<p class="shortdesc">本文介绍如何对已接入的资产进行防护类型配置。</p> <section class="section prereq" id="dc_waf_cfg_0006__prereq_uqt_rj4_nrb"><div class="tasklabel"><h2 class="doc-tairway">前提条件</h2></div> <p class="p">您已购买Web应用防火墙服务，并且完成资产接入。</p> </section> <section><div class="tasklabel"><h2 class="doc-tairway">操作步骤</h2></div><ol class="ol steps"><li class="li step stepexpand"> <span class="ph cmd">登录<a class="xref" href="https://www.ocftcloud.com/" target="_blank" rel="external noopener">平安金融云官网</a>。</span> </li><li class="li step stepexpand"> <span class="ph cmd">单击页面右上角<span class="ph uicontrol">控制台</span>按钮。</span> </li><li class="li step stepexpand"> <span class="ph cmd">输入账号名和密码，通过验证，单击<span class="ph uicontrol">确定</span>，登录控制台。</span> </li><li class="li step stepexpand"> <span class="ph cmd">在左侧导航栏中单击<span class="ph menucascade"><span class="ph uicontrol">全部产品</span><abbr> > </abbr><span class="ph uicontrol">Web应用防火墙</span></span> ，进入<span class="keyword wintitle">概览</span>页面。</span> </li><li class="li step stepexpand"> <span class="ph cmd">单击<span class="ph uicontrol">管理</span>跳转到<span class="keyword wintitle">防护概览</span>页面，单击左侧导航栏<span class="ph menucascade"><span class="ph uicontrol">防护配置</span><abbr> > </abbr><span class="ph uicontrol">防护类型配置</span></span>，进入<span class="keyword wintitle">防护类型配置</span>页面，在左上角选择框中站点域名进行防护类型配置。</span> <div class="itemgroup info"> <img class="image" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-10c186489ca1.png" width="700"> <img class="image" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-188993e79bcf.png" width="700"> <div class="p"> <div class="note note note_note" id="dc_waf_cfg_0006__note_hsy_d54_nrb"><span class="note__title">说明：</span> 也可以在<span class="keyword wintitle">资产列表</span>页面，选择目标资产，单击<span class="ph menucascade"><span class="ph uicontrol">更多</span><abbr> > </abbr><span class="ph uicontrol">防护配置</span></span>进行防护类型配置。<img class="image" id="dc_waf_cfg_0006__image_srv_354_nrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1f2b4fa99fe3.png" width="700"></div> </div> </div> </li><li class="li step stepexpand"> <span class="ph cmd">根据实际需求选择安全模式：</span> <div class="itemgroup info"> <ul class="ul" id="dc_waf_cfg_0006__ul_s1b_n54_nrb"> <li class="li">防护模式：监测到攻击行为后立即拦截，并记录日志。</li> <li class="li">检测模式：监测到攻击行为后不拦截，仅记录日志。</li> <li class="li">转发模式：不监测攻击行为，直接放行。</li> </ul> <img class="image" id="dc_waf_cfg_0006__image_xfj_s54_nrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-108120cb9fbb.png" width="400"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">配置应用防护能力，包括以下四部分：</span> <ol type="a" class="ol substeps" id="dc_waf_cfg_0006__substeps_av5_w54_nrb"> <li class="li substep substepexpand"> <span class="ph cmd">Webshell防护：开启后可杜绝Webshell的上传和访问，并对已经上传的Webshell进行拦截。单击<span class="ph uicontrol">修改防护配置</span>可根据需求选择开启或关闭Webshell防护及防护类型。</span> <div class="itemgroup info"> <img class="image" id="dc_waf_cfg_0006__image_hdr_fv4_nrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1e8c477797d0.png" width="500"> <div class="note note note_note" id="dc_waf_cfg_0006__note_lxd_hv4_nrb"><span class="note__title">说明：</span> 不需要防护的路径可以加入白名单：<ol class="ol" type="i" id="dc_waf_cfg_0006__ol_dvh_jv4_nrb"> <li class="li">单击<span class="ph uicontrol">修改防护配置</span>进入Webshell白名单配置页面，输入URL，单击<span class="ph uicontrol">确认</span>。