waf dlp exception
Use this command to configure DLP Exception to apply to the DLP Policy.
The DLP Exception feature allows you to define granular bypass conditions for traffic that would otherwise trigger Data Loss Prevention (DLP) rules. You can create exception objects composed of one or more match elements, each specifying conditions such as client IP, HTTP header, URI, or payload hash. These exceptions can be assigned to DLP policies to exclude matching traffic from enforcement. This enables more accurate DLP coverage while minimizing false positives and maintaining support for trusted applications and sources.
Syntax
config waf dlp exception
edit <name>
config exception-element-list
edit <entry_index>
set match-target {HOST | URI | FULL_URL | PARAMETER | COOKIE | CLIENT_IP | HTTP_HEADER | PAYLOAD_SHA256 | FILE_SHA256}
set operator {STRING_MATCH | REGEXP_MATCH | EQ | NE}
set ip <IP_range>
set value {<value_str> | <value_pattern>}
set value-check {enable | disable}
set value-name {<value-name_str> | <value-name_pattern>}
set concatenate-type {AND | OR}
next
end
next
end
<name>
|
Name of the DLP exception object. This name is referenced when assigning the exception to a DLP policy. |
No default |
| config exception-element-list
|
<entry_index>
|
Index number of the exception element entry. |
No default |
match-target {HOST | URI | FULL_URL | PARAMETER | COOKIE | CLIENT_IP | HTTP_HEADER | PAYLOAD_SHA256 | FILE_SHA256}
|
Specifies the traffic field to match against. Each target supports specific operators and field options. |
No default |
operator {STRING_MATCH | REGEXP_MATCH | EQ | NE}
|
Defines how the value is compared:
-
STRING_MATCH – Direct string comparison.
-
REGEXP_MATCH – Regular expression comparison.
-
EQ, NE – Equal / Not Equal (only supported for CLIENT_IP).
|
No default |
ip <IP_range>
|
Specifies the source IP address to match.
Only used when match-target is CLIENT_IP. Accepts both IPv4 and IPv6.
|
No default |
value {<value_str> | <value_pattern>}
|
Specifies the value to match for the selected target.
For PAYLOAD_SHA256 and FILE_SHA256, this must be a 64-character SHA-256 hash string.
This field is not available when match-target is CLIENT_IP.
|
No default |
|
value-check {enable | disable}
|
Enable to match the value of a specified name-value pair.
Only applicable for PARAMETER, COOKIE, and HTTP_HEADER.
When enabled, value-name and value must be defined.
|
disable
|
value-name {<value-name_str> | <value-name_pattern>}
|
Specifies the name of the parameter, cookie, or HTTP header to inspect when value-check is enabled.
Only applicable to PARAMETER, COOKIE, and HTTP_HEADER.
|
No default |
|
concatenate-type {AND | OR}
|
Defines how this exception element is evaluated with others:
|
AND
|
Example
config waf dlp exception
edit "DLP_exp"
config exception-element-list
edit 1
set match-target HTTP_HEADER
set operator STRING_MATCH
set value XYZ_Corp_Marketing_Tool
set value-check enable
set value-name User-Agent
end
end
