# WAF bot\_define

**URL:** <https://community.a10networks.com/t/waf-bot-define/469>\
**Category:** CFW - Convergent Firewall\
**Created:** [September 16, 2017, 10:46am UTC](https://community.a10networks.com/t/waf-bot-define/469 "2017-09-16T10:46:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![huy.tran](https://avatars.discourse-cdn.com/v4/letter/h/5daacb/32.png) [@huy.tran](https://community.a10networks.com/u/huy.tran)\
**Post date:** [September 16, 2017, 10:46am UTC](https://community.a10networks.com/t/waf-bot-define/469/1 "2017-09-16T10:46:46Z")

</div>

```auto
WAF feature block traffic then enable WAF ( Bot-Define):

CEF:0|A10|TH1030S|4.1.1-P3|WAF4|bot-check|6|rt=Sep 15 2017 13:49:40 src=52.220.96.111 spt=62290 dst=10.0.0.220 dpt=443 dhost=uat.api-acledabank.com cs1=UAT-API-ACLEDA cs2=4ce1c66d87d59b2d act=deny cs3=active app=HTTPS requestMethod=POST cn1=0 request=/login msg=User-Agent missing!

```

Help me how to fix it

Thanks

---

<div class="post-metadata">

**Author:** ![hkohn72](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hkohn72](https://community.a10networks.com/u/hkohn72)\
**Post date:** [October 6, 2017, 7:04am UTC](https://community.a10networks.com/t/waf-bot-define/469/2 "2017-10-06T07:04:41Z")

</div>

Hello Tran,

what version of ACOS are you using? ACOS 2.7.X or 4.X.X?  
CU Holger!

---

<div class="post-metadata">

**Author:** ![hkohn72](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hkohn72](https://community.a10networks.com/u/hkohn72)\
**Post date:** [October 6, 2017, 7:05am UTC](https://community.a10networks.com/t/waf-bot-define/469/3 "2017-10-06T07:05:21Z")

</div>

Oh! i see 4.1.1-P3! 😉

---

<div class="post-metadata">

**Author:** ![hkohn72](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hkohn72](https://community.a10networks.com/u/hkohn72)\
**Post date:** [October 6, 2017, 7:10am UTC](https://community.a10networks.com/t/waf-bot-define/469/4 "2017-10-06T07:10:51Z")

</div>

Hello Tran,

are you sure this are regular requests? The client is not sending the User-Agent end therefor the WAF can not identify the bot. If this is a regular request and you know who it is should he send the User-Agent. If this is a regular request and you don’t know who sends it you have to deactivate the bot-check. If this is not a regular request → act=deny 😉

CU Holger!

---

<div class="post-metadata">

**Author:** ![huy.tran](https://avatars.discourse-cdn.com/v4/letter/h/5daacb/32.png) [@huy.tran](https://community.a10networks.com/u/huy.tran)\
**Post date:** [October 6, 2017, 7:31am UTC](https://community.a10networks.com/t/waf-bot-define/469/5 "2017-10-06T07:31:13Z")

</div>

Hi hkohn72,  
The version is 4.1.1 and i don’t know who with the user-agent

Thanks

---

<div class="post-metadata">

**Author:** ![hkohn72](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hkohn72](https://community.a10networks.com/u/hkohn72)\
**Post date:** [October 6, 2017, 8:33am UTC](https://community.a10networks.com/t/waf-bot-define/469/6 "2017-10-06T08:33:20Z")

</div>

Hi Tran,

if now one is moaning about it → act=deny 😉 Then it should be a unregular request because all clients are sending there User-Agent. Also wget or curl.

CU Holger!

---

<div class="post-metadata">

**Author:** ![Clarar](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Clarar](https://community.a10networks.com/u/Clarar)\
**Post date:** [December 19, 2023, 7:50pm UTC](https://community.a10networks.com/t/waf-bot-define/469/7 "2023-12-19T19:50:48Z")

</div>

Addressing potential bot-related issues, it’s crucial to ensure regular requests include the User-Agent for WAF identification. If known, clients should send User-Agent; if unknown, consider deactivating the bot-check. User-Agent data is vital for effective WAF management.