Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?
Short answer
The protection unit is the HTTP vService on which the WAF is turned on; the traffic of the vService is split into Virtual Host Groups according to the Host header, and every group has its own WAF Mode (Learning, Monitor, Blocking) and its own Page Types list (basic building blocks). Every rule in the Page types list is the combination of a path pattern and the inspections to be applied to that path; Any Paths is the base rule that handles the requests that match no rule and completes the glob rules that match the path. Check Fields are the inspections a rule applies to the Path, Query, Header, JSON, Xml, Form and Raw sections of the request. A Signature is the counterpart of an attack pattern in a single request section in which it is inspected (signature and pattern distinction); signatures are managed on the Signature & Rule Library and OWASP Rules screens. The OWASP Protection Level is valid vService-wide and determines at which threshold the attack score turns into blocking.
How Does It Work?
The building blocks are nested: vService → Virtual Host Group → Page types rule → Check fields. The request falls first into a group according to its Host header, and then into a rule of that group according to its path; the inspections of the rule and signature scanning are applied to every section of the request (Which stages does a request go through inside TR7 WAF?).
| Building block | Scope | What it determines |
|---|---|---|
| WAF Mode | Virtual Host Group | Learning, Monitor or Blocking. The vService also keeps the default mode of new groups; when the protection is turned on, it is Learning (What are the WAF operating modes?) |
| Virtual Host Group | vService | The requests that match the Virtual Host Patterns. Requests that match no pattern fall into the default group, which cannot be deleted |
| Page Types | Virtual Host Group | Every rule is a path pattern (exact or glob) and the inspections of that path: allowed methods, path length and depth, OWASP scanning (Add) |
| Any Paths | Virtual Host Group | The base rule; it is applied to the requests that match no rule and completes the sections the glob rules do not define. If it is deleted, it is reset to its default values |
| Check Fields | Page types rule | The field, length, size and OWASP settings on the Path, Query, Header, JSON, Xml, Form and Raw tabs |
| Signature | Built-in, global and vService layer (rule layers) | The attack pattern, the section in which it is inspected, its score (2, 4, 6, 8; 9 in three built-in signature rules) and its State (Enabled, Monitor, Disabled) |
| OWASP Protection Level | vService | The blocking threshold: Aggressive 2, Very tight 4 (default), Tight 8, Normal 16, Elementary 24 (What is the OWASP Protection Level; how many levels are there?) |
The other vService-wide settings (Checks, Whitelist & Blacklist, Learning Methods…) are gathered as cards on the WAF Management screen. Short definitions of the concepts: terminology
Common Misconceptions
- "The mode is selected per vService." The WAF Mode is assigned to the Virtual Host Group; in a vService with a single group, this is in practice the mode of the vService. The OWASP Protection Level, on the other hand, is common to all groups.
- "The virtual host group is the same as Virtual hosting in the Load Balancer." Virtual Hosting determines which domain name goes to which vService; the Virtual Host Group, on the other hand, splits the traffic of the same vService into groups for the WAF mode and rules.
- "A signature and a pattern are the same thing." An attack pattern can be searched for in more than one request section; its counterpart in each section is counted as a separate signature (signature and pattern distinction).
How it is done in the documentation
