Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?

Short answer

TR7 WAF works only on vServices of the HTTP type; it cannot be used on L7 TCP and Network vServices. For these types, the WAF option appears neither in the HTTP vServices to WAF list on the WAF-Protected vService List screen nor in the Details list of the vService form. The protection that can be turned on at the application layer on an L7 TCP vService is L7 DDoS & Threat Protection (Bot/DDoS Protection); the traffic of Network vServices is protected with L4 DDoS Protection, which works bound to the route table. If the application is HTTP or HTTPS and WAF is needed, the vService must be of the HTTP type; since the Type field cannot be changed while an existing vService is being edited, a new HTTP vService is created.

How Does It Work?

WAF reads the path, the query, the headers and the body of the request; for this, the traffic needs to be parsed as HTTP. Only the HTTP vService resolves the request at the HTTP level. The L7 TCP vService carries the connection as a TCP stream, and the Network vService distributes the traffic at Layer 3/4; in neither of them is an HTTP request to be inspected formed (WAF in TR7).

vService type	WAF	Other protections that can be turned on at the application layer	Packet and connection layer
HTTP	Yes	L7 DDoS & Threat Protection, AGS	L4 DDoS Protection
L7 TCP	No	L7 DDoS & Threat Protection	L4 DDoS Protection
Network	No	-	L4 DDoS Protection

L4 DDoS Protection is bound not to a vService but to the route table; it is applied to the traffic of all vService types in the same route table.

Enabling WAF in TR7

• Prerequisites: an HTTP vService, the WAF - WAAP license and modify permission: the list path requires modify permission in the WAF area, and the form path modify permission in the Load Balancer area; the WAF box in the form appears disabled if there is no modify permission in the WAF area (scope and limits). If the TR7 WAAP product is not licensed, the protection cannot be turned on.
• The protection is turned on from two places: with Enable on the WAF-Protected vService List screen, or with the WAF box under Details in the vService form (two ways). Steps: How do I enable WAF protection on a vService?
• For HTTPS content to be inspected, TLS must be terminated on the HTTP vService (Can the WAF see the content of HTTPS traffic; what is required for that?).
• All the differences between the types: What are the feature differences between HTTP, L7 TCP and Network vServices?

Common Misconceptions

• "An L7 TCP vService is enough for HTTPS traffic." Even if the L7 TCP vService terminates TLS, it does not parse the request as HTTP, and WAF cannot be used (Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?).
• "The type of an existing vService can be converted to HTTP." The Type field is locked in editing; for WAF, a new HTTP vService is created.

How it is done in the documentation

• How to Enable WAF? · What Does Enabling WAF Mean?
• How to Enable WAF? · Scope and Limits
• vService · vService Types
• L4 DDoS Protection · The Difference from Bot/DDoS and WAF

Related questions

• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• What are the feature differences between HTTP, L7 TCP and Network vServices?
• Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?