What happens to traffic when AGS is enabled on a vService?

Short answer

The moment AGS is enabled, the requests that do not carry a valid AGS session for that vService are directed not to the Backend Service but to the AGS engine of the vService; until the engine is ready, these requests get HTTP 503. In the default flow, the output of the built-in Basic Login form is connected to the Deny step; for this reason, users cannot reach the Backend Service until an Authentication Provider step is added to the flow and connected to Allow. On a vService that carries live traffic, AGS is enabled at a time when the flow can be completed right afterwards, or it is first tried on a vService that takes no traffic.

How Does It Work?

When AGS is enabled, the configuration of the vService is produced again and applied (what is created after it is enabled):

1. The configuration is created: An AGS configuration with the defaults below is written for the vService; if AGS has been enabled and disabled before, the previous configuration comes back exactly.
2. Routing starts: Requests that start with AGS Root Path go to the AGS engine regardless of the session state, and since AGS Activation Condition is undefined, all other requests without a session go to it too.
3. The engine starts: Until the engine is ready, the requests directed to AGS get the HTTP 503 page containing the text Access Gateway is being prepared. Please try again shortly.

Setting	When AGS is enabled
Gateway Mode	Standalone Application
Flow	Start → Form (Basic Login) → Deny; the Allow step is not connected
AGS Activation Condition / AGS Root Path	Undefined (all requests) / /ags-portal
Session Protection Policy	Standard Session Protection: binding to the IP address, an idle time of 8 hours, an absolute time of 7 days
Default Lockout Policies	Default Username Lockout, Default IP Lockout
Bot Protection Policies	Standard Rate Limiting (a threshold of 300 requests in 1 minute per IP, 429), Bot Score CAPTCHA Challenge (threshold 60), Bot Score Deny (threshold 85, 403); they work even if Bot/DDoS Protection is off
Page Template / Dictionary	Default Page Template / Default Dictionary
Backend SSO Config, Notification Profile, Audit Log Forwarders	Not selected

The Effect of AGS in TR7

• What does not change: The IP address, port, certificate, Backend Services, and Algorithm and Persistence settings of the vService stay the same. If WAF and L7 DDoS & Threat Protection are enabled, they also run for the requests without a session.
• The paths of the application: If the Backend Service has a path that starts with /ags-portal, this path can no longer be reached; AGS Root Path is changed (What do AGS Activation Condition and AGS Root Path determine?).
• Monitoring: The status of the engine is monitored on the Engine tab, the login attempts on the Audit Logs tab, the open sessions on the Sessions tab and the instant counters on the Live Stats tab.
• Cluster: The change is also transferred to the peer device with the default auto-sync; each device runs its own AGS engine for the vService (How do AGS sessions and settings behave in a cluster?).
• When AGS is disabled: The flow, mode and policy selections are kept as long as the vService exists; when AGS is enabled again, the same configuration applies (the removal of AGS).

Common Misconceptions

• "Like WAF, AGS also starts in monitoring mode first." AGS has no monitoring mode; the moment it is enabled, the requests without a session are directed to the login flow.
• "When the output of the Form step is connected to Allow, the user is authenticated." The Form step does not verify the identity; if its output is connected directly to Allow, access is granted without the entered credentials being verified. The form is connected to an Authentication Provider step, and the SUCCESS output of that step to Allow (What should be done after this?).
• "The flow can be prepared in advance, before AGS is enabled." The Flowchart and the AGS settings are edited after AGS is enabled; the provider, policy and form profiles, on the other hand, can be defined in advance.

How it is done in the documentation

• How to Enable AGS? · What Is Created After It Is Enabled?
• How to Enable AGS? · What Should Be Done After This?
• How to Enable AGS? · The Removal of AGS
• Flowchart · How Does the Flow Work?

Related questions

• What is AGS - AAM and what does it do?
• What is the Flowchart; which step types does an AGS flow consist of?
• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• What is the AGS engine; what does the Engine screen show?