OCI-Networking-WAF-Public-IP-Enabled

Owned by naveen
Last updated: Aug 09, 2022
1 min read

Severity : Medium

Description: This control ensures that the OCI web application firewall is enable and configured for endpoints with public IP address. WAF protects applications from malicious and unwanted internet traffic. WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications.

Remediation Steps:

Perform following to create auto scaling configuration :

  1. Login to the OCI console at Cloud Sign In.

  2. In navigation menu click  Identity & Security and then click Web Application firewall.

  3. Under Web Application firewall, click Policies.

  4. Click Create WAF Policy.

  5. Enter basic information like name and WAF Policy compartments.

  6. In Actions, configure check, allow and Return HTTP Response type.

  7. Click Show Tags and configure tags for policy.

  8. In Access control list, Click Enable Access control and add Request control Access rules. Define the Default Action for request doesn’t match the access rule.

  9. Configure rate limiting by checking Enable to configure rate limiting rules. Add rate limiting rules.

  10. Configure Protections to log or block requests. Check Enable to configure protection rules and Add Request Protection rules.

  11. To enforce the WAF security on application endpoint or load balancer Select the Enforcement Point in the region.

  12. Click Review and Create and then select Create WAF Policy.

  13. If access to the application is requires to be limited to certain IPAddresses or VNC add the WAF Network Address list. To create a network access list

    1. In Web application Firewall , Click  Network Address List and the click Create Network Access List.

    2. Configure Name, compartment. Select Address Type to add to the list.

    3. For Addresses, Type in the individual IP address for the list.

    4. For Click VNC Addresses , enter compartments and VNC addresses.

    5. Click Create.

Important:

  •  Enabling logging in WAF may incur additional cost.

Reference:

Blue Hexagon Proprietary