Create Firewall Rules with Rules Engine

Use Rules Engine to define the conditions and behaviors your Firewall executes for each incoming request.

This guide walks you through creating a rule using a practical example: verifying whether a client certificate exists and returning a custom response when it doesn’t. This is useful for enforcing mTLS policies, such as those required for BACEN compliance.

To create a rule:

Access Azion Console > Firewall.
Select the firewall in which you want to configure the rule.
Click the Rules Engine tab.
Click the + Rule button.
Give your rule a name and, optionally, a description.
In the Criteria section, select the SSL Verification Status variable.
As a comparison operator, select is equal.
As an argument, select Missing Client Certificate.
In the Behaviors section, select Set Custom Response.
As arguments:
- On Status Code, add 401.
- On Content Type, define the MIME type of the response body. Example: application/json.
- On Content Body, pass the message you want to present to users.
Click the Save button.

Run the following POST request to create a rule, replacing [TOKEN VALUE] with your personal token and the <edge_firewall_id> variable with your firewall id value:

curl --request POST --url https://api.azion.com/v4/edge_firewall/firewalls/<edge_firewall_id>/request_rules --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]' --header 'Content-Type: application/json' --data '{
  "name": "SSL Verification",
  "active": true,
  "criteria": [
    [
      {
        "conditional": "if",
        "variable": "${ssl_verification_status}",
        "operator": "is_equal",
        "argument": "MISSING_CLIENT_CERTIFICATE"
      }
    ]
  ],
  "behaviors": [
    {
      "type": "set_custom_response",
      "attributes": {
        "status_code": 401,
        "content_type": "application/json",
        "content_body": "{}"
      }
    }
  ]
}'

Key	Description
`name`	Name of the rule
`description`	Description of the rule
`behaviors`	Array that stores objects that define behaviors
`criteria`	Array that stores objects that define criteria

Refer to the Azion API documentation for details on all available criteria and behavior objects.

You’ll receive the following response:

{
"results": {
  "name": "SSL Verification",
  "is_active": true,
  "behaviors": [
    {
      "status_code": 401,
      "content_body": "{}",
      "name": "set_custom_response",
      "content_type": "application/json"
    }
  ],
  "criteria": [
    [
      {
        "variable": "ssl_verification_status",
        "operator": "is_equal",
        "conditional": "if",
        "argument": "MISSING_CLIENT_CERTIFICATE"
      }
    ]
  ],
  "last_modified": "2023-11-23T23:54:14.941097Z",
  "last_editor": "your-email@example.com",
  "id": <id>,
  "order": 2
},
"schema_version": 3
}

Wait a few minutes for the changes to propagate.