Skip to content

Smarter by Design.Simpler for Business

TR7Enterprise Application Delivery & Security Platform

Main Navigation Home Getting Started

Getting Started

Load Balancer - ADC

English

English

Appearance

Sidebar Navigation

Getting Started

Glossary

Network Fundamentals

What is an IP address; where are IP addresses defined in TR7?

What is the difference between IPv4 and IPv6?

What is the difference between a private IP and a public IP?

What is a subnet; why does TR7 require the same subnet?

What is CIDR notation (e.g. 10.0.0.0/24)?

What is a port; where are ports set in TR7?

What is TCP; where is it used in TR7?

What is UDP; how does it differ from TCP?

What are ICMP and ping; where are they used in TR7?

What do the L2, L3, L4 and L7 layers mean; why do they appear so often on TR7 screens?

What is NAT; which types exist in TR7?

What is a MAC address; where does it appear in TR7?

What is a Default Gateway?

What is a static route?

What is a VLAN; what is a VLAN interface for in TR7?

What is an interface; what is the difference between a physical (ETH) interface and a virtual interface?

What is the difference between the Up, No Link and Down states of an interface?

What is the difference between bandwidth and packets/s?

What do RX and TX mean?

What do TCP connection states (such as ESTABLISHED and TIME_WAIT) mean?

What is DNAT?

What is ARP; how does it relate to VIP failover and the Spoofing setting in TR7?

What is an IP conflict; how does TR7 check for it?

What is the difference between static routing and dynamic routing?

What is the difference between unicast, multicast and broadcast?

What is MTU; when should I change it in TR7?

What is the difference between Bond and LACP?

What is a bridge interface; why is STP important?

What is the difference between interface errors and drops?

What is VXLAN; how does it differ from VLAN?

In what order do I configure networking when connecting TR7 to a new network (route table, interface, IP, route, firewall)?

High Availability

What is high availability (HA); at which layers is it provided in TR7?

What is failover; when does it happen in TR7?

What is the difference between an active-passive and an active-active cluster?

What is VRRP; how does it provide VIP failover in TR7?

What is a heartbeat; which links serve this role in a TR7 cluster?

What is Gateway Monitoring; how does it affect VIP failover?

HTTP and Web

What is the difference between HTTP and HTTPS?

What are HTTP methods (GET, POST, PUT, DELETE…)?

What is an HTTP status code; what do the 2xx, 3xx, 4xx and 5xx classes describe?

What is an HTTP Header?

What is the Host Header?

What is the User-Agent header?

What is a cookie; what is the difference between the Cookie and Set-Cookie headers?

What is HTTP compression?

What are the parts of a URL (scheme, host, path, query string)?

What is the difference between HTTP/1.1 and HTTP/2?

What are HTTP/3 and QUIC?

What is the difference between the 301, 302, 307 and 308 redirect codes?

What is the Accept-Language header?

What are the Referer header and Referrer-Policy?

What are the Secure, HttpOnly and SameSite cookie attributes?

What is HTTP keep-alive?

What is WebSocket?

What is the difference between GZIP and DEFLATE?

What is a MIME type (Content-Type)?

What is HTTP caching; what does the Cache-Control header do?

What is CORS; what is a preflight (OPTIONS) request for?

What are HTTP security headers?

What is Content-Security-Policy (CSP)?

What is X-Frame-Options?

What is mixed content?

What is gRPC?

What is the difference between a multipart form and a URL-encoded form?

What is X-Content-Type-Options: nosniff?

What is URL percent-encoding?

What is 421 Misdirected Request?

TLS and Certificates

What is the difference between SSL and TLS?

What is an SSL/TLS certificate?

What is a Private Key?

What is a CA (Certificate Authority)?

What is a wildcard certificate?

What is the difference between the TLS versions (TLS 1.0, 1.1, 1.2, 1.3)?

What is the TLS handshake?

What is a cipher suite?

What is SNI (Server Name Indication)?

What is HSTS?

What is mTLS?

What is the difference between RSA and ECDSA keys?

What is a certificate chain?

What is the difference between a root CA and an intermediate CA?

What is a self-signed certificate?

What is a CSR (Certificate Signing Request)?

What are the CN and SAN fields in a certificate?

What is the difference between the PEM and PFX certificate formats?

What is a certificate fingerprint?

What is PKI (Public Key Infrastructure)?

What are the ACME protocol and Let's Encrypt?

What are Perfect Forward Secrecy (PFS) and ECDHE?

What is Post-quantum Key Exchange?

What is ALPN?

What is TLS session resumption?

What are OCSP and OCSP Stapling?

What is certificate revocation?

What is a Trust Anchor?

What is Extended Key Usage (EKU)?

What is AIA (Authority Information Access)?

What is EAB (External Account Binding) in ACME?

What is the difference between renewing a certificate and rekeying it?

What is the difference between STARTTLS and implicit TLS (SMTPS, LDAPS)?

DNS

What is DNS; where is it used in TR7?

What is a DNS zone; how does it relate to a domain and a DNS record?

What is the difference between an A record and an AAAA record?

What is a CNAME record?

What is TTL; on which TR7 screens does it appear, and with what meaning?

What is the difference between an authoritative DNS server and a recursive resolver?

What is an MX record?

What is an NS record?

What is an SOA record; what do its fields mean?

What is a TXT record; how does it differ from the SPF record type?

What is an SRV record?

What are the PTR record and reverse DNS?

What is a CAA record; why does it matter when obtaining certificates with ACME?

What is a wildcard DNS record?

What do the DNS response codes (NOERROR, NXDOMAIN, SERVFAIL, REFUSED) mean?

What is a Zone Transfer (AXFR)?

What are master and slave DNS servers?

What is DNSSEC?

What is DNS NOTIFY?

What is a DS record; why is it submitted to the registrar in DNSSEC?

What are DNSKEY, RRSIG and NSEC records?

What is TSIG?

Authentication and Access

What is the difference between authentication and authorization?

What is LDAP; where is it used in TR7?

What is Active Directory; how does it relate to LDAP?

What is RADIUS; where is it used in TR7?

What is SAML 2.0?

What is the difference between an IdP (Identity Provider) and an SP (Service Provider)?

What is SSO (Single Sign-On)?

What is OAuth 2.0?

What is OpenID Connect (OIDC)?

What is the difference between MFA and 2FA?

What is an OTP (One-Time Password)?

What is TOTP?

What is a session; in which senses is it used in TR7?

What is RBAC (Role-Based Access Control); how is it applied in TR7?

What is the least privilege principle; how is it met in TR7 user management?

What is the difference between LDAP and LDAPS?

What are a DN (Distinguished Name) and a Base DN in LDAP?

What is an LDAP search filter; how is it read?

What is the shared secret in RADIUS and TACACS+?

