Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I reset the rules to the default settings?
Short answer
There are three ways, and none of them can be undone; Export is taken first. waf host-groups reset-rules in WEB-CLI deletes, in the selected host groups, only Any Paths with scope defaultRule, or all the rules of the group with scope all, and sets up the default set (Any paths and the default header rules) again; the template is selected according to the OWASP Protection Level setting of the vService (a narrower template with Aggressive) (reset-rules). In the interface, Sync with Default WAF Rules in the edit window of the OWASP Protection Level card sets up Any paths again with the template suitable for the level in all the host groups of the vService, and does not touch the other rules. On the Page Types screen, deleting Any paths returns Any paths to the standard template in that group; selecting and deleting all the rows also removes the other rules permanently. Signature changes and the WAF settings of the vService are not affected by these operations.
Problem: The Rule Set Is to Be Reset to the Beginning
As a result of learning or manual edits, the rule set has come to an unwanted state; all the rules of the host group, or only Any paths, need to be returned to their default values. The default template is of two types:
| Template | When | Any paths path settings |
|---|---|---|
| Standard | OWASP Protection Level other than Aggressive; Delete in Page types always | Allowed methods GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE · Path length 1–8192 · Path depth at most 256 · OWASP on |
| Strict | While OWASP Protection Level is Aggressive (reset-rules and Sync with Default WAF Rules) | Allowed methods GET, OPTIONS, HEAD · Path length 1–1024 · Path depth at most 8 · OWASP on. In Check fields, Block All JSON Contents, Block All XML Contents, Block All Form Contents and Block Unparsed Contents are on; the Allowed Upload Mime Types and Allowed Raw Body Mime Types lists are empty, that is, uploaded files and raw bodies also produce violations. The limits are narrower (e.g. Raw Body Size 1–16384 bytes, Total Query Size at most 8192 bytes); the query, form, JSON and XML allowed lists start empty, and if Argument Checks is on, every argument in these sections counts as a violation and the Host and User-Agent headers are required |
Solution: Three Methods
| Your situation | Suitable method |
|---|---|
| Only Any paths or all the rules in specific host groups, with the template suitable for the level | Method 1: WEB-CLI reset-rules |
| Any paths in all the host groups of a vService, from the interface | Method 2: Sync with Default WAF Rules |
| In a single group, from the interface; the standard template is enough | Method 3: Deleting in Page types |
Method 1: WEB-CLI reset-rules Recommended
- How it works In the selected host groups, Any paths or all the rules are set up again with the default set; the template is selected according to the OWASP Protection Level setting of each vService itself.
- Where it is opened WEB-CLI →
waf host-groups reset-rules - Requirement WEB-CLI access; an Export taken beforehand
- Scope The selected host groups (they can be from different vServices);
target allcovers all the WAF host groups on the device
Step-by-Step Configuration
1
Adım 1 Take a backup
On the Page types tab of each group to be reset, the existing set is downloaded with Export (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).
2
Adım 2 Write the command
scope defaultRule is written for only Any paths, and scope all for all the rules of the group:
text
waf host-groups reset-rules target selected scope defaultRulescope all deletes all of the custom and learned rules (reset-rules).
3
Adım 3 Select the groups
When target selected is written without an ID, a selection list with checkboxes opens; the host groups to be reset are checked. In a script, the groups are given with --ids.N (target selection and confirmation).
4
Adım 4 Confirm
The confirmation screen writes how many groups will be affected; when it is confirmed, the rules are set up again with the default set and are applied without a separate deployment step. In a cluster setup, they are also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, they are sent manually with Synchronize.
Renewing only the default header rules
To renew only the default header rules with their default definitions without touching the other settings of Any paths, waf host-groups add-arg-headers target selected is used; for a single group, the waf fw-rules add-arg-headers <vService> <group> command is run (add-arg-headers).
Verification
1ListTR7 side
The Page types list of the group and the N page types number on the mode card are examined.
Expected
scope all: only Any paths (1 page types) · scope defaultRule: the other rules in place2User LogsTR7 side
The record is examined on the Settings → System Logs → User Logs screen.
Expected
default WAF rule is reset to factory settings · all WAF rules are reset to the factory setMethod 2: Sync with Default WAF Rules
- How it works In all the host groups of the vService, Any paths is set up again with the template suitable for the selected OWASP Protection Level; exact and glob rules are not touched.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking → OWASP Protection Level card → pencil icon
- Requirement WAF protection enabled on the vService
- Scope All the host groups of a single vService; a single group cannot be selected
Step-by-Step Configuration
1
Adım 1 Open the edit window
In the Left Monitor Panel, the vService is clicked on the WAF-Protected vServices tab and the WAF Management tab is opened; the pencil icon at the top right of the OWASP Protection Level card in the Inspection & Blocking section is clicked (edit screen).
2
Adım 2 Select the level (if needed)
Since the template is determined according to the selected level, it is verified that the OWASP Protection Level field is at the desired value: Aggressive sets up the strict template, and the other levels set up the standard template.
3
Adım 3 Check the synchronization
Sync with Default WAF Rules is checked. It is not a persistent setting; it comes unchecked every time the window is opened.
4
Adım 4 Save
Edit at the bottom of the window is clicked and Yes is clicked in the Are you sure to sync default WAF rules with Owasp protection level? question. In all the host groups, Any paths is set up again, including the argument rules on it, and is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.
Verification
1Detail panelTR7 side
In the Page types list of each group, the Any paths row is clicked and the Path tab of the detail panel is examined.
Expected
Template values suitable for the selected levelMethod 3: Deleting in Page Types
- How it works When Any paths is selected and deleted, it is set up again with the standard template in the same operation; if all the rows are selected and deleted, the other rules are also removed permanently.
- Where it is opened Page types → row selection → Delete
- Requirement WAF protection enabled on the vService; an Export taken beforehand
- Scope The single open host group; the protection level is not taken into account
Step-by-Step Configuration
1
Adım 1 Open the Page Types tab
On the WAF Management tab, the N page types row under the mode card of the host group is clicked (accessing the screen).
2
Adım 2 Select the rows
If only Any paths is to be reset, the Any paths row is checked; if all the rules of the group are to be removed, all the rows are selected with the checkbox in the table header.
3
Adım 3 Delete
Delete on the toolbar is clicked (the deletion steps).
4
Adım 4 Confirm
Yes is clicked in the deletion question. The other rules are deleted permanently, and Any paths is set up again with the standard template in the same operation (Can I delete the Any Paths rule?). The change is applied without a separate deployment step; in a cluster setup, it is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually with Synchronize.
Verification
1Detail panelTR7 side
The Any paths row is clicked and the Path tab of the detail panel is examined.
Expected
Allowed methods: GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE · Path length: [1 - 8192] · Path depth: ≤ 256 · OWASP check: ✓If all the rows were deleted, only Any paths remains in the list and the mode card shows 1 page types.
Common Mistakes
- Resetting without a backup. None of the ways can be undone; Export is taken first.
- Writing it with
target all.target allcovers all the WAF host groups on the device; only the desired groups are selected withtarget selected. - Thinking that Sync will affect only one group. Sync with Default WAF Rules sets up Any paths again in all the host groups of the vService.
- Expecting Any paths deletion to follow the protection level. Delete in Page types always sets up the standard template; the template suitable for the level is set up with reset-rules or Sync.
- Expecting the signature changes to be reset as well. The status and score of the signatures are a separate layer (How do I revert my changes to the default (Restore to Default)?).
How it is done in the documentation
