FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

Can I define advanced notifications based on source IP, country, ASN or subnet (Advanced Notifications)? ​

Short answer

Yes; this feature is not in the Notifications profile of the Load Balancer but in the Notifications cards of the WAF and Bot/DDoS modules. Advanced Notifications is turned on in the Notifications card in the WAF Management or Bot/DDoS Management tab; for each trigger, Scope (Global (all traffic), Source IP, Source subnet, Country, ASN, Network Type Group, Network Type Category, Host header), Count, Window and Threshold are entered, and at most 6 triggers are defined per module. On an HTTP or L7 TCP vService that uses only the Load Balancer, per-source-IP thresholds are defined with the Per-source-IP Thresholds section of the Notifications profile; the country, ASN and subnet scopes are not available there.

Problem: Alerts Cannot Be Received by the Source of the Attack ​

An alert is wanted when the number of attacks or blocks coming from a specific country, ASN or subnet increases; thresholds that look at total counts do not distinguish by source.

Solution: Three Methods ​

WAF and Bot/DDoS triggers count the events of their own modules and can be used together on the same vService; the source IP thresholds in the Load Balancer profile also work without these modules but do not offer a scope option.

Your situationSuitable method
Based on WAF blocks or detectionsMethod 1: WAF → Advanced notifications
Based on Bot/DDoS actions, requests or connectionsMethod 2: Bot/DDoS → Advanced notifications
No WAF or Bot/DDoS; based on the single busiest source IPMethod 3: Notifications profile → Per-source-IP thresholds
  • How it works Each trigger counts the number of WAF blocks or detections over the window for each key in the selected scope (e.g. each country); when the threshold is exceeded, a notification is sent from the channels of the card and the record is written to Notification Logs with the name Advanced WAF Notification.
  • Where it is opened vService screen → WAF Management → Learning & Reporting → Notifications card
  • Requirement HTTP vService with WAF enabled; for e-mail, E-mail Settings (SMTP)
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Enable WAF (if needed)

If WAF is not on for the vService: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

2
Adım 2 Open the edit window

In the WAF Management tab of the vService screen, the pencil icon at the top right of the Notifications card is clicked (Notifications edit screen). The pencil icon appears only for a user with permission to make changes.

3
Adım 3 Define the triggers

Advanced Notifications is turned on (off by default); in the trigger card that comes ready, Scope (default Country), Count (Blocks or Detections; default Blocks), Window (30 seconds–1 hour; default 5 minutes) and Threshold (default 100) are entered. The threshold cannot be below the lower limit set for the selected scope. If Source Subnet is selected, the IPv4 Prefix (default 24) and IPv6 Prefix (default 64) fields appear. With the + (Add Trigger) next to the label, at most 6 triggers are added.

4
Adım 4 Select the channels

In the same window, the E-mail, SMS, SNMP notification and UI notification (on by default) channels are set. E-mail addresses and phone numbers are written to the card's own lists.

5
Adım 5 Save

The Edit button is clicked; there is no separate deployment step.

Verification ​

1Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, the Advanced WAF Notification records are checked (notification types).

ExpectedNotification record and channel result

Method 2: Bot/DDoS → Advanced Notifications ​

  • How it works The triggers count Bot/DDoS actions, detections, requests or connections in the selected scope; the record is written to Notification Logs with the name Advanced Protection Notification.
  • Where it is opened vService screen → Bot/DDoS Management → Notifications card
  • Requirement vService with L7 DDoS & Threat Protection on; for e-mail, E-mail Settings (SMTP)
  • vService type HTTP · L7 TCP (on L7 TCP, the Host header scope and the Requests count do not work)

Step-by-Step Configuration ​

1
Adım 1 Open the vService edit form (if protection is off)

If L7 DDoS & Threat Protection is not on, on the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected (two ways); if protection is on, step 4 is next.

2
Adım 2 Check the protection

L7 DDoS & Threat Protection in the Details panel is checked.

3
Adım 3 Save the vService

The Save button is clicked.

4
Adım 4 Open the edit window

In the Bot/DDoS Management tab of the vService screen, the pencil icon at the top right of the Notifications card is clicked; the Edit - Notifications window opens.

5
Adım 5 Define the triggers

Advanced Notifications is turned on and triggers are added with Scope, Count (Actions taken, Detections (action + monitor), Requests, Connections; default Actions taken), Window and Threshold; at most 6 triggers are defined. In Bot/DDoS, the lower limits vary by scope and count type.

6
Adım 6 Select the channels

The E-mail, SMS, SNMP Notification and UI Notification channels are set.

7
Adım 7 Save

The Edit button is clicked.

Verification ​

1Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, the Advanced Protection Notification records are checked; the Notification Log link at the bottom right of the card also opens the same records.

ExpectedNotification record and channel result

Method 3: Notifications Profile → Per-source-IP Thresholds ​

  • How it works The thresholds look at the per-second connection, request, error or traffic value of the single busiest client and at the number of active source IPs; there are no country, ASN and subnet scopes, and the notification text does not contain the IP address.
  • Where it is openedLoad Balancer → Profiles → Notifications → Per-source-IP Thresholds
  • Requirement For e-mail, E-mail Settings (SMTP)
  • vService type HTTP · L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the Notifications profile

On the Load Balancer → Profiles → Notifications screen, the Add button is clicked for a new profile, or the Edit button for an existing profile.

2
Adım 2 Enter the thresholds and channels

In the Per-source-IP Thresholds section, the Active Source IPs, Connections per Source IP/sec, Requests per Source IP/sec, Errors per Source IP/sec, Incoming traffic per source IP or Outgoing traffic per source IP switches are turned on and values are entered (all off by default); the channels are turned on. Details: Can I get notified when a certificate is about to expire or a performance threshold is exceeded?

3
Adım 3 Save the profile

The Add button is clicked for a new profile, or the Edit button for an existing profile. If the profile is already assigned to the vService, the next steps are skipped.

4
Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

5
Adım 5 Assign the profile to the vService

Notification in the Details panel is checked and the profile is selected. In the Default profile that comes when it is checked, no channel is on.

6
Adım 6 Save

The Save button is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification ​

1Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, the vService statistics records are checked.

ExpectedRequest rate per source IP is high for vService "…": > …

Common Mistakes ​

  • Looking for the scope fields in the Load Balancer Notifications profile. The country, ASN and subnet scopes are only in the WAF and Bot/DDoS cards.
  • Entering a threshold below the lower limit. The form does not accept a threshold below the lower limit set for the selected scope.
  • Expecting more than 6 triggers. In each module, at most 6 triggers are defined per vService.
  • Setting up a Host header or Requests trigger on an L7 TCP vService. In Bot/DDoS, these triggers are saved, but their counters are not formed on L7 TCP.
  • Expecting the IP address in a source IP threshold notification. The source IP notifications in the Load Balancer profile do not contain the address; the address is seen in Live Stats and Logs & Tracking.

How it is done in the documentation

Related questions