Skip to content

troubleshooting.mdx

Latest commit

 

History

History
210 lines (146 loc) · 10.1 KB

troubleshooting.mdx

File metadata and controls

210 lines (146 loc) · 10.1 KB
Raw
pcx_content_type troubleshooting
description Troubleshoot WAF managed rules false positives and configuration issues.
products
waf
title Troubleshoot managed rules
sidebar
order label
4
Troubleshooting
tags
Debugging

import { RuleID } from "~/components";

By default, WAF's managed rulesets are compatible with most websites and web applications. However, false positives and false negatives may occur:

  • False positives: Legitimate requests detected and mitigated as malicious.
  • False negatives: Malicious requests that were not mitigated and reached your origin server.

Troubleshoot false positives

You can use Security Events to help you identify what caused legitimate requests to get blocked. Add filters and adjust the report duration as needed.

If you encounter a false positive caused by a managed rule, do one of the following:

  • Add an exception: Exceptions allow you to skip the execution of WAF managed rulesets or some of their rules for certain requests.

  • Adjust the OWASP managed ruleset: A request blocked by the rule with ID and description 949110: Inbound Anomaly Score Exceeded refers to the Cloudflare OWASP Core Ruleset. To resolve the issue, configure the OWASP managed ruleset.

  • Disable the corresponding managed rule(s): Create an override to disable specific rules. This may avoid false positives, but you will also reduce the overall site security. Refer to the dashboard instructions on configuring a managed ruleset, or to the API instructions on creating an override.

:::note If you contact Cloudflare Support to verify whether a WAF managed rule triggers as expected, provide a HAR file captured while sending the specific request of concern. :::

Additional recommendations

  • If one specific rule causes false positives, disable that specific rule and not the entire ruleset.

  • For false positives with the administrator area of your website, add an exception disabling a managed rule for the admin section of your site resources. You can use an expression similar to the following:

    http.host eq "example.com" and starts_with(http.request.uri.path, "/admin")

Troubleshoot false negatives

To identify false negatives, review the HTTP logs on your origin server.

To reduce false negatives, use the following checklist:

  • Are DNS records that serve HTTP traffic proxied through Cloudflare?
    Cloudflare only mitigates requests in proxied traffic.

  • Have you deployed any of the WAF managed rulesets in your zone?
    You must deploy a managed ruleset to apply its rules.

  • Are Managed Rules being skipped via an exception?
    Use Security Events to search for requests being skipped. If necessary, adjust the exception expression so that it matches the attack traffic that should have been blocked.

  • Have you enabled any necessary managed rules that are not enabled by default?
    Not all rules of WAF managed rulesets are enabled by default, so you should review individual managed rules.

    • For example, Cloudflare allows requests with empty user agents by default. To block requests with an empty user agent, enable the rule with ID in the Cloudflare Managed Ruleset.
    • Another example: If you want to block unmitigated SQL injection (SQLi) attacks, make sure the relevant managed rules tagged with sqli are enabled in the Cloudflare Managed Ruleset.

    For instructions, refer to Configure a managed ruleset.

  • Is the attack traffic matching a custom rule skipping all Managed Rules?
    If necessary, adjust the custom rule expression so that it does not apply to the attack traffic.

  • Is the attack traffic matching an allowed ASN, IP range, or IP address in IP Access rules?
    Review your IP Access rules and make sure that any allow rules do not match the attack traffic.

  • Is the malicious traffic reaching your origin IP addresses directly, therefore bypassing Cloudflare protection?
    Block all traffic except from Cloudflare's IP addresses at your origin server.

Additional recommendations

If WAF's managed rulesets do not detect a specific attack pattern after verifying the above, consider the following:

  • Use WAF attack score to complement signature-based managed rules with machine-learning detection. Attack score classifies each request with a score indicating the likelihood it is malicious, even when no managed rule matches.

  • Create a custom rule to block the specific attack pattern. Use fields such as URI path, query string, or HTTP request headers to match the malicious requests.

Troubleshoot invalid managed rule override

When you try to save changes to a managed ruleset in the Cloudflare dashboard, you may encounter an error if one of your overrides references a rule that no longer exists.

Symptoms

When you select Save after changing the action of a managed rule, the dashboard displays an error similar to the following: <rule_id> is not a valid value for id because it does not exist in ruleset <ruleset_id>

You may also notice that one of your overrides shows empty or missing rule information.

Cause

Managed rulesets are maintained by Cloudflare and updated over time. If a rule you previously overrode is removed from the managed ruleset, your configuration may still contain a reference to that rule ID. This invalid reference blocks any new changes to the ruleset until it is removed.

Resolution

Remove the invalid override using one of the following methods.

Dashboard

Removing the managed ruleset deployment rule clears all overrides and allows you to re-deploy in a clean state.

  1. In the Cloudflare dashboard, go to the Security rules page.

  2. (Optional) Filter by Managed rules.

  3. Search for the managed ruleset you want to configure.

  4. Next to the managed ruleset deployment rule you want to delete, select the three dots > Delete and confirm the operation.

  1. Log in to the Cloudflare dashboard and select your account and domain.
  2. Go to Security > WAF > Managed rules tab.
  3. Next to the managed ruleset deployment rule you want to delete, select the three dots > Delete and confirm the operation.

API

Use the Rulesets API to remove only the invalid override while preserving the rest of your configuration.

  1. <Render file="rulesets/api-zone/step1-get-entrypoint" product="waf" params={{ phaseName: "http_request_firewall_managed" }} />

<APIRequest path="/zones/{zone_id}/rulesets/phases/{ruleset_phase}/entrypoint" method="GET" parameters={{ ruleset_phase: "http_request_firewall_managed" }} roles={false} />

{
  "result": {
    "id": "<RULESET_ID>",
    "rules": [
      {
        "id": "<EXECUTE_RULE_ID>",
        "action": "execute",
        "action_parameters": {
          "id": "<MANAGED_RULESET_ID>",
          "matched_data": {
            "public_key": "..."
          },
          "overrides": {
            "rules": [
              {
                "id": "<VALID_RULE_ID>",
                "enabled": true
              },
              {
                "id": "<INVALID_RULE_ID>",
                "enabled": true
              }
            ]
          },
          "version": "latest"
        },
        "expression": "true"
      }
    ]
  }
}

  1. Take note of the following values from the response:

    • Ruleset ID (result.id)
    • Execute rule ID (result.rules[].id where action is "execute")
    • Invalid rule ID (the invalid rule ID inside action_parameters.overrides.rules[])

  2. Copy the entire execute rule object from the Step 1 response, then remove only the override object containing the invalid rule ID.

  3. Send a PATCH request with the full rule payload.

    <APIRequest path="/zones/{zone_id}/rulesets/{ruleset_id}/rules/{rule_id}" method="PATCH" parameters={{ ruleset_id: "<RULESET_ID>", rule_id: "<RULE_ID>" }} roles={false} />

    Copy your complete action_parameters object from the Step 1 response into the JSON body below. Do not remove other existing fields such as matched_data, categories, or version. Remove only the override object that references the invalid rule ID.

    curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules/{rule_id}" \
  --request PATCH \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "action": "execute",
    "expression": "true",
    "action_parameters": {
      "id": "<MANAGED_RULESET_ID>",
      ...
      "overrides": {
        "rules": [
          ...
        ]
      }
    }
  }'

  :::note
  The `...` placeholders indicate where you must paste your existing fields from Step 1. Replace the first `...` with your complete existing fields (such as `matched_data`, `version`, etc.). Replace the second `...` with your valid overrides from Step 1, excluding the invalid rule.
  :::