What is TACACS+; how does it differ from RADIUS?

What is AAA (Authentication, Authorization, Accounting); what is an accounting record for?

What is a SAML assertion?

What is SAML metadata?

What is the difference between an access token and an ID token?

What are the client ID and client secret?

What is an OAuth scope?

What is a JWT (JSON Web Token); where is it used in TR7?

What is a Bearer Token?

What is a RADIUS attribute?

What is identity federation?

What is an issuer; what is the OIDC discovery document (.well-known/openid-configuration) for?

What is a claim; how does it differ from a SAML attribute?

Security and Attack Types

What is a DDoS attack; at which layers does TR7 provide DDoS protection?

What is the difference between L4 DDoS Protection and L7 DDoS Protection?

What is a bot; how is the difference between a good bot and a bad bot handled in TR7?

What is a CAPTCHA; in which protections is it used in TR7?

What is rate limiting; at which layers is it applied in TR7?

What is a brute-force attack; how does TR7 protect the management interface and applications against it?

What is IP Reputation; where does TR7 use IP Reputation data?

What is geolocation data; where does TR7 perform country-based control?

What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?

What is SQL Injection?

What is Cross-Site Scripting (XSS)?

What is a botnet; how does TR7 detect a distributed attack originating from a botnet?

What is a SYN Flood attack; which rules does TR7 apply against it?

What is a UDP Flood; why does TR7 apply a separate flood limit to DNS requests?

What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?

What is a Port Scan; how does TR7 detect a source performing a port scan?

What is a bot score; what do the Clean, Suspicious, Bot and Bad Bot classes mean?

What is a Verified Bot; how does TR7 treat verified search engine crawlers?

What is Waiting Room; how does it differ from an attack enforcement?

What is Quarantine; how does it differ from blocking and where is it used in TR7?

What is the difference between the Standard, Tarpit and Silent Drop blocking types?

What is an ASN; where do I see and use ASN information in TR7?

What is Network Type; how does it differ from IP Reputation?

What is a Tor exit node; how does TR7 recognize Tor traffic?

What is an open proxy; what does TR7 do by default with addresses in this category?

What is the VPN IP category; why doesn't TR7 block VPN addresses by default?

What is the difference between the OWASP Top 10 (Web) and the OWASP API Top 10?

What is CWE; why does it appear in TR7 WAF logs and reports?

What is MITRE ATT&CK; what do the MITRE ATT&CK and MITRE Post-Exploit fields in TR7 show?

What is a zero-day attack?

What is a Directory / Path Traversal attack?

What are LFI and RFI (Local / Remote File Inclusion) attacks?

What is OS Command Injection?

What is SSRF (Server-Side Request Forgery)?

What is Threat State; what do the bands from No Attack to Active Attack describe?

What are SYN Cookies; when do they come into play in TR7?

What is a Smurf attack; what do the Smurf rules in TR7 limit?

What is spoofing; what do the Spoofing, LAND / Self-Spoof and Martians settings in TR7 catch?

What are Null Flood and Christmas Tree Scan; why does TR7 block these packets without false positive risk?

What is a TLS fingerprint (JA3 / JA4); how does TR7 use it in bot detection?

What is CAPEC; how does it differ from CWE?

What is an XXE (XML External Entity) attack?

What is HTTP Request Smuggling?

What is LLM prompt injection?

What is Application DoS; how does it differ from volumetric DDoS?

Monitoring and Integration

What is SNMP; for what purposes is it used in TR7?

What is Syslog; how are TR7 logs forwarded with Syslog?

What is a SIEM; what does sending TR7 logs to a SIEM provide?

What is NTP; why is time synchronization important in TR7?

What is SMTP; with which settings does TR7 send e-mail notifications?

What is an audit log; where are administrator actions recorded in TR7?

What is Notification Management; how do the notification profile, Contact Groups and channels come together?

What is the difference between SNMP Trap and the SNMP agent?

What is an SNMP community?

What is the difference between SNMP v1, v2c and v3?

What is the difference between the RFC 3164 (BSD) and RFC 5424 Syslog formats?

What is CEF (Common Event Format); which TR7 logs can be sent in CEF format?

What is the difference between the JSON, CEF and Plain Text message formats for log forwarding?

What is the difference between the Apache Combined and Apache VHost log formats?

What is Prometheus; how are TR7 metrics exposed to Prometheus?

What is JSONata; where is it used in TR7?

What is a REST API; what does it offer for managing TR7 programmatically?

What is the difference between Log Forwarding and File Forwarding?

What is stratum in NTP; why is it shown in the TR7 Time Info row?

What is IPFIX; which data does TR7 send with IPFIX?

TR7 Product and Interface Concepts

Which products make up TR7; what do ADC, WAAP, AAM and GTM cover?

What is the Left Monitor Panel; which objects does it let me monitor?

What is the Configuration Menu; how does it differ from the Left Monitor Panel?

What is the Header Bar; how do I set up my own layout?

What is the Search Bar; what can I search for?

What is Home & Dashboard; how does it differ from a vService's own Dashboard?

What is WEB-CLI; which command branches does it offer?

What is the difference between the Smart Advisor and Automatic learning modes?

What is Management Access; with which settings does TR7 protect management access?

Where do I change the interface language, theme, font and size for my own account?

Load Balancer - ADC

Fundamentals and Getting Started

What is a load balancer and what does it do?

I only have one server; would I benefit from using TR7 Load Balancer?

What does the TR7 Load Balancer - ADC module cover, and what does it not cover?

What is a vService?

What is a Backend Service?

What is a Backend Group, and how is it different from a Backend Service?

What are Condition and Action, and what are they used for?

What is a Profile, and why is it defined as a separate object?

What is a Health Check, and why is it needed?

What is persistence?

Is a load balancer different from a reverse proxy?

What is the difference between a Proxy and a Reverse Proxy?

Does TR7 Load Balancer require code changes in my application?

What are the most basic steps to set up my first vService?

During setup, should I create the Backend Service or the vService first?

Which stages does a request go through inside TR7 before it reaches the backend?

What is the difference between Load Balancer and GTM; which one should I use?

Can I use Load Balancer and GTM together?

I'm coming from F5, Citrix, Kemp or HAProxy; what are the TR7 equivalents of concepts like virtual server, pool, node, monitor and iRule?

Do I need to change my network topology to add TR7 (one-arm / two-arm / inline)?

What is a Route Table; when do I need to change it for a vService or Backend Service?

When does a change I make take effect; does it go live as soon as I save it?

vService Types and Protocols

How many types of vService does TR7 have, and how do they differ?

Which vService type should I choose for my application?

Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?

Is HTTP/2 supported?

Can I load balance WebSocket traffic?

Can I load balance UDP traffic (DNS, Syslog, NTP)?

What are the feature differences between HTTP, L7 TCP and Network vServices?

