FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I define different blocking pages depending on conditions (Conditional Blocking Pages)? ​

Short answer

Yes. At most five entries are added to the Conditional Blocking Pages list in the Blocking Page window; each entry carries a Condition, a Page profile and a Status code. For a blocked request, the entries are tried in the order of the list and the page of the first matching entry is returned with the content type of that page profile; if none matches, the default page and the Blocking Status Code are used. An entry whose Status code field is left as Use default status code uses the general code. Only the HTTP conditions evaluated on the request side (Path, Host, Source IP, language preference, HTTP header …) can be selected as the condition. An entry whose Condition field is left empty counts as unconditional and matches every blocked request; if the Content Pages profile used in an entry is deleted, the entry returns the plain WAF BLOCKED text. The order of the entries is changed with drag and drop, and the setting is saved with Edit.

Problem: A Single Blocking Page Does Not Suit All Clients ​

On the same vService, different audiences (API clients, different languages, different brands, the internal network) need different content or a different status code when they are blocked.

Solution: Two Methods ​

The two methods write the same list; one of them is selected. For ready-made setups: language → Can I show a blocking page based on the visitor's language?, API → Can I return a JSON blocking response instead of HTML for API clients?

Your situationSuitable method
I will add the entries from the interfaceMethod 1: Conditional Blocking Pages
I will add them with a script or the command lineMethod 2: WEB-CLI
  • How it works The condition → page pairings are evaluated in order; the first match wins.
  • Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Blocking Page card → pencil icon
  • Requirement A Content Pages profile and an HTTP condition evaluated on the request side (if none exists, it is created first; adding on the Content Pages and Conditions screens requires modify permission in the Load Balancer area)
  • Limit At most five entries; across the vService, common in all the host groups

Step-by-Step Configuration ​

1
Adım 1 Create the page profile (if needed)

On the Load Balancer → Profiles → Content Pages screen, the page is prepared with Add and saved with Add (how to add; details: What is the Content Pages profile; how do I prepare my own HTML page?).

2
Adım 2 Create the condition (if needed)

On the Load Balancer → Conditions screen, the condition is defined with Add and saved with Add (how to add).

3
Adım 3 Open the Blocking page window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Blocking page card in the Inspection & Blocking section is clicked.

4
Adım 4 Add an entry

Under Conditional Blocking Pages, Add Conditional Page is clicked; a new entry titled CONDITIONAL PAGE #n opens. When there are five entries, the button becomes disabled.

5
Adım 5 Select the condition

In the Condition field (it shows Select conditions while empty), the condition is selected; the field is not left empty, an empty entry matches every blocked request. Multiple conditions can be combined with and / or (How do I combine multiple conditions with AND / OR?).

6
Adım 6 Select the page

In the Page Profile field, the page is selected; in a new entry, WAF Blocking Page (English) comes selected. The page is previewed with the info icon next to the selected profile.

7
Adım 7 Select the status code

In the Status Code field, Use Default Status Code is left or a code that can carry a body is selected.

8
Adım 8 Arrange the order (if needed)

While there are multiple entries, the order is changed by dragging the entry from the move icon on its left; the narrowest condition is moved to the top.

9
Adım 9 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification ​

1Blocking page cardTR7 side

On the Blocking page card on the WAF Management tab, the conditional rows are listed above the default sentence in the order of evaluation.

Expected<condition> → the <page> page is shown (<code>) · Conditions are tried in order — first match wins
2Blocked requestClient side

For each entry, a request that matches the condition of the entry and triggers a signature is sent to the host group in Blocking mode.

ExpectedThe page of the entry, the content type of the page profile and the code of the entry

Method 2: WEB-CLI ​

  • How it works The entries are written to the --blockingPageRules list with an index with WEB-CLI; the index is the order of evaluation.
  • Where it is opened WEB-CLI → lb condition list · lb page list · waf options show · waf options update
  • Requirement WEB-CLI access; a defined condition and page profile; view permission in the Load Balancer area for lb condition list (an account with only WAF permission does not see the condition table)
  • Limit At most five entries

Step-by-Step Configuration ​

1
Adım 1 Get the condition ID

The ID is in the id column of the list (it starts with lbConditions-):

text
lb condition list
2
Adım 2 Get the page ID
text
lb page list
3
Adım 3 Find the empty index

The existing entries appear under blockingPageRules with their indexes; for the new entry, the first empty index is used (0 if the list is empty). Writing to an occupied index replaces that entry.

text
waf options show poolId <vService>
4
Adım 4 Write the entry

In place of <condition-id> and <page-id>, the IDs from steps 1 and 2 are written; the 0 in the example is for an empty list, if the list has entries the first empty index found in step 3 is written in place of 0. If --blockingPageRules.0.statusCode is not written, the entry uses the general code. The command gives no output:

text
waf options update poolId <vService> --syncWithDefaultFwRules false --blockingPageRules.0.cond <condition-id> --blockingPageRules.0.pageProfile <page-id> --blockingPageRules.0.statusCode 403

Verification ​

1Setting recordTR7 side

The WAF settings of the vService are displayed.

Command: waf options show poolId <vService>

ExpectedThe condition, the page and 403 written under blockingPageRules
On the card, the view is as in Method 1.

Common Mistakes ​

  • Leaving the Condition field empty. An entry whose condition is not selected counts as unconditional; every blocked request that does not match the entries above it gets the page of this entry, and the entries below it and the default page are not used.
  • Putting a broad condition at the top. Since the first match wins, the pages of the narrower conditions below it are never shown.
  • Applying a ready-made template after conditional pages are defined. All four ready-made templates delete the existing entries; the bilingual template writes only its own Turkish entry in their place. The confirmation window shows the number of entries to be deleted with the …including the N conditional page(s) below. line; if the entries are to be kept, the default page fields are changed manually instead of using a template (What are the ready-made blocking page templates (Turkish, English, JSON)?).
  • Deleting the page profile used in an entry. The entry returns the plain WAF BLOCKED text; before the profile is deleted, it is removed from this list.
  • Looking for a response-side condition. Conditions evaluated on the response side, such as the status code, are not in the list; the blocking decision is made at the request stage.

How it is done in the documentation

Related questions