<img class="image" id="dc_waf_cfg_0006__image_vgd_yv4_nrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1f16839f9489.png" width="700"></li> <li class="li">添加完成后可看到已添加白名单数量。<img class="image" id="dc_waf_cfg_0006__image_g5k_1w4_nrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1cbdbd8b9b9c.png" width="600"></li> </ol></div> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">CC防护：专利级CC防护，多维度拦截恶意CC攻击。</span> <div class="itemgroup info"> <img class="image" id="dc_waf_cfg_0006__image_drp_czl_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-10ca7c4490d6.png" width="550"> <ol class="ol" type="i" id="dc_waf_cfg_0006__ol_gfp_kzl_rrb"> <li class="li">单击<span class="ph uicontrol">修改防护配置</span>可查看已配置的防护规则或新增规则。<img class="image" id="dc_waf_cfg_0006__image_dgj_szl_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-11f7ab809137.png" width="750"></li> <li class="li">点击<span class="ph uicontrol">新增</span>，输入规则名称，选择匹配规则，输入URL等信息。<img class="image" id="dc_waf_cfg_0006__image_csc_zzl_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1ced3e2b9b6c.png" width="700"></li> <li class="li">点击<span class="ph uicontrol">确定</span></li> <li class="li">添加完成后，可在规则列表面查看新增的规则。<img class="image" id="dc_waf_cfg_0006__image_rvm_m1m_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-15d58aeb97de.png" width="750"></li> </ol> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">扫描防护：专利级行为检测算法，分钟级扫描器识别封锁，可拦截大部分扫描器。单击<span class="ph uicontrol">状态</span>后面的开关可开启或关闭防护扫描功能。</span> <div class="itemgroup info"> <img class="image" id="dc_waf_cfg_0006__image_mlq_y1m_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-197c26059290.png" width="550"> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">bots防护：对当前站点中指定URL的静态页面进行加密防护，可以有效防止爬虫等工具获取或篡页面真实内容。</span> <div class="itemgroup info"> <img class="image" id="dc_waf_cfg_0006__image_a21_jbm_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1fd0c64b930d.png" width="600"> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">蜜罐：单击<span class="ph uicontrol">修改防护配置</span>可选择开启或关闭蜜罐及联动防护功能。开启蜜罐功能后，系统会检查当前站点是否正在被攻击、被扫描或遭受爬虫，还可以感知以下行为，方便管理员进行攻击溯源：</span> <div class="itemgroup info"> <ul class="ul" id="dc_waf_cfg_0006__ul_cqt_c4z_wrb"> <li class="li">当用户访问站点中不存在的敏感路径时，进行指纹采集和行为记录。 </li> <li class="li">在Web应用Html页面追加爬虫蜜饵，感知页面是否被爬虫。</li> <li class="li">在网页上开启多个旁路监听web端口，感知web应用是否被端口扫描。</li> </ul> <img class="image" id="dc_waf_cfg_0006__image_g5y_4bm_rrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-12fb443f9360.png" width="550"> </div> </li> </ol> </li><li class="li step stepexpand"> <span class="ph cmd">访问加速配置：开启后，WAF连接站点服务器时会使用压缩传输，降低传输数据大小。</span> <div class="itemgroup info"> <img class="image" id="dc_waf_cfg_0006__image_gnk_5tp_vrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-1653cf0d9c0d.png" width="450"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">连接配置：</span> <div class="itemgroup info"> <ul class="ul" id="dc_waf_cfg_0006__ul_ezr_pkq_vrb"> <li class="li"><strong class="ph b">websocket</strong>：当站点使用WebSocket协议而非HTTP时，需要启用此开关。</li> <li class="li"><strong class="ph b">长连接</strong>：开启后，WAF访问站点服务器时会启用keep-alive机制，一个连接上可以发起多次请求，减轻性能压力，系统默认开启长连接功能。 </li> <li class="li"> <strong class="ph b">端口分离</strong>：当互联网访问的端口和站点服务器开放端口不一致时需要开启本功能，如访问www.abc.com:8080，而服务器开放的是80端口时，则需开启端口分离。</li> </ul> <img class="image" id="dc_waf_cfg_0006__image_dry_5tp_vrb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222102104527-167173229970.png" width="550"> </div> </li></ol></section>