What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?

Is HTTP/3 (QUIC) supported; how is it enabled and which conditions does it depend on?

Can I put my gRPC services behind TR7?

Can I load balance SIP/VoIP traffic?

Can I load balance an RDP server farm?

Can I load balance database connections (SQL Server, Oracle, MySQL, PostgreSQL)?

Can I load balance LDAP / Active Directory queries?

Can I load balance SMTP / mail servers?

Are messaging protocols such as MQTT, AMQP and FIX supported?

Can I load balance FTP; what happens to the data channel?

Can the same vService listen on both port 80 and port 443?

Can I define more than one vService on the same IP:port?

What does creating a vService in the Disabled state mean, and when is it used?

What does a vService started in Debug Mode do; why is it only available in the HTTP vService, and what is the downside of leaving it on in production?

Can I change the type of a vService later?

Can I load balance protocols without ports, such as ICMP, GRE and IPsec (ANY - L3)?

Can I make a vService listen on a wide port range (e.g. 4000-5000)?

Frontend, VIP and Virtual Hosting

Which IP address can I use for a vService; what is the difference between an Interface IP and a VIP?

What is a VIP, and when is it needed?

Can I publish more than one website behind a single public IP?

What is Virtual Hosting, and how does it work?

How do I redirect requests for example.com to www.example.com (or the other way around)?

Can I use a VIP without a cluster?

Can I do Virtual Hosting with a wildcard domain (*.example.com)?

In Virtual Hosting, where does a request that matches no host go?

Can I serve different certificates for different domains on the same IP:443 (SNI)?

What is the difference between the HTTP → HTTPS frontend protocol option and the Redirect to HTTPS action?

Can I use an IPv6 address on the frontend?

What do I need to do on the network side first to open a vService on an IP in a different subnet / VLAN?

Why can't I type the Frontend IP manually; what should I do to use an IP that is not in the list (e.g. IPv6) on a vService?

Backend Services and Groups

How is a Backend Service added; which information is required?

When should I use a Backend Group, and when individual Backend Services?

Should I create a Backend Group even if I only have one server?

Can I use one Backend Service in more than one vService?

What do the health colors and icons in the Backend Service list mean?

What is Weight, and how should it be set?

What does Maintenance Mode do?

What is a Backup Service; when does it take over, and when does it step back?

Can I enter a domain name (FQDN) instead of an IP as the Backend Service address?

How do I see which vServices use a Backend Service ("Used in")?

How do I find Backend Services that are not used anywhere (Unused Entries)?

Which settings are shared at group level, and which are per server?

Can I give the servers in a Backend Group their own Weight and connection limit?

What is Connection Limit; what happens to new requests when the limit is reached?

Can the Backend Service port be different from the frontend port (sending a request received on 443 to 8080)?

What does the "Use Frontend Port" option do?

What does the SSL Service option do; what is needed to connect to the backend over an encrypted connection?

Can I export the Backend Services and Backend Groups lists (Export)?

How do I temporarily stop all traffic to a server; can I set Weight to 0?

What do the "Low" and "Standard" cipher options mean for a Backend Service that uses SSL, and which should I choose?

What is the Proxy Protocol setting, and when should it be enabled?

What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?

What is the Cookie Content field used for?

Can my backends be on different networks / in different route tables?

Can my backends be in a different data center or in the cloud?

Can I add many servers in bulk?

If I define more than one Backup Service, is traffic distributed across all of them?

Load Balancing Algorithms

Which load balancing algorithms are supported?

What is the default algorithm?

Which algorithm should I choose; is there a decision guide?

What is the difference between Round Robin and Weighted Round Robin?

When is Least Connection better than Round Robin?

How do I distribute load proportionally across servers with different capacities?

How do Least Response Time and Least Bandwidth work; why do they sometimes behave like Least Connection?

What is the First algorithm used for?

Does the Random algorithm have any practical benefit?

Can the Source algorithm be used instead of persistence?

Which algorithm is recommended for database connections?

What is the RDP Cookie algorithm?

Why is traffic not distributed evenly across the servers?

All users coming from behind a corporate NAT go to a single server; why?

What are the URI, URL Param and HDR algorithms for; in which scenario are they used?

What do the entries marked "(Self-persistent)" in the algorithm list mean?

What does the Hash Consistency option do in hash-based algorithms?

Session Persistence

How do I know whether my application needs persistence?

Which persistence methods are available?

What is the difference between New Cookie and Current Cookie?

How does Hash persistence work?

What is Session Affinity Manager (SAM); how is it different from classic cookie persistence?

Which persistence options are available for an L7 TCP vService?

How does L4 Persistence work on a Network vService; how is the duration set?

Persistence is enabled, but my users still end up on different servers; why?

Persistence is causing uneven load distribution; what can I do?

Can sessions be rebalanced when servers are added or removed?

How is persistence achieved for clients that do not support cookies (mobile apps, API clients)?

Does saving a configuration change reset the persistence tables?

What do Rebalance and Clear All do on the Session Affinity Manager (SAM) tab?

Why does SAM require at least two Backend Services?

Health Check

What does a Health Check do; what happens if I don't assign one?

What is the default health check behavior (Period, Timeout, Required Successes, Required Failures)?

Which health check types are supported?

What is the difference between a TCP port check and an HTTP check; which should I choose?

How many seconds does it take for a server to be considered "down", and how do I calculate it?

How do I expect a specific status code (e.g. 200, 302) in an HTTP health check?

How do I verify a specific text (e.g. "OK") in the response content?

What is "Expect Negative Result" used for?

Can certificate verification be done in an HTTPS health check?

Can I check a different IP/port of the server for the health check (Use Different IP for Health Check)?

Which source IP are health check packets sent from; can I change it?

Which IPs should I allow on the server firewall for health checks?

How should I set the Period, Timeout, Required Successes and Required Failures values?

What are the recommended values for slow-responding services (databases, reporting)?

How do I health check DNS servers?

How do I see the health check history (when a server went down/up)?

What does Enable HC Logs do; should I turn it off?

If I change a health check profile, which Backend Services are affected?

What do users see if all servers are down; can I show a custom page instead?

What kind of /health endpoint should I design in my application for health checks?

How do I health check UDP services other than DNS (UDP scenario, Hex/Base64/text)?

Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?

The server is running, but TR7 shows it as down; why?

The server has failed, but TR7 still sends traffic to it; why?

The health check keeps going back and forth between up/down (flapping); what should I do?

Health check requests are filling up my backend logs; what can I do?

Can I assign more than one health check to a Backend Service?

How many seconds does it take for a health check result to affect traffic?

Can I validate a JSON response field by field in a health check (Content Check Mode: JSONata Expression)?

Can I specify a Host / SNI in a health check (Virtual domain)?

Can I see only status changes in the health check logs (Only Change Logs / All Logs)?

