How much security does the Load Balancer module provide on its own; when do I need a WAF?

Short answer

Load Balancer - ADC provides access control with the rules that are written. With conditions such as Source IP (country, city, address, ASN), Blacklist IP Category or Path, HTTP Header, Query Parameter and HTTP Request Body, it applies Block; Quarantine for the client that exceeds the threshold, Advanced CAPTCHA for human verification, User Authentication (On HTTP request) for Basic Auth, SSL Security for TLS, Manage HTTP Security Headers and Modify Response Content for hiding data in the response are also in this module. However, it does not recognize known attack patterns on its own, does not learn the expected request structure of the application and does not parse the body. When signature scanning against attacks such as SQL injection and XSS, JSON or XML field inspection and a positive model learned from traffic are required, WAF is put into use.

Security Tools of the Load Balancer

Purpose	Equivalent in the interface	vService type
Blocking by source	Source IP (Country, City, Manual, ASN), Blacklist IP Category, Network Type Group / Network Type Category conditions + Block on HTTP, TCP Connection Management on L7 TCP	HTTP · L7 TCP
Blocking by content	Path, Path + Query, HTTP Header, Query Parameter, HTTP Request Body, Request Size (bytes) conditions + Block	HTTP
Threshold and quarantine	Quarantine, Advanced Traffic Inspection + Tracking Condition	HTTP · L7 TCP
Human verification	Advanced CAPTCHA	HTTP
Authentication	User Authentication (On HTTP request) (Basic Auth)	HTTP
Browser security	Manage HTTP Security Headers, HTTP Cookie Security, Cookie Encryption, Redirect to HTTPS	HTTP
Request correction	URL Normalization	HTTP
Hiding data in the response	Modify Response Content → Mask	HTTP
Bot type	Bot Type condition (by User-Agent)	HTTP

All of these tools apply the rule that is written: an attack variant that does not match the condition, an encoded payload or a path for which no rule has been written is not inspected.

What Does WAF Add?

Topic	Load Balancer	WAF
Known attacks (SQLi, XSS, command injection)	The rule is written manually	Ready-made signature library (two security models)
Body inspection	With the HTTP Request Body condition, the first 16384 bytes at most, as raw text (Body Size to Parse(Bytes))	By parsing JSON, XML and form, field by field
Expected request structure	None	Page types and allowed parameters learned from traffic
False positive management	The rule is edited	Allow / Teach from the Event Logs preview
Operating modes	An action either runs or does not run	Learning, Monitor, Blocking
vService type	HTTP · L7 TCP	HTTP only

Situations that require WAF:

• If known web attacks are to be blocked without writing rules.
• If JSON or XML fields, the allowed parameter list and the value format need to be inspected in APIs.
• If the entire request body needs to be parsed and inspected.
• If rules are to be learned from the application's traffic and false positives are to be taught from the records.

For volume, bot and IP reputation protection, L7 DDoS & Threat Protection is used, and for identity and multi-factor authentication, AGS is used; for attacks at the packet and connection layer, there is L4 DDoS Protection, which runs per route table. Product and license distinction: What does the TR7 Load Balancer - ADC module cover, and what does it not cover?

Processing Order

The security modules (AGS, WAF, L7 DDoS & Threat Protection) run before the Load Balancer Actions list; WAF sees the request in the form not changed by the actions (Which stages does a request go through inside TR7 before it reaches the backend?). Binding the modules to a vService: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

Common Misconceptions

• "The Block action replaces WAF." Block catches only the pattern that is written; encoded attack payloads or attack payloads in a different format are caught by the WAF signature library.
• "WAF protects immediately once it is turned on." When WAF is turned on, it starts in Learning mode and does not block requests; blocking starts in Blocking mode.
• "WAF also inspects responses." WAF inspects requests; hiding sensitive data in the response is done with the Load Balancer's Modify Response Content action.

How it is done in the documentation

• HTTP vService · Security
• Actions · 1. Security and Access Control
• What is WAF

Related questions

• What does the TR7 Load Balancer - ADC module cover, and what does it not cover?
• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• Can I look for and block specific content in the request body (JSON / XML / form)?