Session Recording

Session recording is a troubleshooting tool that enables you to capture the live traffic i.e. the HTTP requests and HTTP responses from a specified client IP address to an application configured on WAF-As-A-Service. This feature is useful to debug traffic related problems, especially with HTTPS applications.

When configured and started, the Barracuda WAF-as-a-Service enables session recording on all traffic processing instances (Barracuda managed containers or custom containers) that are active for the last 60 seconds and serving traffic to the backend server.

Steps to Configure Session Recording

1. Go to the RESOURCES tab.
2. In the left panel, scroll down and expand TROUBLESHOOTING.
3. Select Session Recording.
4. On the Session Recording page, specify values for the following:
   1. Application: Click the drop-down list and select the application for which you want to capture the sessions.
   2. Client-IP: Specify the client IP address for which you want to enable the requests/responses to be captured. The session recording captures the requests/responses coming from the specified client IP.
   3. Port: Specify the port number associated with the client IP.
   4. Recording Request: Select the checkbox to enable requests to the application to be captured. Set the maximum request size limit to be captured during a session.

   5. Recording Response: Select the checkbox to enable responses to the application to be captured. Set the maximum response size limit to be captured during a session.

      You can capture only requests or responses, or both by enabling/disabling the Recording Request and Recording Response checkboxes. Ensure at least one option is selected before you start the recording.

   6. Number of requests to record: Specify the maximum number of requests to be captured during a session.
   7. Content type to record: Specify the content types that needs to be captured in the requests and/or responses during a session.
   8. Click Start recording. 

After the session recording is stopped, the captured files can be downloaded as follows:

• All files are collected in a ZIP file and the Download option is available in the web interface.
• Custom Container-based deployments: The files are copied to the storage location specified in the environment variables of the deployment definition YAML file. 
  
  

Use a text editor or an XML parser to open the downloaded file and check the request(s) and response(s) from the client and the server respectively.

Session Recording in Custom Containers

For session recording to work with custom container deployments, storage location (AWS S3 or Azure blob) is a mandatory parameter to be specified as a part of the deployment definition YAML file. 

1. Follow the steps mentioned in Deploying WAF-as-a-Service Security Module as a Container on On-Premises Kubernetes Cluster to deploy the custom container.
2. After Step 6. Download the YAML file, edit the YAML file to include the following:
   1. Specify the storage location of the custom container in the respective environment variables:
        TROUBLESHOOTING_STORAGE_TYPE  : "AWS"       
        TROUBLESHOOTING_AWS_ACCESS_KEY_ID : ""
        TROUBLESHOOTING_AWS_SECRET_ACCESS_KEY : "
        TROUBLESHOOTING_AWS_BUCKET : ""
      
        TROUBLESHOOTING_STORAGE_TYPE  : "AZURE"
        TROUBLESHOOTING_AZURE_CONNECTION_STR : ""
        TROUBLESHOOTING_AZURE_CONTAINER_NAME : ""
3. Save and deploy the container.

Storage Environment Variables

To add Azure storage details, specify values for the following environment variables:

TROUBLESHOOTING_STORAGE_TYPE: "AZURE"

• TROUBLESHOOTING_AZURE_CONNECTION_STR: Specify the connection string of the Azure blob storage account.
• TROUBLESHOOTING_AZURE_CONTAINER_NAME: Specify the name of the blob container where you want to upload the session recording files.

To add AWS storage details, specify values for the following environment variables:

TROUBLESHOOTING_STORAGE_TYPE: "AWS"  

• TROUBLESHOOTING_AWS_ACCESS_KEY_ID:  Specify the AWS access key associated with the Identity and Access Management (IAM) user.
• TROUBLESHOOTING_AWS_SECRET_ACCESS_KEY: Specify the AWS secret access key (password) associated with the access key.
• TROUBLESHOOTING_AWS_BUCKET: Specify the name of the S3 bucket on AWS.

Example for Azure Storage Type

Example for AWS Storage Type