SSL/TLS and Certificates

What is SSL offloading (termination), and how is it set up?

How do I upload my certificate to TR7; which formats are supported?

How do I redirect HTTP to HTTPS?

Can I use a wildcard certificate?

How do I get a warning before a certificate expires?

What is SSL passthrough; when should I use passthrough instead of termination?

What is SSL bridging; how do I also encrypt the traffic to the backend?

How do I choose between termination, passthrough and bridging?

How do I add the intermediate certificate chain?

Can I manage Private Keys separately (Private Key Library)?

Can I create a CSR on TR7?

Can I get certificates automatically with Let's Encrypt / ACME?

Can I attach more than one certificate to a vService; how is the right certificate selected (SNI)?

When I renew a certificate, do I need to replace it on each vService one by one?

What is a TLS Security Profile, and what does it configure?

How do I disable TLS 1.0/1.1; is TLS 1.3 supported?

How do I disable weak ciphers?

How do I add HSTS?

After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?

The browser says "certificate not trusted"; what are the possible causes?

How do I tell if the certificate chain is incomplete?

My backend uses a self-signed certificate; is that a problem?

Which DNS providers are supported for the ACME DNS challenge?

Can I import/export cipher lists?

What should I do to get an A+ from SSL Labs?

Can I authenticate clients with client certificates (mTLS)?

How do I add my own internal CA to TR7?

Can I verify the backend certificate when connecting to the backend over HTTPS?

I need to send SNI when connecting to the backend; how do I set it up?

Is there a difference between TCP + TLS termination on L7 TCP and termination on an HTTP vService?

With passthrough, can I route to different backends based on SNI?

Can I route or block traffic based on TLS version or cipher?

How do I filter certificates that have expired or are about to expire (Expiry Health)?

What does the vService do if the certificate I uploaded has an error?

Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?

What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?

Is OCSP Stapling supported?

Is post-quantum key exchange supported?

Can I reject requests whose SNI and Host Header do not match (domain fronting) (SNI/Host Validation)?

Client IP, SNAT and XFF

Why do my backend servers see all requests as coming from TR7's IP?

What is SNAT, and why is it used by default?

How do I see the real client IP on the backend?

How is X-Forwarded-For enabled; what do I need to do on the backend side (Apache / Nginx / IIS logs)?

What is the difference between X-Forwarded-For and Proxy Protocol?

How do I pass the real client IP for non-HTTP TCP services?

There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?

What is the difference between the "Real IP from" options in the Trusted Proxy profile (X-Forwarded-For (last / most trusted), X-Forwarded-For (first), Custom Header)?

Do TR7 and the backends have to be on the same L2 network?

What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?

Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?

Is it possible to work without SNAT (transparent mode); what are the requirements?

What is Direct Server Return (DSR); what preparation is needed on the server side?

Why does return traffic have to flow through TR7 in Route Mode?

Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?

What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?

Conditions, Actions and Routing

What is the difference between a Condition and an Action?

What is Content Switching?

How do I route to different servers based on the URL path (e.g. /api → API servers)?

Can I route based on the Host Header?

Where does traffic go if no condition matches?

What is the difference between Conditional Backend Services and Default Backend Services?

Can I route based on an HTTP Header, cookie or query parameter?

Can I route clients to a different backend based on their country / city?

Can I send mobile devices to a separate backend?

Can I route based on the browser's language preference?

How do I combine multiple conditions with AND / OR?

Can I use a condition in negated form ("if not")?

In what order do Actions run; how do I change the order?

If an action blocks or redirects traffic, do the subsequent actions run?

What is the difference between On Request and On Response actions?

Why is my Action not triggering?

Can I use the same condition in more than one vService?

When I change a condition or an action, which vServices are affected?

How do I do a canary or blue-green deployment?

Can I route only users coming from the internal network (specific IPs) to a test server?

Can I send only a certain percentage of traffic to a new version?

Can I make decisions based on backend response time or response status code?

What is a Smart Variable; how is it used in conditions and actions?

What are Dynamic Condition and Dynamic List used for?

Can I send a copy of the traffic to a test environment (Traffic Mirroring)?

How do I change the evaluation order of Conditional Backend Services blocks?

Can I see how many times an action has been triggered (hit counter, Action Hits)?

How many Traffic Mirroring actions can I use on a vService at most?

Why doesn't a Location Redirection or User Authentication (On HTTP request) action work if I add it without a condition?

Can I apply different rules per destination IP on a vService published on multiple IP addresses (Destination IP)?

If a vService listens on multiple ports, can I apply a different action or Backend Service per port (Destination Port)?

Can I show different content or route to a different Backend Service based on the client's operating system (Operating System)?

Can I act on the size of the response returned by the Backend Service (Response Size (bytes))?

HTTP Manipulation

How do I redirect a specific URL to another URL with a 301/302?

How do I set up a redirect that adds or removes www?

How do I publish a maintenance page?

Can I show a custom error page when the backend returns 404 or 500?

Can I add, remove or change HTTP Headers in a request or response?

How do I do an SEO-friendly migration from an old domain to a new domain?

Can I rewrite the URL path before it reaches the backend (rewrite)?

What is the difference between Set Path and Set Path + Query?

How do I hide headers that reveal server information, such as Server and X-Powered-By?

Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?

Can I show a custom page for 503/502/504 errors generated by TR7 itself?

On an error, is it better to show a page or to redirect?

What is the Content Pages profile; how do I prepare my own HTML page?

Can I return content directly for certain requests without going to the backend (Show Content)?

How do I make the admin panel accessible only from specific IPs?

Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?

Can I change a header value with a regex?

My backend is sensitive to the letter case of header names; does TR7 change them (Keep Header Names / HTTP 1.0 Header Compatibility)?

Can I modify the response body (e.g. inject a script into HTML, mask national ID / card numbers)?

Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?

Are there ready-made maintenance / error page templates?

Performance and Optimization

Which features does TR7 offer to speed up my application?

Can I do caching on TR7; what are the default settings?

How is compression (GZIP / DEFLATE) enabled; which content types should be compressed?

What do the values in the Timeouts profile (HTTP Keepalive Timeout, HTTP Request Timeout, Connect, Server, Client, Queue, Tunnel(Websocket) Timeout, Client FIN, Server FIN) mean?

What is the vService Limits profile; what are the default limits?

Which content gets cached; how do I define cache rules?

How do I know a response came from the cache (Cached(HIT) Header Name, default value TRCACHE)?

Are the query string and Host Header part of the cache key; can I change this?

How do I prevent user-specific content from being cached by mistake?

Old content is still being served after an application update; what should I do?

What should the Compression Level be; what is its effect on CPU?

Why is the request cut off during long operations (report, file upload); which timeout should I increase?

My WebSocket connections drop after a certain time; what should I do?

