FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

What happens if I enter an incorrect format (invalid IP) for the Teacher identity? ​

Short answer

The form does not warn: the Teacher IP field is not validated for format, the invalid value is saved and the Learning Methods card still says "teaching sources are identified by IP". While the WAF configuration is generated, the field is split at spaces; only valid IPv4 addresses and IPv4 blocks in the a.b.c.d/nn format are used, the rest (a typo, an IPv6 address, a comma-separated list, an address with a port added) are dropped without a warning. As a result, the requests coming from that source do not count as Teacher requests: they can be blocked in Blocking mode, appear in Event Logs with a verdict such as "Attack blocked" or "Not blocked — Monitor mode" instead of the Teacher verdict and are not listed in Teacher Tracking. The same rule also applies to the Conditional Learning IP field. In the Teacher Cookie and Teacher Header fields there is no format problem, but the value in the request must be exactly the same, including upper/lower case.

Valid and Invalid Entries ​

Written to the Teacher IP fieldResult
198.51.100.5Valid
198.51.100.5 198.51.100.6Both addresses valid (separated by a space)
198.51.100.0/24Valid block
198.51.100.5,198.51.100.6Dropped (comma)
198.51.100.5:443Dropped (port)
2001:db8::5Dropped (IPv6) (Can I define an IPv6 address for Teacher?)
198.51.100.500Dropped (invalid address)
  • In a block, only the format (a.b.c.d/nn) is looked for; the block length must not be written greater than 32.
  • If valid and invalid values are together on one line, only the invalid ones are dropped; the valid addresses work.
  • Diagnosis: a test request that will reach the blocking threshold is sent from the Teacher source and the Event Logs verdict is examined (a clean request is not written to Event Logs; the test is done while the host group is not in Learning mode, because no Event Logs record is formed in a group in Learning mode); if the verdict is not "Not blocked — Teacher IP matched", the field is written again and saved with Edit. Other causes: Teacher traffic is not recognized; why?
  • The same situation for Conditional learning: Conditional Learning

Common Misconceptions ​

  • "If it was saved, it is valid." The form does not validate the format; an invalid value is ignored without a warning.
  • "If the card shows the identity, it is working." The card shows only that the field is filled in.
  • "Addresses are separated by commas." The separator is a space; a comma-separated list is dropped entirely.

How it is done in the documentation

Related questions