How do I make sure a certain user group (e.g. internal network, test team) is never blocked?

Short answer

The definitive way is Whitelist Condition: in the Whitelist & Blacklist window, a Source IP condition that defines the addresses of the user group is selected; the requests that match the condition do not enter the WAF inspection at all, are not blocked because of the blacklist or the scan time limit either, are not written to Event Logs and do not take part in the learning. If the inspection is to continue but without blocking, there are two learning identities. The requests that come with the Teacher identity are inspected but are not blocked; the ones that reach the blocking threshold or trigger a signature whose state is Monitor are taught to the rule set at the end of the period; it is suitable only for a trusted test team. The requests that come with the Conditional Learning identity are processed as in the Learning mode, independently of the mode of the host group: they are not blocked, are written to the learning record and do not change the rule set on their own. With these two identities, a request whose scan exceeds the time limit is not blocked either. If the user group uses a separate domain name, that domain name can be kept in the Monitor mode in a separate Virtual Host Group. Frontend Blacklist Exclusions, on the other hand, removes only the blacklist hit; the WAF inspection and the blocking continue.

Problem: The Internal Network or the Test Team Is Blocked

The users in the internal network or the test team must not be blocked by WAF. The options differ in whether the requests continue to be inspected and in their effect on the rule set.

Solution: 4 Methods

Your situation	Suitable method
I want the requests of the user group not to be inspected at all	Method 1: Whitelist Condition
I want them to be inspected, not blocked, and the false positives to be taught to the rule set (test team)	Method 2: Teacher
I want them to be inspected, not blocked, and written to the learning record (for analysis)	Method 3: Conditional Learning
The user group uses a separate domain name	Method 4: Separate Virtual Host Group

Method 1: Whitelist Condition Recommended

• How it works A request that matches the condition is kept entirely outside the WAF inspection (Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?). The setting is vService-wide; it is valid in all the host groups.
• Where it is openedLoad Balancer → Conditions · Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking → Whitelist & Blacklist card
• Requirement Modify permission in the WAF area (also in the Load Balancer area if a condition is to be created); if there is a CDN or proxy in front of TR7, the real client address being resolved with Trusted Proxy
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form (if needed)

If there is no condition for the addresses of the user group yet, the Configuration Menu is opened with the TR7 logo at the bottom left; on the Load Balancer → Conditions screen, Add is clicked.

2

Adım 2 Define the addresses

Criteria = Source IP and Source IP Type = Manual are selected, and the addresses and blocks of the user group are entered (e.g. 198.51.100.0/24).

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Open the Whitelist & Blacklist window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Whitelist & Blacklist card in the Inspection & Blocking section is clicked (Whitelist & Blacklist Edit screen).

5

Adım 5 Bind the condition

The Whitelist Condition switch is turned on, and the condition from step 3 is selected in the condition combiner that appears below it. If the condition field is left empty, the save cannot be made.

6

Adım 6 Save

Edit in the window is clicked. In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

The same setting is also made in WEB-CLI. The condition is created, its ID is taken from the list and written to the setting (WAF scope). --syncWithDefaultFwRules is not a stored setting but a write trigger: only when true is written is the Any Paths rule rebuilt with its default definition; if it is not written in the command, the rule set is not touched. The false in the command states this explicitly (Sync with Default WAF Rules):

lb condition add criteria src_ip srcIpType manual src "198.51.100.0/24" --name ic-ag
lb condition list
waf options update poolId <vService> --syncWithDefaultFwRules false --wafConditionEnabled true --wafCondition "<condition-id>"

Verification

1Whitelist & Blacklist cardTR7 side

The line of the card on the WAF Management tab is checked.

ExpectedRequests matching this condition skips WAF inspection: + condition

2DashboardTR7 side

After requests come from the user group, the WAF Inspection Distribution panel on the Dashboard tab of the vService is checked.

ExpectedThe Whitelisted series increases · no new record from these addresses in Event Logs

Method 2: Teacher

• How it works The requests that come with the Teacher identity are inspected but are not blocked in any mode (a request whose scan exceeds the time limit is also passed); the requests that reach the blocking threshold or trigger a signature whose state is Monitor are written to Event Logs with the Teacher decision and are taught to the rule set at the end of the Teaching Frequency period (How is Teacher used to reduce false positives?).
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement Modify permission in the WAF area; the host group in the Monitor or Blocking mode; a trusted, narrow user group
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Learning Methods window

On the WAF Management tab, the pencil icon at the top right of the Learning Methods card in the Learning & Reporting section is clicked.

