Wallarm Connector for MuleSoft¶

MuleSoft is an integration platform that enables seamless connectivity and data integration between services with an API gateway serving as the entry point for client applications to access APIs. Wallarm can act as a connector to secure APIs running on MuleSoft.

To use Wallarm as a connector for MuleSoft, you need to deploy the Wallarm node externally and apply the Wallarm-provided policy in MuleSoft to route traffic to the Wallarm node for analysis.

The Wallarm connector for MuleSoft supports only in-line traffic analysis:

Use cases¶

Among all supported Wallarm deployment options, this solution is the recommended one for securing APIs deployed on the MuleSoft Enterprise Edition platform with only one policy.

Limitations¶

• Rate limiting by the Wallarm rule is not supported.

• Multitenancy is not supported yet.

Requirements¶

To proceed with the deployment, ensure that you meet the following requirements:

• Understanding of the Mulesoft platform.

• Docker installed and running on your host system.

• Maven (mvn).

• You have been assigned the Mulesoft Exchange contributor's role, enabling you to upload artifacts to your organization's Mulesoft Anypoint Platform account.

• Your Mulesoft Exchange credentials (username and password) are specified in the <MAVEN_DIRECTORY>/conf/settings.xml file.

• Your application and API are linked and running on Mulesoft.

• Access to the account with the Administrator role in Wallarm Console for the US Cloud or EU Cloud.

Deployment¶

1. Deploy a Wallarm node¶

The Wallarm node is a core component of the Wallarm platform that you need to deploy. It inspects incoming traffic, detects malicious activities, and can be configured to mitigate threats.

You can deploy it either hosted by Wallarm or in your own infrastructure, depending on the level of control you require.

2. Obtain and upload the Wallarm policy to Mulesoft Exchange¶

To acquire and upload the Wallarm policy to Mulesoft Exchange, follow these steps:

1. Proceed to Wallarm Console → Security Edge → Connectors → Download code bundle and download a code bundle for your platform.

   If running a self-hosted node, contact sales@wallarm.com to get the code bundle.

2. Extract the policy archive.

3. Within the pom.xml file, specify the following:

   Global instanceRegional instance

   1. Navigate to Mulesoft Anypoint Platform → Access Management → Business Groups → choose your organization → copy its ID.
   2. Specify the copied group ID in the groupId parameter of the pom.xml file:

   <?xml version="1.0" encoding="UTF-8"?>
       <groupId>BUSINESS_GROUP_ID</groupId>
       <artifactId>wallarm</artifactId>
   

   1. Navigate to Mulesoft Anypoint Platform → Access Management → Business Groups → choose your organization → copy its ID.
   2. Specify the copied group ID in the groupId parameter of the pom.xml file.
   3. For Mulesoft instances hosted in specific regions, update the pom.xml file to use the corresponding regional URLs. For example, for a European instance of Mulesoft:

   <?xml version="1.0" encoding="UTF-8"?>
       <groupId>BUSINESS_GROUP_ID</groupId>
       <artifactId>wallarm</artifactId>
   
       <properties>
           <mule.maven.plugin.version>4.1.2</mule.maven.plugin.version>
           <exchange.url>https://maven.eu1.anypoint.mulesoft.com/api/v1/organizations/${project.groupId}/maven</exchange.url>
       </properties>
   
       <distributionManagement>
           <repository>
               <id>anypoint-exchange-v3</id>
               <name>Anypoint Exchange</name>
               <url>https://maven.eu1.anypoint.mulesoft.com/api/v3/organizations/${project.groupId}/maven
               </url>
               <layout>default</layout>
           </repository>
       </distributionManagement>
   
       <repositories>
           <repository>
               <id>anypoint-exchange-v3</id>
               <name>Anypoint Exchange</name>
               <url>https://maven.eu1.anypoint.mulesoft.com/api/v3/maven</url>
               <layout>default</layout>
           </repository>
       </repositories>
   

4. Create the conf directory and a settings.xml file inside it with the following content:

   Username and passwordToken (if MFA is enabled)

   Replace username and password with your actual credentials:

   <?xml version="1.0" encoding="UTF-8"?>
   <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
   <servers>
       <server>
           <id>anypoint-exchange-v3</id>
           <username>myusername</username>
           <password>mypassword</password>
       </server>
       <server>
           <id>mulesoft-releases-ee</id>
           <username>myusername</username>
           <password>mypassword</password>
       </server>
   </servers>
   </settings>
   

   Generate and specify your token in the password parameter:

   <?xml version="1.0" encoding="UTF-8"?>
   <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
   <servers>
       <server>
           <id>anypoint-exchange-v3</id>
           <username>~~~Token~~~</username>
           <password>01234567-89ab-cdef-0123-456789abcdef</password>
       </server>
       <server>
           <id>mulesoft-releases-ee</id>
           <username>~~~Token~~~</username>
           <password>01234567-89ab-cdef-0123-456789abcdef</password>
       </server>
   </servers>
   </settings>
   

5. Deploy the policy to Mulesoft using the following command:

   mvn clean deploy -s conf/settings.xml
   

Your custom policy is now available in your Mulesoft Anypoint Platform Exchange.

3. Attach the Wallarm policy to your API¶

You can attach the Wallarm policy to either all APIs or an individual API.

Attaching the policy to an individual API¶

To secure an individual API with the Wallarm policy, follow these steps:

1. In your Anypoint Platform, navigate to API Manager and select the desired API.

2. Navigate to Policies → Add policy and select the Wallarm policy.

3. Specify an address of the Wallarm node instance including http:// or https://.

4. If necessary, modify other parameters.

5. Apply the policy.

Attaching the policy to all APIs¶

To apply the Wallarm policy to all APIs using Mulesoft's Automated policy option, follow these steps:

1. In your Anypoint Platform, navigate to API Manager → Automated Policies.

2. Click Add automated policy and select the Wallarm policy from Exchange.

3. Specify an address of the Wallarm node instance including http:// or https://.

4. If necessary, modify other parameters.

5. Apply the policy.

Testing¶

To test the functionality of the deployed policy, follow these steps:

1. Send the request with the test Path Traversal attack to your API:

   curl http://<YOUR_APP_DOMAIN>/etc/passwd
   

2. Open Wallarm Console → Attacks section in the US Cloud or EU Cloud and make sure the attack is displayed in the list.

   

   If the Wallarm node mode is set to blocking and the traffic flows in-line, the request will also be blocked.

Troubleshooting¶

If the solution does not perform as expected, refer to the logs of your API by accessing Mulesoft Anypoint Platform → Runtime Manager → your application → Logs.

You can also verify whether the policy is applied to the API by navigating to your API in the API Manager and reviewing the policies applied on the Policies tab. For automated policies, you can use the See covered APIs option to view the APIs covered and the reasons for any exclusions.

Upgrading the policy¶

To upgrade the deployed Wallarm policy to a newer version:

1. Download the updated Wallarm policy and upload it to Mulesoft Exchange, as described in Step 2.

2. Once the new version appears in Exchange, go to API Manager → your API → Policies → Wallarm policy → Edit configuration → Advanced options and choose the new policy version from the dropdown.

3. If the new version introduces additional parameters, provide the necessary values.

   For example, if upgrading from 2.x to 3.x:

   • CLIENT HOST EXPRESSION: use the default value #[attributes.headers['x-forwarded-host']] unless specific changes are needed.
   • CLIENT IP EXPRESSION: use the default value #[attributes.headers['x-forwarded-for']] unless specific changes are needed.

4. Save changes.

If the Wallarm policy is applied as an automated policy, direct upgrades may not be possible. In such cases, remove the current policy and reapply the new version manually.

Policy upgrades may require a Wallarm node upgrade, especially for major version updates. See the Native Node changelog for the self-hosted Node release notes and upgrade instructions or the Edge connector upgrade procedure. Regular node updates are recommended to avoid deprecation and simplify future upgrades.

Uninstalling the policy¶

To uninstall the Wallarm policy, use the Remove policy option in either the automated policy list or the list of policies applied to an individual API.

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send