What happens when the connection limit is reached?

Can I limit bandwidth (download / upload)?

The site is slow; how do I tell whether the problem is in TR7 or in the backend?

What is Dynamic Caching, and when should it be used?

What does the Offloading option in the Compression profile do?

How do cache and compression work together?

What is HTTP TCP Multiplexing; how does it reduce the number of backend connections?

What should I consider in the Timeouts and vService Limits profiles for Microsoft Exchange (OWA / ActiveSync)?

How does the queue work; how long do requests wait at most?

What is Max. Failed Connection Retries used for?

What is Buffer size used for; when should I change it?

What is QoS; how do I reserve dedicated CPU/memory resources for critical vServices?

What do the Memory Limit, Cores, CPU Priority, Cpu usage limit and Inline Mode settings in QoS do?

Security and Access Control

How much security does the Load Balancer module provide on its own; when do I need a WAF?

Can I block traffic from specific countries?

Can I block specific IPs/CIDRs or allow only them?

How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

Can I block by ASN?

Can I block known malicious IPs (IP Reputation / blacklist category)?

How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?

Can I do rate limiting (X requests per second per IP)?

How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?

How do I see the clients in quarantine?

How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?

Can I verify humans with a CAPTCHA?

Can I block requests that contain debug/test parameters?

I am blocking legitimate users by mistake; how do I find out?

Can I apply rate limiting based on a key such as an API key / token?

Can I take automatic action when the number of requests / connections suddenly increases?

Can I block large requests (e.g. above a certain size)?

Can I look for and block specific content in the request body (JSON / XML / form)?

Can I prevent sensitive data (credit card, national ID number) from leaking out in the response?

How do I see how many times a client has failed Advanced CAPTCHA and how close it is to quarantine?

How do I exempt specific IPs, networks or countries from L4 DDoS protection (Whitelist & Known Peers)?

How do I limit the number of concurrent TCP connections from a single source in L4 DDoS; what does the Zombie TCP setting do?

How do I see sources that were quarantined in the past by L4 DDoS and why (Quarantine History)?

High Availability and Cluster

Is TR7 itself a single point of failure; how do I set up Load Balancer redundantly?

How is a VIP defined after the cluster is set up?

How does a cluster work?

Is the configuration automatically synchronized between cluster members?

What does a status circle split in two mean in the vService list in a cluster?

What is the Master/Slave role on a VIP?

What should I watch out for when taking a device in the cluster into maintenance?

For redundancy across data centers, should I use Load Balancer or GTM?

When a failed device comes back, does the VIP automatically move back to it?

Monitoring, Logging and Reporting

Where do I monitor the current status of my vService?

Which metrics are on the vService dashboard?

What does the Live Stats screen show?

What is the difference between HTTP logs and TCP logs?

Can I get notified when a vService goes down; which channels are available (SNMP, e-mail, SMS)?

How is a report created; which formats are available (HTML, PDF, XLSX)?

Can I see which connections are currently open (vService Sessions)?

What does the Data Flow Panel on the right of the vService screen show?

How do I find out from the logs why a request failed (termination state)?

What does Debug Mode record; how long should I keep it on?

How do I find the requests of a specific client IP in the logs?

How do I send logs to a SIEM (Syslog)?

Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?

Can I receive reports regularly by e-mail?

Can I get notified when a certificate is about to expire or a performance threshold is exceeded?

How long are logs kept on the device?

Can I define my own log format?

How do I reduce log volume (silencing health check and static file logs)?

Can I mask IP addresses in the logs for KVKK / GDPR?

Can I send flow data with IPFIX?

Can I monitor TR7 metrics with Prometheus / Grafana?

What kind of statistics can I collect with Advanced Traffic Inspection?

Can I customize the vService dashboard with templates?

Why can't I see the Report tab?

Can I define advanced notifications based on source IP, country, ASN or subnet (Advanced Notifications)?

What does "Partially Healthy" mean on a Backend Group dashboard; how do I find which server in the group has a problem?

Troubleshooting

Users see "503 Service Unavailable" / "No Available Server"; what should I do?

The vService cannot be reached at all; what should I check step by step?

It works when the backend is accessed directly but not through TR7; why?

The change I made does not seem to take effect; what should I check?

I get 502 Bad Gateway; what are the possible causes?

I get 504 Gateway Timeout; which timeout should I check?

A backend shows as down; how do I diagnose it?

The site became slow behind TR7; where should I start?

I get a certificate error; how do I diagnose it?

Legitimate users are being blocked; how do I find which rule is blocking them?

Traffic is not distributed evenly across the servers; how do I investigate?

The Health Check is "up", but users get errors; why?

An infinite redirect loop occurred; why?

My application keeps sending users back to the login screen (the session is lost); why?

Large file uploads fail; why?

The backend application generates http:// in absolute URLs; how do I fix it?

How do I follow a specific user's problem in live traffic?

Which information should I collect before contacting TR7 support?

Can I capture packets on TR7 and download them as a pcap (tcpdump)?

How do I download the encrypted diagnostic bundle for the support team (Encrypted Support Bundle)?

What does the configuration error(s) warning in the vService preview (DNS Resolution Error, Port binding error) mean; where does Port Collision appear?

How do I test from TR7 whether a server's port is reachable?

How do I check which IP address TR7 resolves a domain name to?

Can I run a load test against a vService or a Backend Service from TR7?

How do I test from TR7 which TLS versions and ciphers a server supports?

Operations and Management

How do I read the entire configuration of a vService on a single screen (Load Balancer Management)?

Which profile types are there; which vService types can they be used with?

What is the difference between temporarily disabling a vService and deleting it?

Can I export lists as Excel, CSV or PDF?

How do I understand the impact of changing a profile before I change it ("Used in")?

Is it right to use the default profiles as they are in production?

How do search, RegExp search and column-based search work on list screens?

Can I back up and restore the configuration?

Can I see who made changes and when?

Can I define users who only have monitoring rights, or who can manage only specific vServices?

What are the naming recommendations when managing many vServices?

Can I manage the Load Balancer configuration via CLI or API?

How are the lb commands grouped in the Web CLI (service, backend, backend-group, hc, certificate, ...)?

How are array / object fields (e.g. listen) entered in the CLI?

Can I enable, disable or delete multiple vServices at the same time?

Can I create a new action, health check or SSL profile without leaving the vService form?

How is a quick search done in the menu and across vServices (Alt+T)?

What does Reload in the right-click menu do; how is it different from Disable / Enable?

Can I restart a vService without interruption (soft / hard restart)?

How do I see the change history of a single vService or Backend Service?

Can I change the same field on multiple objects at once?

How do I make sure a user edits only the vServices assigned to them and does not touch Backend Services and certificates?

How do I expand TR7's data disk on a virtual machine; how do I get a disk I newly added recognized?

