What is the difference between AGS, the WAF and Bot/DDoS protection?

Short answer

The three modules work on the same HTTP vService but ask different questions: AGS - AAM verifies who the user sending the request is, WAF looks at whether the content of the request is malicious, and Bot/DDoS Protection measures the volume and the source of the request and the behavior of the client. None of them takes the place of another: the requests of a logged-in user are also inspected in WAF, and WAF does not stop a user whose identity has not been verified. When they are enabled together, the login pages of AGS (under AGS Root Path) are kept out of the WAF scan; automated traffic coming to these pages is answered by AGS's own Bot Protection Policies.

How Does It Work?

The same request is looked at from three angles (the difference from WAF and Bot/DDoS):

1. Bot/DDoS Protection evaluates the source and the frequency: L7 DDoS Protection measures the volume, IP Reputation Protection the reputation of the source, and Bot Protection the behavior of the client.
2. AGS looks at whether there is a valid session in the request; if there is no session, it takes the request into the login flow.
3. WAF scans the content of the request; it does not ask who the user is.

When all three are enabled, the bot score is calculated first, then the AGS session is determined, and the WAF scan is performed last (What is the order when WAF and AGS are used together?).

Comparison

	AGS - AAM	WAF	Bot/DDoS Protection
The question it asks	Who is this user, and can they access?	Is the content of the request malicious?	How many requests are coming, from where and from which client?
What it looks at	Session, login credentials, second factor	Path, query, header and body	Request and connection counters, IP reputation, client behavior
What it typically catches	Access without a session, password attempts	SQL injection, XSS, path traversal	Request flood, scraper, botnet
vService type	HTTP	HTTP	HTTP and L7 TCP

The Three Modules Together in TR7

• Login pages outside WAF: The login, OTP and CAPTCHA requests under AGS Root Path carry passwords and codes, so they do not enter the WAF scan or WAF learning. Requests on other paths are inspected in WAF, whether they have a session or not.
• The bot score is also used in AGS: On an AGS-enabled vService, the bot score is calculated even if Bot/DDoS Protection is off; the AGS policies with the Bot Score trigger (e.g. the default Bot Score CAPTCHA Challenge and Bot Score Deny) use this score. The bot score of a user whose session has been verified receives a trust discount.
• Scope: The bot policies of AGS work only on requests directed to the AGS engine; volume and bot protection for the application traffic is provided by Bot/DDoS Protection (What are bot protection policies and CAPTCHA in AGS for; how do they differ from Bot/DDoS protection?).
• Enabling: All three are enabled with separate boxes in the Details list of the vService form (How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?).

Common Misconceptions

• "A logged-in user does not need WAF." Even a user whose identity has been verified can send a malicious request; the user's requests are fully inspected in WAF.
• "WAF stops a user who has not logged in." WAF looks at the content and does not ask for an identity; binding access to identity is the job of AGS.
• "The bot policies of AGS take the place of Bot/DDoS Protection." Bot Protection Policies cover only the requests directed to the AGS engine; for the application's own traffic, Bot/DDoS Protection is enabled.

How it is done in the documentation

• AGS - AAM · The Difference from WAF and Bot/DDoS
• Bot/DDoS Protection · The Difference from WAF
• WAF - WAAP · What Is WAF - WAAP?
• Flowchart · AGS Root Path

Related questions

• What is the order when WAF and AGS are used together?
• What are bot protection policies and CAPTCHA in AGS for; how do they differ from Bot/DDoS protection?
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?
• What is the difference between the Load Balancer and AGS; where does AGS work within the Load Balancer?