Configure Support for Akamai Dynamic Site Accelerator

1. Log into Luna Control Center and select the Configure tab.
2. Click the link corresponding to the desired site configuration under Configuration Name.
3. On the next screen, find the currently-active configuration and click Create Version from... in the right-hand column. Make the following changes:

   Table 3: Luna Control Center Configuration Changes

   Configuration Section	Parameter	Value
   Honor HTTP Cache-Control and Expires Headers	Cache Control Headers	false (uncheck)
   Honor HTTP Cache-Control and Expires Headers	HTTP Expires Headers	false (uncheck)
   Browser Cache Control Headers	Pass through the origin's Cache-Control headers to the browser	true (select)
   Browser Cache Control Headers	Pass through all origin cache control headers	true (select)
   Edge Services - General	Enable True Client IP Header	true (check)
   Edge Services - General	True Client IP Header Name	True-Client-IP (or other; see below)
   Edge Services - General	Enable Edge Server Identification	false (uncheck)

   Note: Choosing a name for the True-Client-IP header other than the default can provide additional security by preventing malicious users from spoofing this header. Make a note of the value chosen for the header. You will need to configure it on the WebApp Secure side.

4. After making these changes, scroll to the bottom of the page and activate the new Akamai configuration as you normally would.
5. Once you have verified that your new Akamai configuration has gone live, log into the WebApp Secure Web UI. If you are configuring Akamai support for an application, browse to that application's configuration page. Otherwise, browse to the Content Delivery Network section of the Security Engine configuration (or use the Configuration CLI). Make the following changes:

   Table 4: WebApp Secure Configuration Settings for Akamai Support

   Parameter ID	Parameter Name	Value
   engine.cdn.akamai.enabled	Akamai: Enabled	true
   engine.cdn.akamai.true_client_ip	Akamai: True-Client-IP Header	(value specified in Akamai configuration)
   engine.cdn.akamai.incidents.spoofing.enabled	Akamai: Spoofing Incident Enabled	true or false

6. Set Akamai Enabled to true and True-Client-IP Header to the value that you configured in the Luna Control Center.

   Note: If you want a security incident to be triggered when a client attempts to spoof a request through Akamai, you can enable the Akamai Spoof Attempt incident. This incident carries a severity of Medium and can be incorporated into custom Autoresponse rules.

   Note: If WebApp Secure is configured to function alongside Akamai and a direct request comes in to the web server's backend, a warning will appear in mws.log, indicating "Unexpected direct access to origin server. This could be malicious or it could be origin site maintainers doing checkout." While this could be malicious, it could also be an indication that the site maintainer is doing work directly with the backend. It is always safe to confirm these direct backend requests with the webmaster.

Related Documentation

• Security Engine Configuration