How do I merge several page types into one rule (Merge)?

Short answer

In the Page Types list, at least two rules to be merged are checked and Merge is clicked (if Any Paths is in the selection, the button is disabled). In the Merge WAF Rules window, the path of the merged rule is written in the Merge Path field (exact or glob); the preview below the field shows with Matches / Does not match which of the selected paths match the pattern. If needed, Force Merge and Keep Original Rules are checked and Accept is clicked: a copy of the first checked rule is extended with the settings of the other rules to create a new rule, and the selected rules are deleted (if Keep Original Rules is checked, they are not deleted). If there is a path that does not match the pattern and Force merge is unchecked, a confirmation is asked. The change is applied without a separate deployment step and cannot be undone; there is no merge command in WEB-CLI.

Problem: There Are Many Page Types for Similar Paths

Learning has produced a separate exact page type for every version or ID (/api/v1/login, /api/v2/login …); it is wanted that the rules carrying the same checks be gathered under a single glob and that the new paths matching the pattern also be covered automatically.

Solution

Merging is done only with the Merge window in the interface. Before the Merge, the rule set of the group is backed up with Export; the operation cannot be undone.

Merge Window

• How it works The selected rules are merged under a single path; the merged rule is a copy of the first checked rule and is extended with the settings of the other rules (How are settings (methods, OWASP) combined during a Merge?).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card of the host group → N page types → Merge
• Requirement At least two rules in the same host group (excluding Any paths); WAF protection enabled on the vService
• vService type HTTP vService with WAF protection enabled

Step-by-Step Configuration

1

Adım 1 Open the Page Types tab

In the Left Monitor Panel, the vService is clicked on the WAF-Protected vServices tab, the WAF Management tab is opened and the N page types row under the mode card of the relevant host group is clicked (accessing the screen).

2

Adım 2 Select the rules

The checkboxes of the rows to be merged are checked (at least two). If Any paths is in the selection or a single row is selected, Merge stays disabled. Since the merged rule takes the first checked rule as its basis, the rule whose settings are to be taken as the basis is checked first.

3

Adım 3 Open the Merge window

Merge on the toolbar is clicked; the Merge WAF Rules window opens and the preview box lists the selected paths with the Paths to merge (N): title (merging steps).

4

Adım 4 Write the merge path

The path of the merged rule is written in the Merge Path field (e.g. /api/v*/login). The preview title becomes Glob pattern matching - m/n matching (or Exact path matching for an exact path); the paths that match the pattern are marked with a green check mark and Matches, and the non-matching ones with an amber cross and Does not match. The pattern is corrected until all the paths match (How are glob patterns (*, **) written; how is the path test tool used?).

5

Adım 5 Set the options

If needed, Force Merge (merge despite the paths that do not match the pattern) and Keep Original Rules (do not delete the selected rules) are checked; both are unchecked by default (What do the Force Merge and Keep Original Rules options do?).

6

Adım 6 Save

Accept is clicked. If there is a path that does not match the pattern and Force merge is unchecked, the N path(s) do not match the merge pattern. Are you sure you want to continue? question appears: Yes continues the merge with Force merge, and No returns to the window. If the merge path is the same as the path of a rule other than the ones being merged, the operation is rejected with a Rule collision error and the window stays open. A successful merge is applied without a separate deployment step; in a cluster setup, it is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1ListTR7 side

The Page types list and the N page types number on the mode card are examined.

ExpectedA new merged rule; the selected rules deleted (if Keep original rules is unchecked)

2Detail panelTR7 side

The new rule is clicked and the tabs of the detail panel are examined.

ExpectedThe checks of the merged rules in a single rule

Common Mistakes

• Entering an exact value as the merge path. The merged rule covers only that path; the other original paths (if Keep Original Rules is unchecked) fall into a matching glob rule or into Any paths.
• Including non-matching paths with Force merge. Their settings are carried into the merged rule, but since their paths do not match the pattern, these paths no longer match the merged rule (What do the Force Merge and Keep Original Rules options do?).
• Not taking the list limits into account. If the merged allowed argument list exceeds the Max. Allowed Arguments limit, the list is emptied and the list restriction in that field is removed. If the merged OWASP Exclusions list exceeds the Max. OWASP Exclusions limit, the list is also emptied, and OWASP is turned off on that path, or OWASP check in the section or the argument; OWASP scanning that is off in one of the rules also stays off in the merged rule (How are settings (methods, OWASP) combined during a Merge?).
• Not exporting before merging. Merge cannot be undone; an Export is taken first.

How it is done in the documentation

• Merge · The Merging Steps
• Merge · Merge Path
• Merge · The Matching Preview
• Merge · The Runtime Effect

Related questions

• How are settings (methods, OWASP) combined during a Merge?
• What do the Force Merge and Keep Original Rules options do?
• Can I review and edit the analysis result before applying it (Analyze Page Types screen)?