Skip to content

appfw-settings

The following operations can be performed on "appfw-settings":

set| show| unset|

set appfw settings

Modifies the global application firewall settings. The global settings apply to all application firewall profiles.

Synopsis

set appfw settings [-defaultProfile ] [-undefAction ] [-sessionTimeout ] [-learnRateLimit ] [-sessionLifetime ] [-sessionCookieName ] [-clientIPLoggingHeader ] [-importSizeLimit ] [-signatureAutoUpdate ( ON | OFF )] [-signatureUrl ] [-cookiePostEncryptPrefix ] [-GeoLocationLogging ( ON | OFF )] [-CEFLogging ( ON | OFF )] [-entityDecoding ( ON | OFF )] [-useConfigurableSecretKey ( ON | OFF )] [-sessionLimit ] [-malformedReqAction ...] [-CentralizedLearning ( ON | OFF )] [-proxyServer ] [-proxyPort ]

Arguments

defaultProfile Profile to use when a connection does not match any policy. Default setting is APPFW_BYPASS, which sends unmatched connections back to the Citrix ADC without attempting to filter them further. Default value: APPFW_BYPASS

undefAction Profile to use when an application firewall policy evaluates to undefined (UNDEF). An UNDEF event indicates an internal error condition. The APPFW_BLOCK built-in profile is the default setting. You can specify a different built-in or user-created profile as the UNDEF profile. Default value: APPFW_BLOCK

sessionTimeout Timeout, in seconds, after which a user session is terminated. Before continuing to use the protected web site, the user must establish a new session by opening a designated start URL. Default value: 900 Minimum value: 1 Maximum value: 65535

learnRateLimit Maximum number of connections per second that the application firewall learning engine examines to generate new relaxations for learning-enabled security checks. The application firewall drops any connections above this limit from the list of connections used by the learning engine. Default value: 400 Minimum value: 1 Maximum value: 1000

sessionLifetime Maximum amount of time (in seconds) that the application firewall allows a user session to remain active, regardless of user activity. After this time, the user session is terminated. Before continuing to use the protected web site, the user must establish a new session by opening a designated start URL. Default value: 0 Minimum value: 0 Maximum value: 2147483647

sessionCookieName Name of the session cookie that the application firewall uses to track user sessions. Must begin with a letter or number, and can consist of from 1 to 31 letters, numbers, and the hyphen (-) and underscore (_) symbols.

The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, "my cookie name" or 'my cookie name'). Default value: NS_S_AS_DEFAULT_COOKIE_NAME

clientIPLoggingHeader Name of an HTTP header that contains the IP address that the client used to connect to the protected web site or service.

importSizeLimit Cumulative total maximum number of bytes in web forms imported to a protected web site. If a user attempts to upload files with a total byte count higher than the specified limit, the application firewall blocks the request. Default value: 134217728 Minimum value: 1 Maximum value: 268435456

signatureAutoUpdate Flag used to enable/disable auto update signatures

Possible values: ON, OFF Default value: OFF

signatureUrl URL to download the mapping file from server Default value: https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml

cookiePostEncryptPrefix String that is prepended to all encrypted cookie values. Default value: NS_S_AS_DEFAULT_CKI_POST_ENCRYPT_PREFIX

GeoLocationLogging Enable Geo-Location Logging in CEF format logs.

Possible values: ON, OFF Default value: OFF

CEFLogging Enable CEF format logs.

Possible values: ON, OFF Default value: OFF

entityDecoding Transform multibyte (double- or half-width) characters to single width characters.

Possible values: ON, OFF Default value: OFF

useConfigurableSecretKey Use configurable secret key in AppFw operations

Possible values: ON, OFF Default value: OFF

sessionLimit Maximum number of sessions that the application firewall allows to be active, regardless of user activity. After the max_limit reaches, No more user session will be created . Default value: 100000 Minimum value: 0 Maximum value: 500000

malformedReqAction flag to define action on malformed requests that application firewall cannot parse Default value: AS_DEFAULT_DISPOSITION

CentralizedLearning Flag used to enable/disable ADM centralized learning

Possible values: ON, OFF Default value: OFF

proxyServer Proxy Server IP to get updated signatures from AWS.

proxyPort Proxy Server Port to get updated signatures from AWS. Default value: 8080

show appfw settings

Displays the current application firewall global settings.

Synopsis

show appfw settings

Arguments

Output

defaultProfile Profile to use when a connection does not match any policy. Default setting is APPFW_BYPASS, which sends unmatched connections back to the Citrix ADC without attempting to filter them further.

undefAction Profile to use when an application firewall policy evaluates to undefined (UNDEF). An UNDEF event indicates an internal error condition. The APPFW_BLOCK built-in profile is the default setting. You can specify a different built-in or user-created profile as the UNDEF profile.

sessionTimeout Session timeout (in seconds).

learnRateLimit Learn messages rate limit value (in messages per second).

sessionLifetime Session lifetime (in seconds). Zero means no limit.

sessionCookieName Name of the session cookie that the application firewall uses to track user sessions. Must begin with a letter or number, and can consist of from 1 to 31 letters, numbers, and the hyphen (-) and underscore (_) symbols.

The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, "my cookie name" or 'my cookie name').

clientIPLoggingHeader Name of header that holds downstream IP address for logging purposes.

importSizeLimit Cumulative total maximum number of bytes in web forms imported to a protected web site. If a user attempts to upload files with a total byte count higher than the specified limit, the application firewall blocks the request.

signatureAutoUpdate Flag used to enable/disable auto update signatures

signatureUrl URL to download the mapping file from server

cookiePostEncryptPrefix String that is prepended to all encrypted cookie values.

logMalformedReq Log requests that are so malformed that application firewall parsing doesn't occur.

GeoLocationLogging Enable Geo-Location Logging in CEF format logs.

CEFLogging Enable CEF format logs.

entityDecoding Transform multibyte (double- or half-width) characters to single width characters.

useConfigurableSecretKey Use configurable secret key in AppFw operations

sessionLimit Maximum number of sessions that the application firewall allows to be active, regardless of user activity. After the max_limit reaches, No more user session will be created .

appEnforceSessionLimit Let application firewall enforce session limits. Available settings are as follows: * ON - Application firewall enforces session limits. * OFF - DHT framework enforces session limits

malformedReqAction flag to define action on malformed requests that application firewall cannot parse

learning Global learning option that overrides the profile level learning. Available settings are as follows: * ON - Honor all profile level learn settings. * OFF - Avoids learning for all profiles ignoring profile level learn setting.

CentralizedLearning Flag used to enable/disable ADM centralized learning

proxyServer Proxy Server IP to get updated signatures from AWS.

proxyPort Proxy Server Port to get updated signatures from AWS.

builtin Flag to determine if application firewall settings is built-in or not

feature The feature to be checked while applying this config

unset appfw settings

Use this command to remove appfw settings settings.Refer to the set appfw settings command for meanings of the arguments.

Synopsis

unset appfw settings [-defaultProfile] [-undefAction] [-sessionTimeout] [-learnRateLimit] [-sessionLifetime] [-sessionCookieName] [-clientIPLoggingHeader] [-importSizeLimit] [-signatureAutoUpdate] [-signatureUrl] [-cookiePostEncryptPrefix] [-GeoLocationLogging] [-CEFLogging] [-entityDecoding] [-useConfigurableSecretKey] [-sessionLimit] [-malformedReqAction] [-CentralizedLearning] [-proxyServer] [-proxyPort]

Was this article helpful?