Setup Custom Rules and Exceptions | Check Point WAF

What are Custom Rules and Exceptions?

CloudGuard WAF is automatically configured through the wizard and learning mechanisms, which are sufficient in most cases.

Custom Rules and Exceptions allow security administrators to fine-tune behavior when specific traffic should be handled differently — for example, to prevent false positives or adjust enforcement for known traffic patterns.

Creating an Exception

Steps:

1. Go to Monitor->Important Events

2. Right-click a relevant Log (URI, Parameter Name, etc.)

3. Select Add a Custome Rule / Exception

4. Review the exception and click OK and Enforce

5. Go to Policy → Assets

6. Edit an asset and open Custom Rules and Exceptions

7. Click to add new rule

8. Configure conditions and action

9. Click OK and Enforce

Actions

The following action are supported:

• Drop – Block matching traffic

• Skip – Skip inspection of a specific parameter, indicator or Protection Name while continuing to inspect the rest of the request

• Is only relevant to the Web Attacks & IPS Sub practices

• Accept – Allow matching traffic

• Suppress Log – Do not generate logs for matching traffic

Enforcement Order

When a request matches multiple exceptions with different actions, the most restrictive action is applied.

The actions are enforced in the following order (from most to least restrictive):

1. Drop
2. Skip
3. Accept

Suppress Log is evaluated independently and is always applied in addition to the selected enforcement action.

Exception Keys Overview

Some exception keys support the Skip action. See Skip Action Support for details and limitations.

How GEO Location Works in Check Point WAF

The GEO filter lets you control which countries can access your protected assets. When a request arrives, the WAF checks the source IP against your configured list of allowed or blocked countries and acts accordingly.

The WAF collects all IP addresses present in the X-Forwarded-For (XFF) header. It then removes any IPs you have added to the previous hops list in your asset configuration. The remaining IPs are checked against your geo rules.

Your Source Identity setting — including any custom Header Key you configure does not affect how the GEO filter resolves IPs. The GEO filter always reads from XFF, regardless of your Source Identity configuration.

IPS Exceptions Scope Exceptions for requests that are blocked or detected by IPS are evaluated only against the following attributes:

• protectionName – The name of the signature
• hostName – The HTTP host name (if available)
• sourceIP – The client IP address (if available)
• url – The HTTP decoded path (if available)
• sourceIdentifier – The source identifier (if available)

Any additional attributes defined in an exception (for example, HTTP method) are not supported for IPS and are ignored. As a result, a request may still be blocked by IPS even if an exception is defined using unsupported fields.

Skip Action Support

The Skip action allows excluding a specific part of a request from inspection, while continuing to inspect the rest of the traffic for malicious behavior.

Skip is typically used to reduce false positives caused by known parameters or indicators, without weakening overall protection.

How Skip Works

The Skip action excludes a specific matched value from security inspection, while continuing to inspect all other parts of the request.

• Skip applies only to Skip-capable keys ( Parameter Name, Parameter Value, and Indicator, Protection Name), which define what is skipped
• All other keys act as scope or context, limiting when the exception applies
• Only the matched value is skipped — all other request components continue to be inspected.