Web Application Firewall & Reverse Proxy

 View Only
  • 1.  Policy Trace

    Posted Dec 14, 2017 06:36 AM

    Is there any other way on doing the policy trace.

     

    It would be nice to have a page put in some parameters like the destination IP address / URL then run it against the policy, tool would show you the policies that it hit. Is there such a tool somewhere?

     

    Honestly the policy trace tool is not efficient , going through the policy trace log is not that efficient as well.



  • 2.  RE: Policy Trace

    Posted Dec 17, 2017 11:04 PM

    Hi Philip,

     

                     Due to the complexity on how the rules are evaluated, there is no such option as you requested. For a simple firewall if would have made sense to have a page which gives option to mention some details (mainly Src/DST IP/Port) as seen in the request for it show the rule/s it will be matching. In proxy, there are lot of variables needed for a request to complete evaluation like user, group, client requesting IP address, ICAP responses (if configured), server responses, http header evaluations, SSL certificate emulation for SSL interception (if configured) ..etc. In short, the "Triggers" are more complex than a firewall. It is not possible for one to have all these ready and then use a test page to find the rule hit. Its much easier to rely on a live capture by using policy trace.

     

    If you have used the proper triggers in the policy trace, it is the best tool you can have to show the exact rules getting hit. This will also give information on the "why" the outcome. Sharing 2 articles which could help in reading policy trace

     

    How to use policy trace to debug access issues - https://support.symantec.com/en_US/article.TECH242198.html

    Understanding Policy Trace checkpoint timing - https://support.symantec.com/en_US/article.TECH244919.html