I lost access to the management interface (Allowed Networks); how do I restore it from the CLI?

Is it necessary to clear the memory cache (drop caches); when is it done?

WAF - WAAP

Fundamentals

What is a WAF and what does it do?

I already have a network firewall; why would I also need a WAF?

What is the difference between IPS/IDS and a WAF?

My application's code was written securely; is a WAF still necessary?

Which attacks does TR7 WAF protect against?

Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?

Can the WAF see the content of HTTPS traffic; what is required for that?

What is the difference between the negative security model (signature scanning) and the positive security model?

What is TR7's hybrid security model; how do the two models work together?

Which stages does a request go through inside TR7 WAF?

What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?

Which decisions does the WAF make for a request; what do Action in Event Logs and Verdict in Debug Mode Logs mean?

Can TR7 WAF catch a zero-day attack without a signature?

Enablement and Initial Setup

How do I enable WAF protection on a vService?

What is the difference between the two ways of enabling WAF (from the list / from the vService form)?

Does traffic start being blocked as soon as I enable the WAF?

Which default settings are created when WAF is enabled?

What should I do first after enabling the WAF?

How do I remove WAF protection from a vService?

Can I enable or disable WAF on several vServices at once?

If I remove WAF protection, are the learned rules and settings deleted?

How do I deploy the WAF on a live site without risking an outage?

What is the recommended life cycle (Learning → Monitor → Blocking); how long should I stay in each stage?

How do I prepare the WAF for an application that is about to launch, while there is no traffic yet?

Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?

Operating Modes

What are the WAF operating modes?

What does the WAF do in Learning mode; are attacks blocked?

What does the WAF do in Monitor mode?

What does the WAF do in Blocking mode?

In which mode is an Event Logs record created and in which is it not; are attacks below the threshold also logged?

When should I move from Learning to Monitor and from Monitor to Blocking?

Can I use different modes for different domains on the same vService?

What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?

Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?

If the application changes after moving to Blocking, should I go back to Learning mode?

Can a request be blocked with 418 even in Learning or Monitor mode?

Can I enable TR7 WAF directly in Blocking mode without using Learning mode?

Scoring, Threshold and OWASP Protection Level

How does TR7 WAF decide whether to block a request?

What is the attack score and how is it calculated?

What is the OWASP Protection Level; how many levels are there?

What is the default protection level?

Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?

How does tightening the protection level affect false positives?

In which cases is a request not blocked even though an attack is detected (signature in Monitor state, Monitor mode, Teacher, Learning mode)?

Can I set the protection level separately for each domain / host group?

What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?

If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?

Signature and Rule Library

What is a signature?

How many signatures / rules does TR7 WAF have?

Which attack categories do the signatures cover?

Where can I see the rules in the library?

What is the difference between a signature and a pattern; why are "Unique Signature Patterns" and "Total Active Signatures" different numbers?

In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?

Are cookies scanned?

What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?

Can I disable a signature on a single vService only, rather than device-wide?

What does a signature's state (Enabled / Monitor / Disabled) mean?

Can I change a signature's score (Low / Medium / High / Very High)?

How do I add my own custom rule (regex)?

What is the "Inspection Scopes" field for when adding a custom rule?

How do I revert my changes to the default (Restore to Default)?

How do I try a new signature in production without risk (Monitor state)?

How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

What does "Protected Target Types" mean?

What is Recompile and when is it needed?

What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?

How does the protection level affect what the OWASP Rules screen shows?

Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?

If my custom rule fails to compile, does the WAF keep protecting; how do I find out?

If I change a built-in signature's score, state or scan scopes, how do I see the original (Original Rule / Edited Rule)?

Positive Security: Page Types

What is a Page Type?

What is the Any Paths rule?

Where do WAF rules come from (learning analysis, teaching from logs, manual definition)?

How do I add a new page type manually?

What is the difference between an Exact Path and a glob path?

How are glob patterns (*, **) written; how is the path test tool used?

Can I allow only certain HTTP methods on a page (Allowed Methods)?

What are the Path Length and Path Depth constraints for?

If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?

How is a request that matches no page type inspected?

Can I delete the Any Paths rule?

How do I merge several page types into one rule (Merge)?

How are settings (methods, OWASP) combined during a Merge?

Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?

What happens to existing rules when I Import (full replacement)?

Can I generate rules automatically from my OpenAPI / Swagger file?

What does turning OWASP scanning on or off at the Page Type level mean?

What do the Force Merge and Keep Original Rules options do?

How do I reset the rules to the default settings?

Why can't the Any Paths rule be merged with other rules?

Check Fields

What is Check Fields; into which seven parts does the WAF split a request to inspect it?

How do inheritance and "Rule Source" work in rules?

How do I make sure only the query parameters I allow reach a page (Allowed Query Parameters)?

Can I define required parameters (Required Query Parameters / Required Headers / Required Form Fields)?

Can I limit parameter name length and parameter count?

Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?

Can I limit how many times the same parameter may repeat (Value count)?

Can I limit the total header / query size?

Can I require a specific header to be present?

What are the default header rules?

Can I block malformed (unparseable) JSON / XML / form bodies?

Can I forbid JSON or XML bodies entirely on a page (Block All JSON Contents / Block All XML Contents)?

Can I limit JSON / XML nesting depth?

Can I allow only specific keys in JSON; how are nested key paths written?

How are element and attribute paths defined in XML?

Can I allow only certain MIME types in file uploads?

Is the content of uploaded files scanned as well (OWASP Check in Upload)?

Can I turn off OWASP scanning for a specific parameter?

What does the "Detailed Log" option do; is a log written if I turn it off?

What does the Raw tab inspect; what happens to content that cannot be parsed?

What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?

What is Allowed Raw Body Mime Types used for?

What is the Raw inspection order?

Is form data scanned both raw and URL-decoded?

Does the file type check look at the client's Content-Type or at the file's content?

In multipart requests, is the whole body scanned separately as well?

Inspection & Blocking Settings

What does a blocked user see?

Can I change the blocking page?

Why is the 418 status code returned by default on a block; can I change it?

Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?

Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?

What are the ready-made blocking page templates (Turkish, English, JSON)?

Can I show a blocking page based on the visitor's language?

Can I return a JSON blocking response instead of HTML for API clients?

Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?

Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?

What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?

What does the URL Decoding setting affect; are query and form values decoded too?

What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?

What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?

How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?

What is "Wait for body for a time" for?

With "Do not WAF static contents" on, under which condition is a request considered static?

How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?

Is the traffic I whitelist logged at all; where does it appear on the dashboard?

Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?

What is the difference between the vService blacklist and the IP intelligence list?

What is the maximum value of Max. body size to process; how does it relate to the log limit?

Learning: Analysis & Learning, AI Learning, Teacher

How does the WAF "learn" my application?

