Protecting a web server against attacks

Define a host for the web server.

1. Go to Hosts and services > FQDN host and click Add.
2. Specify the settings.

   Option	Description
   Name	My website
   FQDN	example.com

3. Click Save.

Configure a web server to host a website.

1. Go to Web server > Web servers and click Add.
2. Specify the settings.
   Note For settings not listed here, use the default value.

   Option	Description
   Name	My web server
   Host	My website

3. Click Save.

These settings protect the network against unauthorized access and common threats.

1. Go to Web server > Protection policies and click Add.
2. Specify the settings.

   Option	Description
   Name	Web server protection

3. Specify protection settings.

   Option	Description
   Pass Outlook anywhere	Off
   Mode	Reject
   Cookie signing	Off
   Static URL hardening	On
   Entry URLs	/
   Form hardening	On
   Anti-virus	On
   Block clients with bad reputation	On
   Skip remote lookups for clients with bad reputation	Off
   Common threat filter	On

4. Click Save.

To protect the web server against application exploits, you define a business application rule that uses the WAF template. You specify the web server, authentication settings, and protection settings.

1. Go to Firewall and click + Add firewall rule > Business application rule.

   

2. Specify the settings.

   Option	Description
   Application template	Web server protection (WAF)
   Rule name	Protect my web server

   

3. Specify hosted server settings.

   Option	Description
   Hosted address	#Port1
   Domains	webserver.example.com

   

4. Specify protected server settings.

   Option	Description
   Web server list	My web server

   

5. Specify access permission settings.

   Option	Description
   Authentication	Basic with passthrough

   

6. Specify advanced settings.

   Option	Description
   Protection	Web server protection

   

7. Click Save.