We request an enhancement in F5 Distributed Cloud (XC) WAAP/WAF to provide granular File Type control, similar to the File Types functionality available in F5 BIG-IP Advanced WAF.

In the on-premises F5 WAF, security policies can be configured to allow or disallow specific file types/extensions occurring in the ASM Policy/URL , helping restrict unnecessary, sensitive, backup, configuration, executable, or other potentially risky file types.

We require similar functionality in F5 XC WAAP where administrators can centrally:

• Define allowed and disallowed file extensions/file types to Specific App Firewall Policy

• Support global/default controls with application-specific exceptions where required.

• Provide appropriate security event logging when a request is blocked due to a prohibited file type.

• Support monitor/log and blocking/enforcement modes to allow validation before enforcing the control.