OCI Web Application Firewall (WAF) - Steps for a Quick Implementation

Oracle Web Application Firewall (WAF) is a cloud-based, PCI-compliant, global security service that protects applications from malicious and unwanted internet traffic. Oracle Cloud Infrastructure WAF can protect any internet-facing endpoint, providing consistent rule enforcement across a customer's applications.

WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection, and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable bots to enter. Access rules can be limited based on geography or the signature of the request.

The global Security Operations Center (SOC) will continually monitor the internet threat landscape acting as an extension of your IT infrastructure.

Create WAF Policy - Creating a policy without rules enabled to route traffic through the WAF ensures that there are no regressions by having a reverse proxy in front of the application.

Update CNAME in DNS  - Update the CNAME to OCI DNS zone or on-prem DNS A record based on the provider.

Map OCI LB hostname to OCI WAF CNAME 

Upload certificate to WAF - Upload certificate to WAF

Open WAF policy and go to settings, general settings then select HTTPS support to attach the uploaded certificate.

Test Your Application - Open a chrome browser and Enter the FQDN of the website protected by WAF. Inspect HTTP Response Headers to see if traffic is flowing through WAF. Some HTTP Response Headers to look for are (X-Cdn: Served-By-Zenedge or Server: ZENEDGE)

Click the name of your WAF Policy, under Logs, click View. Logs for the WAF policy appear.

Protection Rules - WAF contains over 250 pre-defined protection rules. The rules match web traffic to rule conditions and determine the action to be taken when the conditions are met. Protection Rule Settings allow you to define the parameters for enforcement any time a protection rule is matched.

Access Control - Administrators can add and configure their own access controls based on geolocation data, whitelisted and blacklisted IP addresses, and HTTP URL and header characteristics.

Threat Intelligence - Oracle WAF takes feeds from a number of threat intelligence providers to ensure it has the latest, up-to-date information on suspicious IP addresses.

Bot Management - Leverages an advanced set of challenges including JavaScript verification, CAPTCHA, device fingerprinting, and human interaction algorithms to identify and block malicious bot traffic. 

Additional Security - Configure the servers to accept traffic from the WAF servers. Configure origin's ingress rules to only accept connections from the following CIDR ranges in NSG and attach to the VNIC.

CIDR Ranges

Abbreviations

1. Oracle Cloud Infrastructure (OCI)
2. Web Application Firewall (WAF)

Document Versioning

To learn more about OCI WAF or you need help with setting up your firewall contact us at info@beastute.com.