How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

Short answer

In the vService edit form, Details is opened; the WAF, L7 DDoS & Threat Protection and AGS boxes are checked and saved with Save. For multiple vServices, the Enable button in the modules' own lists is used (WAF-Protected vService List, Bot/DDoS Protected vService List, AGS-Enabled vService List). WAF and AGS exist only on HTTP vServices, while L7 DDoS & Threat Protection exists on HTTP and L7 TCP vServices. The boxes only turn the module on and off; the settings are on the module's own management screen, and each module is turned on with its own starting mode: WAF in Learning mode, while AGS starts with the default flow that stops access until the sign-in flow is edited.

Problem: Security Modules Do Not Work on the vService

Even if WAF, Bot/DDoS or AGS is licensed, it is not applied to the traffic of a vService unless it is enabled on that vService. It must be known from which screen the modules are turned on, on which vService types they can be used and in which mode they work after they are turned on. The modules run before the Actions list of the vService (Which stages does a request go through inside TR7 before it reaches the backend?).

Solution: Three Methods

All three methods change the same switches; one of them is chosen.

Your situation	Suitable method
A single vService	Method 1: vService form → Details
Turning on multiple vServices at once	Method 2: Module lists → Enable
From the command line	Method 3: WEB-CLI

Method 1: vService Form → Details Recommended

• How it works When the module boxes in the Details section of the vService are checked, the module is turned on for that vService. The boxes do not open a settings section; the settings are on the module's own management screen.
• Where it is openedLoad Balancer → Load Balancer vService List → vService → Edit → Details
• Requirement The license of the related module (otherwise the box appears inactive); WAF edit permission for the WAF box
• vService type WAF, AGS: HTTP · L7 DDoS & Threat Protection: HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Prepare the AGS flow (if AGS will be turned on)

When AGS is turned on, the vService starts as a Standalone Application, and the default flow stops the user with Deny after the sign-in form; until the flow is edited, users cannot reach the Backend Service (what happens after it is enabled). On a live service, the flow and the authentication method are prepared before AGS is turned on.

2

Adım 2 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

Shortcut

The same switches are also opened with the Edit link of the Security Modules heading on the Left Monitor Panel → vService → Load Balancer Management tab; the form comes as a window reduced to this section (Edit link).

3

Adım 3 Check the boxes

In the Details section, the required ones among the WAF, L7 DDoS & Threat Protection and AGS boxes are checked (WAF, Bot/DDoS, AGS). On an L7 TCP vService, only the L7 DDoS & Threat Protection box exists.

4

Adım 4 Save

Save is clicked; the module takes effect without a separate deployment step. In a cluster setup, the change is also sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Security modulesTR7 side

The Security modules cards are checked on the Left Monitor Panel → vService → Load Balancer Management tab.

ExpectedWAF: Learning mode · Bot/DDoS: Enabled · AGS: Enabled

The WAF badge shows the dominant mode of the host groups. The Bot/DDoS badge becomes Enabled if at least one protection is blocking; since IP Reputation Protection starts as Active, it appears as Enabled on the first activation.

2Module listsTR7 side

The WAF-Protected vServices, Bot/DDoS Protected vServices or AGS-Enabled vServices tab in the Left Monitor Panel is checked.

ExpectedvService in the related list

Method 2: Module Lists → Enable

• How it works The Enable button in the vService list of each module adds multiple vServices to the module at once.
• Where it is opened Configuration Menu → WAF / Bot/DDoS / AGS → vService list → Enable
• Requirement The license of the related module
• vService type WAF, AGS: HTTP · Bot/DDoS: HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the vService list of the module

In the Configuration Menu, WAF → WAF-Protected vService List, Bot/DDoS → Bot/DDoS Protected vService List or AGS → AGS-Enabled vService List is opened.

2

Adım 2 Open the Enable form

The Enable button above the list is clicked.

3

Adım 3 Select the vServices

The vServices are selected in the HTTP vServices to WAF field for WAF, in the vServices to Protect with Bot/DDoS field for Bot/DDoS and in the HTTP vServices to Protect with AGS field for AGS (WAF, Bot/DDoS, AGS). Network vServices also appear in the Bot/DDoS list, but the protection does not work on this type.

4

Adım 4 Confirm

Add is clicked. As long as no vService is selected, the "At least 1 must be selected" warning appears below the field and Add stays inactive.

Verification

1ListTR7 side

The vService list of the module is checked.

ExpectedThe selected vServices are in the list

Method 3: WEB-CLI

• How it works In the lb service update command, the module switches are set to true (protection and processing switches).
• Where it is openedWEB-CLI → lb service update
• Requirement WEB-CLI access; the license of the related module
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Run the command

On an HTTP vService, the three modules are turned on together:

lb service update id <vService> --waf true --threatProtection true --ags true

On an L7 TCP vService, only L7 DDoS & Threat Protection can be turned on; --waf and --ags are not accepted on this type:

lb service update id <vService> --threatProtection true

To turn it off, the same switch is set to false.

Verification

1RecordTR7 side

The vService record is displayed.

Command: lb service show <vService>

ExpectedThe waf, threatProtection and ags lines are true

In the interface, the same status appears in the Security modules cards.

Common Mistakes

Turning on AGS without preparing the flow

The default flow of AGS stops access with Deny after the sign-in form; on a live service, users cannot reach the Backend Service. The flow is prepared first (what happens after it is enabled).

• Turning on WAF and leaving it in Learning mode. WAF starts in Learning mode and does not block requests; for protection, it is then switched to Monitor and Blocking mode.
• Not knowing the starting modes of Bot/DDoS. L7 DDoS Protection starts in Monitor, and Bot Protection starts in Monitor on HTTP (Off on L7 TCP); IP Reputation Protection, on the other hand, starts in Active and can block from the first moment (starting modes).
• Looking for WAF or AGS on an L7 TCP vService. These two modules exist only on HTTP vServices.
• Checking the box and assuming that the settings are also done. The boxes only turn the module on; the rules are edited on the management screen of the module (WAF Management, Bot/DDoS Management, AGS flow).

How it is done in the documentation

• HTTP vService · WAF
• How to Enable WAF · Two Ways
• How to Enable Bot/DDoS Protection? · The Starting Modes of the Three Protections
• How to Enable AGS · What Is Created After It Is Enabled?
• Load Balancer Management · Security Modules

Related questions

• How much security does the Load Balancer module provide on its own; when do I need a WAF?
• Which stages does a request go through inside TR7 before it reaches the backend?
• I am blocking legitimate users by mistake; how do I find out?