2

Adım 2 Turn on Teacher

The Teacher switch at the end of the window is turned on.

3

Adım 3 Enter the identity

The IPv4 addresses of the test team are entered in the Teacher IP field, separated by a space (e.g. 198.51.100.25), or the value of the TR7-LEARN cookie or header is written in the Teacher Cookie / Teacher Header field.

4

Adım 4 Select the period

The processing period is selected from the Teaching Frequency list (e.g. 5 minutes). If None is selected, the requests are not blocked but are not turned into a rule.

5

Adım 5 Save

Edit in the window is clicked.

Verification

1Event LogsTR7 side

In the record of a request of the test team that reaches the blocking threshold, the sentence of the Action icon is checked.

ExpectedNot blocked — Teacher IP matched

Method 3: Conditional Learning

• How it works The requests that come with the identity are processed as in the Learning mode, independently of the mode of the host group: they are not blocked, are not written to Event Logs, are written to the learning record and become the input of the Analysis & Learning run (What is the difference between Conditional Learning and Teacher; when should I use which?). In the Learning mode, the structural inspections do not run.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Learning Methods window

On the WAF Management tab, the pencil icon at the top right of the Learning Methods card is clicked.

2

Adım 2 Turn on Conditional Learning

The Conditional Learning switch is turned on.

3

Adım 3 Enter the identity

The addresses are entered in the Conditional Learning IP field, or the value of the TR7-ANALYZE cookie or header is written in the Conditional Learning Cookie / Conditional Learning Header field.

4

Adım 4 Save

Edit in the window is clicked. When the method is turned off, the identity fields are not deleted automatically, and an identity that remains in the fields continues to match while the switch is off as well. Since the fields are hidden from the form when the switch is turned off and a change in the hidden fields is not saved, when the method is abandoned the fields are emptied with a separate save before the switch is turned off (How are the disk and CPU load of the learning log kept under control (Smart Sampling)?).

Verification

1Learning Methods cardTR7 side

The line of the card on the WAF Management tab is checked.

ExpectedConditional learning is on — the analyst is recognised by IP

The requests that come with the identity are counted in the Learning series of the WAF Inspection Distribution panel on the Dashboard.

Method 4: Separate Virtual Host Group

• How it works Since the host group is selected according to the Host value of the request, the domain name the user group uses is kept in the Monitor mode in a separate group; the requests are inspected and recorded but are not blocked (Can I use different modes for different domains on the same vService?). A distinction by address cannot be made.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups band
• Requirement Modify permission in the WAF area; the user group using a separate domain name (e.g. test.example.com)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the group window

On the WAF Management tab, the new group window is opened with the icon at the top right of the Virtual Host Groups band (How is a Host Group added; what goes into the Virtual Host Patterns field?).

2

Adım 2 Define the group

Virtual Host Group Name is entered, WAF Mode = Monitor Mode is selected and the domain name is written in the Virtual Host Patterns field (e.g. test.example.com).

3

Adım 3 Save

Add is clicked.

Verification

1Event LogsTR7 side

The sentence of the Action icon of a request that comes to the domain name and produces an attack record is checked.

ExpectedNot blocked — Monitor mode

Common Mistakes

• Keeping the whitelist condition wide. Every request that matches the condition passes without inspection; so do the attacks that come from the same addresses.
• Thinking that Frontend Blacklist Exclusions is an exemption. It removes only the blacklist hit; signature and structural violations continue to be blocked (Does "Add to Whitelist (vService)" in Event Logs exempt an IP from WAF inspection, or does it only add a blacklist exclusion?).
• Opening Teacher to the whole internal network. The requests of every client in the internal network that would be blocked are taught to the rule set and the protection loosens (What is the risk of a wrongly defined Teacher?).
• Thinking that the fields are cleared when the identity is turned off. When Teacher or Conditional Learning is turned off, the identity fields are kept; in Conditional Learning, an identity that remains in the fields continues to match while the switch is off as well; the fields are emptied with a separate save before the switch is turned off.
• Defining the proxy address behind a CDN. If the real client address is not resolved, the condition matches the address of the CDN and all the visitors become exempt.

How it is done in the documentation

• Whitelist & Blacklist · Whitelist Condition
• Learning Methods · Conditional Learning
• WAF Mode · The Difference Between WAF Mode and the Learning Methods

Related questions

• Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?
• What is the difference between AI Learning and Teacher?
• What is the difference between Conditional Learning and Teacher; when should I use which?