The A10 Networks ADC, when used for load balancing web servers, must deploy the WAF in active mode.

From A10 Networks ADC ALG Security Technical Implementation Guide

Associated with: CCI-000366

SV-82511r1_rule The A10 Networks ADC, when used for load balancing web servers, must deploy the WAF in active mode.

Vulnerability discussion

The Web Application Firewall (WAF) supports three operational modes - Learning, Passive, and Active. Active is the standard operational mode and must be used in order to drop or sanitize traffic. Learning mode is used in lab environments to initially set thresholds for certain WAF checks and should not be used in production networks. Passive mode applies enabled WAF checks, but no action is taken upon matching traffic. This mode is useful in identifying false positives for filtering. Only Active mode filters web traffic.

Check content

Review the device configuration. The following command displays the configuration and filters the output on the WAF template section: show run | sec slb template waf If the output contains either "deploy-mode passive" or "deploy-mode learning", this is a finding. Note: Since deploy-mode active is the default value, it will not appear in the output.

Fix text

The following command sets the deployment mode of the WAF template: slb template waf [template name] deploy-mode active

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.