How long does learning take; how do I know it is finished?

What do Learning Coverage and Learning Discovery Rate mean?

Is my site protected during learning?

What is the learning log; where is it kept?

What is Smart Sampling; how does it affect the learning log?

How do I generate rules from past traffic with Analysis & Learning?

What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?

What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?

How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?

What are the "Only Domains" and "Only Browsers" filters for?

Can I review and edit the analysis result before applying it (Analyze Page Types screen)?

What happens when I apply an analysis result?

Can I run an analysis for several host groups at once (Collective Analysis)?

What is AI Learning and how does it work?

What is Teacher; which sources can I define as Teacher (IP, header, cookie)?

What is the difference between AI Learning and Teacher?

How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?

Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?

How do I see what AI Learning and Teacher applied in the past?

Can I revert a learned rule?

Does changing the Rule Creation Policy change existing rules?

What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?

What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?

What are Dynamic Paths, Excluded Paths and Dynamic Path Exclusions for?

Why are there Min Requests, Min Visitors, Min Ips, Country Limit filters?

When should the "Don't Learn OWASP Exclusions" option be checked?

What is the difference between Conditional Learning and Teacher; when should I use which?

Can an attacker fool AI Learning by making their traffic look widespread; how is this risk reduced?

What is the risk of a wrongly defined Teacher?

What happens if I enter an incorrect format (invalid IP) for the Teacher identity?

What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?

Why is the AI Learning & Teacher Tracking tab not visible?

Can I stop a running analysis; how many analyses can be kept at most?

How long until Teacher traffic becomes a rule; is a single request enough?

Can I define an IPv6 address for Teacher?

Why are rules learned from headers written to the Any Paths rule rather than per page?

False Positive Management

What is a false positive?

How do I tell that a legitimate request was blocked by the WAF?

How do I allow a request that was blocked by mistake?

Which rule changes in the background when I Allow / Teach (Learning Suggestion)?

Should I fix a false positive for a single parameter only or for the whole page?

How do I edit the matching rule from a log with "Edit Corresponding Rule"?

Is it better to disable a signature entirely or to add an OWASP exclusion?

How do I use Monitor mode to weed out false positives?

How is Teacher used to reduce false positives?

How do I make sure a certain user group (e.g. internal network, test team) is never blocked?

How do I fix the same false positive on several vServices at once (global layer)?

How do I find a signature that produces too many false positives?

False positives increased after an application update; what should I do?

How do I assess whether a false positive fix creates a security gap?

Can I blacklist an attacker IP directly from Event Logs (Attacker IP → Actions)?

Can I Allow / Teach several logs at once; are attacks hidden by the filter taught as well?

Virtual Host Groups

What is a Virtual Host Group and what is it for?

What is the default host group?

Can I apply different WAF rules to different domains behind the same vService?

How is a Host Group added; what goes into the Virtual Host Patterns field?

Which host group does a request fall into; what if it matches none?

If I delete a host group, what happens to its rules?

Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?

Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?

How does the quota work when analyzing many host groups collectively?

In which mode does a host group I have just added start?

Can the default host group be deleted?

Which host group does a request without a Host Header fall into?

Monitoring, Logging, Reporting and Notifications

Where do I watch what the WAF is doing?

Which tabs does the WAF Dashboard have (Summary, Attack Analysis, Learning); why is the Learning tab not always visible?

What are Event Logs; which requests are logged?

How do I see the list of blocked requests?

Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?

How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?

What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?

What does the flow diagram on WAF screens (Data Flow Panel) show?

What is monitored for the WAF on the Live Stats screen?

What do the Action values in Event Logs mean?

How are the Severity levels (Blacklist, Structural, Very High … Very Low) determined?

How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?

What do I see in a log record's details (Summary, Attacks, Request & Location)?

Can I see how long a request spent in the WAF (WAF Time)?

Is the request body written to the log?

How do I find a specific request by its Request Unique ID?

Can I receive reports regularly by e-mail; at what times are they sent?

Can I get a single WAF report for the whole device (Global WAF Report)?

Can I receive a notification when the attack count exceeds a certain threshold?

What are the notification channels (UI, e-mail, SMS, SNMP)?

How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?

Can I send only attack records to the SIEM?

How does scope (Global, Source IP, Source Subnet, Country, ASN, Host Header …) work in advanced notifications?

What is the difference between "Blocks" and "Detections" in a notification?

Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?

Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?

How do I stop WAF logs of Health Check or probe traffic (WAF Log Suppression Condition)?

Can I produce a report containing only certain attacks with the report filter?

Can I see the WAF status of all vServices at a glance on the home page?

Where do I see the WAF notifications that were sent (Notification Logs)?

Can I export Event Logs as Excel, CSV or PDF?

Which Event Logs columns are hidden by default; how do I show them?

How long are WAF logs kept?

How do I set the report language and the maximum number of rows in a report?

Can I write advanced filters in Event Logs with AND/OR, NOT, regex and JSONata expressions?

What exactly does the WAF Time value measure?

In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?

Performance and Capacity

Does the WAF slow down my site?

How do I measure the time the WAF adds to a request; for which requests is it visible?

Does latency grow as the number of rules grows?

How do large request bodies (file uploads) affect WAF performance?

What does excluding static content from inspection gain in performance?

How are the disk and CPU load of the learning log kept under control (Smart Sampling)?

How does WAF inspection behave under heavy traffic?

What happens to a request if the scan exceeds a certain time (2-second scan limit)?

Bot/DDoS Protection

What is the difference between the Off, Monitor and Active modes of Bot/DDoS protection; is traffic blocked as soon as I enable it?

How do I move Bot/DDoS protection settings to another vService or device (Export / Import)?

Can I limit the number of connections a single IP address can open (Source IP Connection Protection)?

Can I automatically block a client that generates many 404 and other 4xx errors (directory scanning)?

How do I review and selectively apply the Bot/DDoS learning engine's suggestions; can an applied suggestion be undone?

What is monitored on the Bot/DDoS Live Stats screen?

Can I see the Bot/DDoS events of all vServices on one screen (Global Event Log)?

API and Modern Application Protection

Can I protect my REST APIs with TR7 WAF?

How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?

Can I generate API protection rules automatically from my OpenAPI definition?

Can I apply schema-like checks (key list, depth, length) to JSON-bodied API requests?

Can I protect my SOAP / XML services; is there protection against XXE attacks?

Can I protect my mobile application's backend API?

Is there protection against SSRF and cloud metadata (169.254.169.254) access attempts?

Can it catch prompt injection attacks against my LLM / AI services?

Can I protect GraphQL requests?

Is there protection against HTTP request smuggling and parameter pollution attacks?

Relationship and Integration with Other Products and Add-ons

How does the WAF work together with the Load Balancer?

What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?

What is the order when WAF and AGS are used together?

