What is a WAF and what does it do?

Short answer

WAF (Web Application Firewall) is the security layer that opens and examines the HTTP requests coming to a web application at the application layer, before they reach the Backend Service. TR7 WAF inspects the path, the query parameters, the headers and the body (JSON, XML, form, raw) of the request separately; it searches for known attack patterns with signatures and catches the deviations that do not match the request shape the application expects with structural inspections (hybrid security model). Every violation found is added to the attack score of the request; when the score reaches or exceeds the OWASP Protection Level threshold, the request is blocked in Blocking mode. The protection is turned on per vService, works only on HTTP vServices, requires the WAF - WAAP license and, since it starts in Learning mode, does not block any request at the moment it is turned on.

How Does It Work?

WAF stands in front of the application and reads every request before it reaches its target. While a firewall at the network layer looks at the address and the port of the packet, WAF looks at the content of the request: an ordinary form submission and a request carrying SQL injection that come from the same port 443 can be told apart only by reading the content (the difference from the network firewall and IPS/IDS).

In TR7, the inspection is performed after the HTTP vService terminates TLS and before the request is sent to the Backend Service. The flow (how it works):

1. Exempted requests (static content by default) do not enter the inspection.
2. While Blacklist Protection is on (default), the source IP being on the blacklist becomes a violation written to the score.
3. The request is matched with the rules of the Virtual Host Group selected according to the Host header of the request.
4. The path, query, headers and body go through both signature scanning and structural inspections; all violations are collected in a single attack score (violation scores).
5. When the scan finishes, the score is compared with the threshold and the decision is applied according to the mode of the group: in Blocking, the request is blocked; in Monitor, it is recorded and let through; in Learning, it is written to the learning record.

Details of the stages: Which stages does a request go through inside TR7 WAF?

WAF in TR7

Function	Its counterpart in TR7
Signature scanning	Known attack patterns are searched for in every part of the request; the signatures are managed on the Signature & Rule Library screen (Which attacks does TR7 WAF protect against?)
Structural inspection	The path, parameters, headers and body are inspected according to the rules in the Page Types list (What is the difference between the negative security model (signature scanning) and the positive security model?)
Score and decision	Violations are collected in a single attack score and compared with the OWASP Protection Level threshold (How does TR7 WAF decide whether to block a request?)
Learning	In Learning mode, the traffic is recorded; Analysis & Learning produces rule suggestions from these records
Recording and monitoring	Blocked and monitored requests are seen in Event Logs, and summaries in Dashboard

• The protection is turned on not with a single switch across the device but separately for each HTTP vService; when it is turned on, the default Virtual Host Group starts in Learning mode (what enabling WAF means). Steps to turn it on: How do I enable WAF protection on a vService?
• WAF is licensed separately as the WAF - WAAP (TR7 WAAP) product; if the product is not licensed, the protection cannot be turned on.
• WAF inspects requests; it does not inspect responses. To hide sensitive data in the response, the Modify Response Content action of the Load Balancer is used (Can I prevent sensitive data (credit card, national ID number) from leaking out in the response?).

Common Misconceptions

• "When WAF is turned on, attacks are blocked immediately." The protection starts in Learning mode; blocking according to the attack score is performed only in Blocking mode (Does traffic start being blocked as soon as I enable the WAF?).
• "WAF works on all vService types." It works only on HTTP vServices (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?).
• "WAF also stops volumetric attacks and bots." Request volume and bot traffic are within the scope of Bot/DDoS Protection, and packet and connection floods within the scope of the L4 DDoS Protection add-on.

How it is done in the documentation

• WAF - WAAP · What Is WAF - WAAP?
• WAF - WAAP · How Does It Work?
• WAF - WAAP · WAF on TR7
• How to Enable WAF? · What Does Enabling WAF Mean?

Related questions

• How much security does the Load Balancer module provide on its own; when do I need a WAF?
• I already have a network firewall; why would I also need a WAF?
• Which attacks does TR7 WAF protect against?