Configuring IAG URL rules
Applies To: Intelligent Application Gateway (IAG)
Configuring URL inspection rules in Whale Communications Intelligent Application Gateway (IAG) 2007 consists of the following steps:
Defining a list of URL inspection rules, including system and application-specific pre-defined rules and the custom rules that you define.
Defining a parameter list and unlisted parameters.
Before configuring URL rules, note the following:
Do not change, add, or delete any of the rules protecting IAG built-in services, including: Internal Site, Web Monitor, File Access, IAG Portal, and Certified Endpoint Enrollment. Any changes you make to those rules will be over-written when IAG software is next upgraded or a patch is applied.
If you change, add, or delete any of the rules protecting the applications that are supported out-of-the-box, when IAG software is next upgraded or a patch is applied, the changes you make will only be supported for backward compatibility.
Note the following:
For applications that were added to the trunk prior to the upgrade, the rule set will retain the customization.
For new applications that are added after the upgrade or patch application, the customization will not be retained, and the rule set will be created with the default definitions. If you wish to apply the changes to new applications, as well, make sure to back up the changes you made in an external file.
Disabling the option Verify URLs in the Web Settings tab of an application’s Application Properties dialog box disables application-specific URL inspection for that application.
Activating the option Debug Mode in the General tab of the Advanced Trunk Configuration window disables URL inspection altogether.
Defining URL rules
URL inspection rules are defined in the URL List of the URL Set tab of the portal or application trunk. URLs that are not listed here will be denied access. The rules are configured and applied per application type. For each primary rule in the URL list, you can define exclusionary rules that define exceptions to the primary rule. For example, you may wish to reject all graphic .jpg files, with the exception of the file: logo.jpg. In this case, you create a primary rule to reject all the .jpg files and then add an exclusionary rule to accept the file logo.jpg. Note that when you disable a primary rule, its exclusionary rules are also disabled. After you enable the primary rule again, the associated exclusionary rules are not automatically enabled. You have to manually re-enable each exclusionary rule.
When creating rules you do the following:
Create primary and exclusionary rules in the URL list.
Create a set of general rules in the URL list. General rules are applied globally for an entire trunk. You can create any number of general rules with a reject action, or you can create a general rule with an accept action. A general rule with an accept action must be the last rule in the list of general rules. General rules are checked prior to the application rules as follows:
The general rules with a reject action are run. If the request is rejected at this stage, it is not subjected to examination by the application rules.
The general rule with the accept action is run. Its function is to indicate to IAG that the set of general rules has been completed and that the request should now be submitted for examination by the relevant application rules. Note that if you do not configure this rule, the request will not be submitted for further examination and will be rejected.
Create rules in the parameter list.
Copy, edit, or remove rules, in both the URL and the Parameter lists.
Specify how to handle unlisted parameters, where the URL rule is set to handle parameters and no rule is defined for a specific parameter in the parameter list.
Import and export rule sets.
You can also define rules automatically by using the rule-creation utility. For more information, see About the IAG rule-creating utility.
Creating primary and exclusionary rules
The following procedures describe how you add new rules to the URL and Parameters lists.
To add a primary rule to the URL List
In URL List, click Add Primary.
Configure the rule in accordance with the values described in the section "URL rule values".
To add an exclusionary rule to a primary rule
Select the primary rule to which you wish to add the exclusionary rule.
In URL List, click Add Exclude. An exclusionary rule is added under the primary rule.
Add rule parameters, as described in the section "URL rule values".
Creating general rules
You create a general rules by creating a regular rules with the GENERAL prefix. The following procedure describes how you create general rules with an accept action.
To create a set of general rules
Create the required general rules that have the reject action by using the following values:
In Name, specify the name by using the GENERAL prefix. For example, GENERAL_MyRule.
In Action, select Accept.
In URL, specify /.*.
In Parameters, select Ignore.
In Methods, ensure that you include all of the methods that might be used by any of the applications in the trunk. For example, for Microsoft Office SharePoint Portal Server 2003, include all of the following methods: GET, POST, HEAD, MOVE, COPY, PUT, DELETE, PROPFIND, OPTIONS, LOCK, UNLOCK, MKCOL, PROPPATCH, GETLIB. For Microsoft Office Outlook Web Access 2003, include all of the following methods: GET, POST, HEAD, COPY, TRACE, SEARCH, PUT, PROPPATCH, MOVE, PROPFIND, SDELETE, POLL, BMOVE, BCOPY, BPROPPATCH, SUBSCRIBE, MKCOL, DELETE.
Warning
If you create a general rule with the accept action, ensure that it is the last rule in the set of general rules. Use the arrows at the right of the URL List in order to move a selected rule up or down in the rule order. In addition, make sure that all of the values defined for the general accept rule are correct. If not, the request will be rejected, even if the rule set includes an application rule that accepts the request.
Following is an example of a set of general rules:
.gif "14851cba-b526-4567-81ef-8c9d28bc2c77")
URL rule values
| Value | Description |
|---|---|
Name |
Rule name. A rule name must be preceded by the following prefix:
Rule names are separated from the prefix by an underscore. For example: GENERAL_IISRule1. Note that exclusionary rules do not require a prefix. |
Action |
Select what action is taken when this rule is triggered:
|
URL |
A URL or group of URLs to which the rule is applied. Use regular expressions to describe URLs. |
Parameters |
Action to take when the request contains parameters:
|
Note |
Optional: a note describing the rule. |
Methods |
Defines acceptable request methods for the URL (multiple selection is possible). If the request uses a method other than those defined here, it is rejected. After you select the method from the list, click outside the list to apply the setting. |
Creating parameter rules
The parameter list defines the rules that IAG applies to URL parameters when a URL rule is set to handle parameters. The parameter list displays the parameter rules for a selected URL rule. Note that in addition to the parameters you define in the parameter list, you can define global parameter rules that apply to all URLs defined in the URL List. For more information, see Configuring IAG global URL parameters.
