What is the difference between the Off, Monitor and Active modes of Bot/DDoS protection; is traffic blocked as soon as I enable it?

Short answer

The three protections in Bot/DDoS protection, L7 DDoS Protection, IP Reputation Protection and Bot Protection, each carry their own mode separately. In Off mode the protection makes no evaluation at all; in Monitor mode the limits are measured, the scores are calculated and the decision to be applied is written to Event Logs in the Would… form, but no request is stopped; in Active mode the rule list and the limits are applied to traffic. When the protection is enabled, L7 DDoS Protection and Bot Protection start in Monitor mode (on an L7 TCP vService, Bot Protection comes Off), while IP Reputation Protection starts Active (starting modes). For this reason, as soon as I enable the protection, traffic from addresses recorded in the reputation lists is quarantined or blocked with 403; the other two protections only monitor.

How Does It Work?

In Bot/DDoS protection there is no single mode switch as in WAF. Each protection carries its own mode, and the three can work in different modes at the same time:

	Off	Monitor	Active
Measurement and score	Not done	Done	Done
Rule and limit decision	Not made	Made, not applied	Made and applied
Request stopping (Block, Show Captcha, Quarantine, Silent Drop…)	No	No	Yes
Event Logs row	Not written for this protection	Orange rows such as Would block · Monitor, Would show CAPTCHA · Monitor	Red rows such as Blocked, CAPTCHA shown
L7 DDoS Hard Ceiling tier	-	Does not work as a separate tier	Applied

Monitor mode is the rehearsal before moving to enforcement: the limits, actions and rule rows are written and kept in this mode too, but none of them is triggered. When the field is focused, the interface puts it as follows: Actions fire only while the pillar is Active — in Monitor everything here stays staged and no traffic is affected.

The strip at the very top of the Bot/DDoS Management screen shows a reading derived from these three modes; it is not a setting (how the state is calculated):

Shown on the strip	Condition
Active (Attack traffic is being blocked.)	At least one protection is in Active mode
Monitoring (No layer is blocking — the layers are only monitoring.)	None is Active, at least one is in Monitor mode
Not Active (This pool has no active threat protection.)	All three protections are Off

The Protecting, Monitoring and Off badges at the top right of the strip count which protection is in which mode.

What Happens When I Enable the Protection?

When the protection is enabled on a vService, the configuration record is created with default values and the three protections start with these modes:

Protection	HTTP vService	L7 TCP vService	Effect on traffic at the moment it is enabled
L7 DDoS Protection	Monitor	Monitor	The limits are measured, no request is stopped
Bot Protection	Monitor	Off	The score is calculated, no request is stopped
IP Reputation Protection	Active	Active	The rule list is applied

The default rule list of IP Reputation Protection has two rows: eight attack categories and the list entered manually by the operator are bound to the Quarantine action, and the other categories except vpnIp are bound to the Block (403) action. On an L7 TCP vService, Silent Drop is written instead of Block. A quarantined address is met with the setting on the Quarantine card (default 30 minutes, Silent Drop). Since Trust Verified Bots is on by default, verified search engine bots are exempted from these rules.

There is one exception that does not stop requests but changes the response: Browser Check (default Suspicious Visitors) also works while Bot Protection is in Monitor mode. A visitor whose score already falls into the suspicious band is presented with a short, silent browser check page before the request continues; nothing is asked of the visitor and the request is not blocked. On a vService where this is not wanted, Browser Check is set to Off.

Waiting Room is outside these three protections; it has its own mode and its default is Off.

Where Is the Mode Changed in TR7?

Bot/DDoS covers the bot management of the TR7 WAAP product and the L7 DDoS Protection add-on (its place in the TR7 product structure). The mode is changed from each protection's own edit window:

1. The Left Monitor Panel is opened, the vService is selected from the Bot/DDoS Protected vServices tab, and the Bot/DDoS Management tab is opened (accessing the screen).
2. The Edit link in the header of the relevant protection band is clicked.
3. In the window that opens, the mode field (DDoS Protection, IP Reputation Protection or Bot Protection) is set to Off, Monitor or Active.
4. The window is saved with the Edit button; there is no separate deployment step, and the configuration is applied without interruption. In a cluster setup, it is also sent to the peer device with the default auto-sync.

Recommended transition order: first, the IP Reputation rows are reviewed in Event Logs with the Blocked and Blocked by quarantine values; then the limits are adjusted by reading the Would… rows of the protections in Monitor mode and Live Stats; finally, the protections are set to Active (what should be done after this). In the default Smart Advisor mode, Learning presents as a suggestion that a monitoring protection is ready to move to Active, but does not change the mode on its own; only in Automatic mode does it enable the ready protections itself. In no mode does learning turn on a protection that has been set to Off.

Common Misconceptions

• "If the strip says Active, all three protections are blocking." A single protection being Active carries the strip to Active. On an HTTP vService that has not been touched at all, the strip reads Active and the badges show Protecting: 1, Monitoring: 2; the only one blocking is IP Reputation Protection.
• "Nothing is recorded in Monitor mode." In Monitor mode, every decision to be applied is written to Event Logs with an orange Would… · Monitor row; the L7 DDoS, Bot and IP Reputation counters also work.
• "Leaving the mode empty means Off." A mode that has never been written is considered Monitor in L7 DDoS and Bot Protection, and Active in IP Reputation Protection. Off is always a manually selected value; the default Off of Bot Protection on an L7 TCP vService is the only exception.
• "A protection in Monitor mode switches to Active on its own when it sees an attack." In the default Smart Advisor learning mode, the transition is only presented as a suggestion and is applied when it is approved; the only case in which the protection is set to Active on its own is learning working in Automatic mode (AI Learning Settings · Learning Mode).

How it is done in the documentation

• Bot/DDoS Protection Mode · How Is the State Calculated?
• Bot/DDoS Protection Mode · The Default Modes
• How to Enable Bot/DDoS Protection? · The Starting Modes of the Three Protections
• L7 DDoS Protection Edit · DDoS Protection
• Event Logs · In Which Situation Is a Log Produced?

Related questions

• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• Can I block known malicious IPs (IP Reputation / blacklist category)?
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?
• How do I review and selectively apply the Bot/DDoS learning engine's suggestions; can an applied suggestion be undone?