WAF rule triggered with the following error message- ModSecurity: XML parser error: XML: Failed parsing document

WAF rule is been triggered with the following WAF error message- ModSecurity: XML parser error: XML: Failed parsing document

Product: LoadMaster, ECS Connection Manager

Version: 7.2.57

Platform: Any

Application: Web Based Application

The Web application is not functioning correctly. WAF rule is been triggered with the following WAF error message- ModSecurity: XML parser error: XML: Failed parsing document

There is two options to resolved this issue:-

Disable the Inspect HTTP POST Request Bodies-

1. WUI -> Virtual Services -> View/Modify Services -> WAF Options -> Web Application Firewall -> WAF Advanced Configuration -> Inspect HTTP POST Request Bodies -> Disable
2. Once disabled, all xml requests will pass through and application will start function correctly

Create a custom rule to bypass this function-

1. Open a notepad and ensert the following values
2. SecRule REMOTE_ADDR "@ipMatch 192.1.1.101" \ id:101,phase:1,t:none,nolog,pass,ctl:ruleEngine=off
3. IP Address 192.1.1.101 is the source IP address of the Client
4. Save file as a .conf extension
5. Once created, upload rule WUI -> Web Application Firewall -> Custom Rules -> Legacy Custom Rules -> Add Custom Ruleset
6. Once Added, add WAF rue to Virtual Service, Virtual Services -> View/Modify Services -> WAF Options -> Web Application Firewall -> Manage Rules -> Custom Rules -> Select Custom Rule -> Apply
7. Once rule is applied, all xml requests will pass through and application will start function correctly.

https://support.kemptechnologies.com/hc/en-us/articles/210399183-WAF-Rule-Writing-Guide

https://support.kemptechnologies.com/hc/en-us/articles/203128369-Web-Application-Firewall-WAF-

https://support.kemptechnologies.com/hc/en-us/articles/207523516-How-to-disable-or-remove-a-Specific-WAF-Rule