Integration Server 10.3 | Integration Server Administrator's Guide | Configuring webMethods Enterprise Gateway | How Enterprise Gateway Works | Enterprise Gateway Rules and Alerts | About Enterprise Gateway Rules
 
About Enterprise Gateway Rules
When a request violates a rule, Enterprise Gateway Server can deny the request, or it can allow the request and send an alert about the violation. This behavior is controlled by two types of Enterprise Gateway rules:
*Denial rules. Enterprise Gateway Server denies the request and sends an alert. The server stops processing the request as soon as it detects a match to a filter and does not consider other filters in the rule or any other rules for this request.
*Alert rules. Enterprise Gateway Server sends an alert about the violation and then continues processing the request. If a rule contains multiple filters, the server checks each filter and sends an alert each time it detects a match. After processing the rule, the server continues to the next rule. If there are no subsequent rules, or if the request does not violate any denial rules, the server allows the request.
Enterprise Gateway Server applies rules in the order in which they are displayed on the Enterprise Gateway Rules screen. Because a violation of a denial rule causes Enterprise Gateway Server to stop processing a request, it is important to prioritize the rules based on the order in which you want them to be evaluated. The server processes denial rules before alert rules.
You can configure an Enterprise Gateway rule to:
*Deny a request and send an alert about the violation.
*Allow a request and send an alert about the violation.
*Apply to all request types or only to SOAP, REST, or INVOKE requests.
*Apply to requests to use services or resources that have a particular name.
*Contain one more filters. If a request matches the condition specified by a filter, the request is in violation of the rule. For rules that contain multiple filters, if a request matches any one filter, the rule is in violation. For example, you can filter requests based on message size, the presence of an OAuth token, or the mobile application and type of device from which the request was sent.
*Contain no filters. Even if you do not specify filters in a rule, you can still use a rule to apply to certain request types or to requests for specific resources. For example, you can deny all SOAP requests.
For instructions on defining Enterprise Gateway rules, see Working with Enterprise Gateway Rules.