Add a rule to the parameter list as follows.
To add a rule in the Parameter List
In Parameter List, click Add.
The parameter rule is added at the end of the list of existing parameter rules.
Define the parameter rule, as described in the table above.
Parameter values
| Parameter | Description |
|---|---|
Name |
Parameter name. Must match name sent by the browser. |
Name Type |
Type of parameter name: String or Regular Expression. |
Value |
Parameter value. Depends on the type of value, as defined in the Value Type column.
|
Value Type |
Type of parameter value: Integer, Real, or String. |
Length |
Length of the value. |
Existence |
The possible values are the following:
|
Occurrences |
Define whether the parameter can appear in the URL once or multiple times. |
Max total length |
Total length of parameter values of all occurrences of this parameter. |
Rejected values checking |
Select whether to check parameters against the Rejected Values list, defined in the Global URL Settings tab.
|
Copying, editing and removing rules
The following procedures describe how you use the URL Set tab to copy, edit, or remove existing rules.
To copy an existing rule
Select the rule, and then below one of the following lists, click Copy:
URL List for URL rules
Parameter List for Parameter rules
Click Paste below the applicable list.
If you are copying an exclusionary rule, select its associated primary rule before pasting it. The rule, including its exclusionary rules, is added at the bottom of the rule list. If it is an exclusionary rule, it is added under the selected primary rule. For primary rules and parameter rules, a temporary name is assigned to the rule.
Where applicable, name the copied rule.
To edit rule parameters
Place the cursor over the field of the parameter you wish to edit, and then click inside it. Do one of the following:
If you have to enter parameter values as text, the color of the text field changes to light blue. In the box, enter the parameter value, and then click ENTER.
If you have to select from a list of options, a combo box list drops down. In the list, click the parameter.
To remove rules from the URL or Parameter list
Select the rule, and then below one of the following lists, click Remove:
URL List for URL rules
Parameter List for Parameter rules
The rule is removed, together with all its exclusions where applicable.
Handling unlisted parameters
In Unlisted Parameters, specify whether to accept or reject requests that contain parameters, when the URL rule is set to handle parameters and no rule is defined for the specified parameter in the parameter list.
Reject: URL is rejected.
Accept: URL is accepted if it matches the rules configured in this area, as listed in the following table.
Unlisted parameter values include the following.
| Parameter | Description |
|---|---|
Max Name Length |
Maximal length of a parameter name. Default: -1, where length of the name is not checked (length is unlimited). |
Max Value Length |
Maximal length of a parameter value. Default: -1, where length of the value is not checked (length is unlimited). |
Allowed Occurrences |
Define whether the same parameter can appear in the URL multiple times. |
Max Total Length |
Available only when “Allowed occurrences” is set to “Multiple”. Total length of parameter values of all occurrences of this parameter. Default: -1, where the total length of the values is not checked (total length is unlimited). |
Rejected Values Checking |
Select whether to check parameters against the Rejected Values list, defined in the Global URL Settings tab.
|
Exporting and importing rule sets
This section describes how you export the set of rules that is currently defined in a trunk. Once you create or export a ruleset, you can import it into other trunks. Note that if you want to import rules to other IAG servers, ensure that all servers use the same encryption key.
Exporting rule sets
You can export any rule set that is defined in an HTTP or an HTTPS trunk. You can then import the rule set into other HTTP and HTTPS trunks.
To export a rule set
In the Advanced Trunk Configuration window, in the URL Set tab, click Export.
The Export Ruleset dialog box is displayed.
Enter the following:
Select the location to which you wish to export the ruleset.
Enter your passphrase.
By default, the file is encrypted when it is exported. If you wish the file not to be encrypted, select the option Export decrypted.
Click Export.
The Export Ruleset dialog box closes. The ruleset is exported to the selected location.
Importing rule sets
You can import rulesets as follows:
Rule sets that are created by the rule-creating utility or pre-defined rulesets can be imported into both HTTP and HTTPS trunks. For more information about the rule-creation utility, see About the IAG rule-creating utility.
Rules sets that you export from one trunk can be imported into other trunks of the same type, either HTTP or HTTPS.
You can find rulesets that support spell-checkers by AccuSpell (www.spellchecker.com) in the following location on IAG:
…\Whale-Com\e-Gap\Von\Samples\RuleSetFor Microsoft Office Outlook Web Access 2000 SP3:
Ruleset_SpellCheck_ForOWA2000SP3.rulFor Microsoft Office Outlook Web Access 5.5:
RuleSet_SpellCheck_ForOWA55.rul
Import a rule set as follows.
To import a ruleset
In the Advanced Trunk Configuration window, in the URL Set tab, click Import.
The Import Ruleset dialog box is displayed.
Enter the following:
Select the folder where the ruleset is located.
Enter your passphrase.
If you want to overwrite the rules that are already defined for the trunk, select Overwrite existing.
If you want to append the imported rules to the existing rules, select Append to existing.
Click Import. The Import Ruleset dialog box closes. The ruleset is loaded, and the rules are displayed in the Advanced Trunk Configuration window, in the URL Set tab.
In the URL Set tab, in the URL List, in the Name column, edit the rules you imported in order to include the application-type prefix.