Which vService types does AGS work with?

Short answer

AGS works only on vServices of the HTTP type; in HTTPS applications, TLS is terminated on the vService and AGS works on the decrypted request. Because showing a login page, reading the session cookie and directing the request by path require HTTP parsing, there is no AGS box in the Details list of L7 TCP and Network vServices. The selection list on the AGS-Enabled vService List screen also contains only HTTP vServices.

How Does It Work?

Every job AGS does relies on the HTTP content of the request:

• Routing: The AGS pages are separated by path (AGS Root Path, default /ags-portal).
• Session: The user's session is carried in an HTTP cookie and is read on every request.
• Login flow: The form, redirect, CAPTCHA and OTP steps are served as HTTP pages.
• Identity propagation: The identity is added to the request to the Backend Service as a header, Basic Auth, a Bearer Token or a cookie (Backend SSO).

An L7 TCP vService terminates the connection but does not parse the application protocol; a Network vService does not terminate the connection at all. Neither of them has the HTTP information these jobs rely on.

Where AGS Is Enabled in TR7

Place	Scope
HTTP vService form → Details → AGS box (over the vService form)	A single vService
AGS-Enabled vService List → HTTP vServices to Protect with AGS (collectively over the list)	Multiple vServices; only vServices that are of the HTTP type and on which AGS has not been enabled yet appear in the list
Application vService in the application card in Portal mode	The application the portal publishes; only HTTP vServices can be selected

Enabling steps: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

Common Misconceptions

• "AGS cannot be used in HTTPS applications." Because TLS is terminated on the HTTP vService, AGS also works in HTTPS applications; the login pages are served with the vService's certificate.
• "A vService with AGS enabled also protects the other vServices on the same IP address." AGS is applied only to the traffic of the vService on which it is enabled; vServices running on a different port of the same IP address are not affected.
• "AGS can also be enabled on a Network vService." For AGS, the application must be published through an HTTP vService.

How it is done in the documentation

• How to Enable AGS? · What Does Enabling AGS Mean?
• How to Enable AGS? · Scope and Limits
• HTTP (L7) vService · AGS
• vService · vService Types

Related questions

• What is AGS - AAM and what does it do?
• What is the difference between the Load Balancer and AGS; where does AGS work within the Load Balancer?
• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?