From 605bc02a09b44a08364c5042481da717b39102d1 Mon Sep 17 00:00:00 2001
From: kudriavitsky <109550454+kudriavitsky@users.noreply.github.com>
Date: Mon, 23 Jun 2025 09:39:03 +0300
Subject: [PATCH 1/2] Update policy.html
update override-rules and ip-address-lists
---
content/includes/nap-waf/policy.html | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/content/includes/nap-waf/policy.html b/content/includes/nap-waf/policy.html
index b76ab5fb3..d4d0104cc 100644
--- a/content/includes/nap-waf/policy.html
+++ b/content/includes/nap-waf/policy.html
@@ -2856,13 +2856,13 @@ ip-address-lists
- Specifies how the system responds to blocking requests sent from this IP address list.
-- Policy Default: Specifies that the Policy Blocking Settings will be used for requests from this IP address list.
+- Policy Default: Specifies that thepolicy enforcementMode will be used for requests from this IP address list.
- Never Block: Specifies that the system does not block requests sent from this IP address list, even if your security policy is configured to block all traffic.
- Always Block: Specifies that the system blocks requests sent from this IP address list.
-Optional |
+Optional, if absent Policy Default is used.
- always
- never
@@ -2878,13 +2878,13 @@ ip-address-lists
| ipAddresses |
array of objects |
-Specifies the IP addresses. |
+Specifies the IP addresses. Use CIDR notation for subnet definition. |
|
matchOrder |
integer |
-Specifies the order index for IP Address List matching. If unspecified, the order is implicitly as the lists appear in the policy. IP Address Groups with a lower matchOrder will be checked for a match prior to items with higher matchOrder. |
+Specifies the order matching index between different IP Address Lists. If unspecified, the order is implicitly as the lists appear in the policy. IP Address Lists with a lower matchOrder will be checked for a match prior to items with higher matchOrder. |
|
@@ -2896,13 +2896,13 @@ ip-address-lists
neverLogRequests |
boolean |
-Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic. |
+Specifies when enabled that the system does not log requests or responses sent from this IP address list, even if the traffic is illegal, and even if your security policy is configured to log all traffic. Optional, if absent default value is false. |
|
setGeolocation |
string |
-Specifies a geolocation to be associated for this IP address list. Optional |
+Specifies a geolocation to be associated for this IP address list. This will force the IP addresses in the list to be considered as though they are in that geolocation. This applies to blocking via "disallowed-geolocations" and to logging. Optional |
|
@@ -2927,7 +2927,7 @@ ipAddresses
ipAddress |
string |
- |
+Specifies the IP address. Use CIDR notation for subnet definition. |
|
@@ -3694,7 +3694,7 @@ override-rules
Request Attributes:
-- clientIp: Client IP address in canonical IPv4 or IPv6 format. Use CIDR notation for subnet definition. Example: 192.168.1.2 or fd00:1::/48. If trustXff (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is matches.
+- clientIp: Client IP address in canonical IPv4 or IPv6 format or ip-address-list. Use CIDR notation for subnet definition. Example: 192.168.1.2 or fd00:1::/48. If trustXff (X-Forwarded-For) is enabled in the containing policy, then the value is taken from the configured header (XFF or other). The only supported boolean function for the clientIP attribute is matches.
- host: The value of the Host header
- method: The HTTP method in the request
- uri: The URI (path part) of the request
@@ -3705,7 +3705,7 @@ override-rules
- headers['<name>']: (map-type) The value of the specified header name. Example: "headers['Accept'].startsWith('application')"
-Note: The "headers['<name>']" attribute does not support 'Cookie' as a header name. |
+Note: The "headers['<name>']" attribute does not support 'Cookie' as a header name. Attribute "clientIp" supports using "ipAddressLists" in condition: "clientIp.matches(ipAddressLists[''])
|
From 611aef923a59c6cf37fff1af38c1332776350cbd Mon Sep 17 00:00:00 2001
From: kudriavitsky <109550454+kudriavitsky@users.noreply.github.com>
Date: Mon, 23 Jun 2025 09:56:07 +0300
Subject: [PATCH 2/2] Update policy.html
thepolicy -> the policy
---
content/includes/nap-waf/policy.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/includes/nap-waf/policy.html b/content/includes/nap-waf/policy.html
index d4d0104cc..0d84e0c67 100644
--- a/content/includes/nap-waf/policy.html
+++ b/content/includes/nap-waf/policy.html
@@ -2856,7 +2856,7 @@ ip-address-lists
- Specifies how the system responds to blocking requests sent from this IP address list.
-- Policy Default: Specifies that thepolicy enforcementMode will be used for requests from this IP address list.
+- Policy Default: Specifies that the policy enforcementMode will be used for requests from this IP address list.
- Never Block: Specifies that the system does not block requests sent from this IP address list, even if your security policy is configured to block all traffic.
- Always Block: Specifies that the system blocks requests sent from this IP address list.
|