SecMaster WAF Address Group Association Policy

Playbook Overview

If a WAF emergency policy is added to SecMaster and the policy blocks IP addresses, the SecMaster WAF address group association policy playbook takes effect when either of the following conditions is met:

Condition 1: After an emergency policy is added to SecMaster and IP addresses are configured, SecMaster converts the IP addresses into an IP address group and delivers the IP address group to WAF. WAF then executes the policy. If no IP address group is delivered by SecMaster to WAF, the SecMaster WAF address group association policy playbook takes effect. WAF automatically creates an IP address group and associates the IP address group with an existing protection policy.

Condition 2: After an emergency policy is added to SecMaster and IP addresses are configured, SecMaster converts the IP addresses into an IP address group and delivers the IP address group to WAF. WAF then executes the policy. If the IP address group quota on WAF is used up, the SecMaster WAF address group policy association playbook takes effect. WAF automatically creates an IP address group and associates the IP address group with an existing protection policy.

For details about the basic concepts of policies, see Overview.

This playbook is enabled by default, and no manual configuration is required. It is triggered every hour.

Prerequisites

• Your SecMaster professional edition is available.
• Your WAF professional edition is available, and the available quota of IP address blacklist and whitelist rules is abundant.
• You have at least one domain name protected by WAF.

Implementation Effect

1. If the playbook is triggered, you can view the IP address group automatically created by WAF on the Objects > Address Groups page in WAF.

Figure 1 Viewing the new IP address group in WAF

2. If the playbook is triggered, you can view the IP address group automatically created by WAF on the Objects > Address Groups page in WAF. The IP address group is associated with an existing protection policy in WAF.

Figure 2 Viewing the IP address group associated with a protection policy in WAF