I already have a network firewall; why would I also need a WAF?

Short answer

A network firewall looks at the address, the port and the protocol of the packet; for it, an ordinary form submission and a request carrying SQL injection that come to port 443 are the same valid HTTPS traffic. WAF, on the other hand, reads the content of the request (path, query, header, body) after TLS is terminated and decides whether the request will harm the application (the difference from the network firewall and IPS/IDS). In addition, by learning the expected request structure of the application, it also catches deviations that have no signature; doing this with a port and address rule is not possible. The two do not replace each other: the firewall inspects network access, and WAF inspects application content. For volumetric attacks, TR7 also has L4 DDoS Protection and Bot/DDoS Protection.

Comparison

	Network firewall	WAF
Layer	Network and transport (L3/L4)	Application (L7, HTTP)
Information it looks at	Source and destination address, port, protocol	Path, query, header, body
Encrypted traffic	It does not see the content	It sees the content when TLS is terminated on TR7 (Can the WAF see the content of HTTPS traffic; what is required for that?)
What it catches	Unauthorized network access, connection to a closed port, port scanning	SQL injection, XSS, command injection, path traversal, unexpected parameter or method
Application knowledge	None	Learned Page Types (What is the difference between the negative security model (signature scanning) and the positive security model?)

Layers in TR7

• In TR7, network layer rules are handled on the Network → Firewall screen, and application content inspection in WAF; the two work together on the same device.
• WAF does not work before an HTTP request is formed: half-completed handshakes and packet floods are within the scope of the L4 DDoS Protection add-on that works per route table, and request volume and bot traffic within the scope of Bot/DDoS Protection, which is turned on per vService.
• WAF is adjusted at the level of rules and exemptions without touching the source code of the application (why it is needed).

Common Misconceptions

• "If port 443 is open only to HTTPS, the application is safe." The attack is carried inside a valid HTTPS request coming from the allowed port.
• "WAF replaces the firewall." WAF inspects only the requests coming to HTTP vServices; network access rules remain in the firewall.

How it is done in the documentation

• WAF - WAAP · The Difference from the Network Firewall and IPS/IDS
• WAF - WAAP · Why Is It Needed?
• L4 DDoS Protection · The Difference from Bot/DDoS and WAF
• Firewall · What Is Firewall?

Related questions

• What is the difference between IPS/IDS and a WAF?
• What is a WAF and what does it do?
• How much security does the Load Balancer module provide on its own; when do I need a WAF?