If there is a CDN / proxy in front of TR7, how does the WAF see the real client IP?

Can I take a different action on the Load Balancer side based on the attack the WAF detected (WAF Attack Signature / Signature Group condition)?

Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?

Where do geolocation and IP reputation data come from and how often are they updated?

Troubleshooting

My users are getting a "418" error; what is happening?

The site is not working after I enabled the WAF; what should I check first?

An attack attempt was not blocked; why?

No records appear in Event Logs; why?

File uploads are being blocked by the WAF; how do I fix it?

Large POST requests are blocked or cut off; why?

JSON requests from my API are blocked by the "Block Invalid JSON Contents" rule; why?

The logs show the proxy / CDN IP instead of the client IP; what should I do?

Learning Coverage has not increased for a long time; why?

AI Learning produces no suggestions; why?

Teacher traffic is not recognized; why?

The analysis produced very few page types / none at all; which filters should I check?

New pages are blocked after I released a new version; what should I do?

Why does a request that received 418 not appear in Event Logs?

I turned off upload scanning but files are still blocked; why?

I see rule 369999 in Debug Mode Logs or SIEM records; what is it?

Operations and Management

Where do I see a vService's whole WAF configuration on one screen (WAF Management)?

Where do I see the list of WAF-protected vServices (WAF-Protected vService List)?

Can I back up my WAF rules?

How do I move the WAF rules I prepared in a test environment to production?

How should I include the WAF in my application release process?

Where do I see the change history of WAF settings?

How is a consistent WAF policy managed across many vServices?

Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?

Can I change the WAF settings or host group mode of several vServices at once?

Can I extract only the WAF rules from an old system backup (Export WAF Rules)?

AGS - AAM

Fundamentals

What is AGS - AAM and what does it do?

What is the difference between the Load Balancer and AGS; where does AGS work within the Load Balancer?

What is the difference between AGS, the WAF and Bot/DDoS protection?

Which vService types does AGS work with?

If I put AGS in front of my application, does the application need code changes?

What are the basic building blocks of AGS?

Where does authentication happen: in TR7, in the application or at the identity provider?

Is AGS an SSO solution; can it be used as an identity provider (IdP)?

What happens to traffic when AGS is enabled on a vService?

Gateway Modes and Access Flow

What is Gateway Mode; what is the difference between Standalone Application, Portal and Portal Application?

What is the Portal; how do users reach several applications with a single sign-in?

What do the Portal Access Mode options (Domain Tunnel, TR7 Application, Private Domain Tunnel) mean?

What is the Flowchart; which step types does an AGS flow consist of?

What is the difference between Decision Point and Switch in the Flowchart?

What do AGS Activation Condition and AGS Root Path determine?

Authentication and MFA

What is an Authentication Provider; which provider types does AGS support?

What is the difference between an Authentication Provider and an authentication server?

What is Local Database; when does it make sense to keep users in TR7?

How is a choice made between the LDAP, RADIUS, SAML 2.0, OAuth2 and OpenID Connect providers?

What are the Web Form, HTTP and Portal providers for?

How does MFA work in AGS; which methods are available?

Sessions and Protection Policies

How is an AGS session kept; what does the Sessions screen show?

What is a Session Protection Policy; what does it protect the session against?

What is an Account Lockout Policy; how does account lockout work?

What are bot protection policies and CAPTCHA in AGS for; how do they differ from Bot/DDoS protection?

How do AGS sessions and settings behave in a cluster?

Backend SSO, Pages and Language

What is Backend SSO; how does AGS pass the user's identity to the application?

What are the login form, page template and dictionary; what determines how AGS pages look?

How does multilingual support work on AGS pages?

Monitoring, Integration and Engine

Which monitoring screens does AGS have; what does each one show?

What are AGS Audit Logs; which events are recorded?

What are log forwarding and notification profiles for in AGS?

What is the AGS engine; what does the Engine screen show?

How is AGS used together with Load Balancer conditions and the WAF?

What does the AGS Management tab show; how are a vService's AGS settings edited from it?

GTM

Fundamentals

What is GTM (Global Traffic Manager) and what does it do?

What is the difference between GTM and the Load Balancer?

How does DNS-based traffic management work; when is the decision made?

What are the basic building blocks of GTM?

I have a single data center; do I need GTM?

Can I use GTM only as an authoritative DNS server?

How are GTM and the Load Balancer used together?

What are the limits of DNS-based routing; how do TTL and the resolver cache affect the decision?

DNS Service and Domains

What is a DNS Service in GTM?

What is a domain in GTM; how does it relate to a DNS Service?

What is the difference between the Standalone, Disaster Recovery and Datacenter modes?

What is the difference between Local and Express record management?

What is an Express Profile; how does it relate to zone transfer?

What is the DNS Forwarder; what happens to queries GTM is not authoritative for?

Records and Distribution

What is a DNS record in GTM; which record types are supported?

Which distribution algorithms are available between several addresses in a record?

What is Topological Selection; how does GTM determine the client's location?

What is fail-safe; what does GTM answer if no address is healthy?

What does a record's TTL determine; how should it be chosen in GTM?

Disaster Recovery and Datacenter

How does the switchover between the primary and backup data centers work in Disaster Recovery mode?

What are the Disaster Recovery conditions; is the switchover automatic or manual?

How is traffic distributed across data centers in Datacenter mode?

What is a Remote Device; how does GTM monitor a remote data center?

What do the Remote Device status values mean?

Health Checks, Scenarios and Triggers

What is a health check in GTM; how does it differ from a Load Balancer health check?

What is a health scenario; how does it combine several checks?

What is a Trigger Action; what does it do in which situations?

How does a Health Check result affect the DNS answer?

Monitoring, Security and Cluster

Which monitoring screens does GTM have; what does each one show?

Can GTM log DNS queries; where are the logs shown?

How does DNSSEC work in GTM?

How does GTM behave in a cluster?

Two forces in balance; Security and Delivery, united at Layer 7.

tr7.com docs.tr7.com LinkedIn YouTube support@tr7.com

© 2026 TR7 Ltd.

On this page

GTM›Monitoring, Security and Cluster

Monitoring, Security and Cluster

GTM monitoring screens, query logs, DNSSEC and cluster behavior.

Which monitoring screens does GTM have; what does each one show?GTM-06-001
Can GTM log DNS queries; where are the logs shown?GTM-06-002
How does DNSSEC work in GTM?GTM-06-003
How does GTM behave in a cluster?GTM-06-004

Pager

Previous questionHow does a Health Check result affect the DNS answer?

Next questionWhich monitoring screens does GTM have; what does each one show?

Products ADC WAAP AAM GTM

Add-ons L7 Reporting Bot/DDoS L4 DDoS

© 2026 TR7 Ltd. All rights reserved.·TR7 Enterprise Application Delivery & Security Platform