Getting Started with Edge Policies

1. Select the region and compartment where the policy should be maintained (there is no constraint around the WAF co-existing with Load Balancer or other application resources in Oracle Cloud Infrastructure.

2. Open the navigation menu and click Identity & Security. Under Web Application Firewall, click Policies.

3. Click Create WAF Policy.

4. Look at the bottom of the Basic Information page for the following:

   Use legacy workflow here if you need to secure your non-OCI web applications.

5. Click the link to display the Create Edge Policy dialog box.
6. Complete the following:
   • Name: A unique name for the policy.
   • Domains:
     • Primary Domain: The fully qualified domain name (FQDN) of the application where the policy will be applied.
     • Additional Domains: (Optional) Subdomains where the policy will be applied.
       Note
       
       

       Wildcard domains are accepted, however, only as additional domains and only through the API and CLI.

   • WAF Origin: The host or IP address of the public internet facing application that is being protected.
     • Origin Name: A unique name for the origin.
     • URI: Enter the public facing endpoint (IPv4 or FQDN) of the application.
     • HTTPS Port: The port used for secure HTTP connection. The default port is 443.
     • HTTP Port: The HTTP port the origin listens on. The default port is 80.
     • Headers: (Optional)
       • Header Name: The name displayed in the HTTP request header and the header value that can be added and passed to the origin server with all requests.
       • Header Value: Specifies the data requested by the header.
   • Tags: If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you're not sure whether to apply tags, skip this option or ask an administrator. You can apply tags later.
7. Click Create WAF Policy. The WAF Policy overview appears. Expect the policy to become active within 15 minutes of creation.

   See Managing Edge Policies for more information.

1. Open a terminal.

   Run the following command for HTTP:

   curl -lvk http://<OCI_WAF_CNAME> -H "Host: <WEBAPP_DOMAIN>" -so /dev/null

   Run the following command for HTTPS:

   curl -lvk https://<OCI_WAF_CNAME> -H "Host: <WEBAPP_DOMAIN>" -so /dev/null

2. You can also run a DNS query against the <OCI_WAF_CNAME> for your WAF policy and copy one of the IP addresses from the resulting output.
   • To run a DNS query you can use one of the following commands:

     dig <OCI_WAF_CNAME>

     nslookup <OCI_WAF_CNAME>

   • Copy any of the IP addresses from the output.
3. Run the following command. Replace <WEBAPP_DOMAIN> with your WAF policy domain. Use port 80 or 443. Replace <OCI_NODE_IP> with the IP address from OCI_WAF_CNAME.

   Query curl -vso/dev/null --resolve <WEBAPP_DOMAIN>:<PORT_80_OR_443>:<OCI_NODE_IP> https://<WEBAPP_DOMAIN>

   A 200, 301, 302, or any other expected HTTP response code is returned.

   Note
   
   If you receive a 5XX HTTP error, ensure that you have updated your firewall setting to allow our IP addresses. If you are still experiencing an issue, open a service request with My Oracle Support. In the support request, provide your compartment OCID, policy OCID, explanation about the issue you are experiencing, a HAR file, and a time when the issue started.

To test your application using a hosts file, you need an IP address where you could point your application. Under the policy, you should see the CNAME which is assigned to you. You can get the IP address where you can point your application.

1. Open a terminal.
2. Run a DNS query using any of the following commands:

   dig <OCI_WAF_CNAME>

   nslookup <OCI_WAF_CNAME>

3. Copy one of three IP addresses from a dig command output Answer section and paste it to a hosts file with your domain name.
4. After you save your hosts file, open your application in a browser and verify it is working as expected.

   A 200, 301, 302, or any other expected HTTP response code is returned.

   Note
   
   If you receive a 5XX HTTP error, ensure that you have updated your firewall setting to allow our IP addresses. If you are still experiencing an issue, open a service request with My Oracle Support. In the support request, provide your compartment OCID, policy OCID, explanation about the issue you are experiencing, a HAR file, and a time when the issue started.

echo | openssl s_client -showcerts -servername <Domain> -connect <Domain>:443 2>/dev/null | openssl x509 -inform pem -noout -text

..
Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
        Validity
            Not Before: Jun  5 03:15:10 2020 GMT
            Not After : Sep  3 03:15:10 2020 GMT
        Subject: CN = www.example.com
        Subject Public Key Info:
...

You can also check the certificate from third-party websites such as SSL Shooper or SSL labs and perform the validation there.

1. In the Policy Information tab of the WAF Policy overview, select the CNAME Target.
2. Copy the CNAME target to your clipboard.
3. Open the navigation menu and click Networking. Under DNS management, click Zones.

4. Click the Zone Name of the primary domain where you want to update the record. Zone details and a list of records appear.

5. Select the check box for the CNAME record and select Edit from the Actions drop-down menu.
6. In the Edit Record dialog box, update the Target field with the CNAME Target from your clipboard.
7. Click Submit.
8. Click Publish Changes.
9. In the confirmation dialog box, click Publish Changes.