Allow or drop traffic based on headers

NoamRotter — Thu, 23 Sep 2021 08:00:54 GMT

Hi,
I need to allow/drop traffic based on headers.
I need a custom signature to make sure the HOST is one of:
1. abc.com (or)
2. xyz.com

AND
The XFF header is one of:
1. 1.1.1.1 (or)
2. 2.2.2.2 (or)
3. 3.3.3.3

AND
A header name "X-MyHeader" has the value: "123"

If one of the above condition is false, drop the traffic.

I will appreciate any help.

Noam.

Re: Allow or drop traffic based on headers

nikoolayy1 — Thu, 13 Jan 2022 08:39:30 GMT

You check my idea for app signature for the referrer header:

LIVEcommunity - Knowledge sharing: Version 10 no 7 byte limit for sinatures examples for Layer 7 (L7) DDOS/Brute force protection and referer match - LIVEcommunity - 394734 (paloaltonetworks.com)

Please also the link below and the part how to make multiple match conditions "

Specify the matching conditions by clicking
Add And Condition
or
Add Or Condition
."

Create Custom Application Signature (paloaltonetworks.com)

topic Re: Allow or drop traffic based on headers in Custom Signatures

Allow or drop traffic based on headers

Re: Allow or drop traffic based on headers