hence, the request is passed.
• statuscode=413: If the client sends an invalid Content-Length header, the clients receives a HTTP 413 answer with the content of a HTTP 413 answer (Request Entity Too Large). 

I don't think the UTM WAF proxy is blocking the requests but, can you show me the pictures of the configurations and the exception policy. Make sure all the tabs are extended in the screenshot.

Thanks

I'm not able to get screenshots at the moment, I'll have to add them later on.

That's interesting, I have tested by moving the same client machine onto the same DMZ Subnet as the server, which worked as expected.  By a process of elimination this suggests the UTM is what's blocking the traffic.  Is there another part of UTM which could be blocking the connection?  Is there anywhere I can configure the UTM to allow traffic with an invalid content-length header sent to this server?

Gary, have you tried creating a separate Virtual Server to have access to this FQDN pass through with no Filter in place?  If that works, then you can add protections until the access fails.

Cheers - Bob

Hi,

Many thanks for your feedback, I'm afraid I haven't been able to look at this for a few days.

There is a separate Virtual Server under Webserver protection -> Web Application Firewall -> Virtual Webservers, with the certificate attached for this FQDN.  Is that what you're referring to?  This Virtual Webserver is using a firewall profile in 'Monitor' mode, with all the options unchecked under 'Hardening & Signing' and 'Filtering'

Have I missed somewhere where I can configure the filtering to be bypassed?

Many thanks

Please see below screenshot.  Does this help at all?