How do I enable WAF protection on a vService?

Short answer

WAF is enabled separately for each HTTP vService (what enabling WAF means) and requires the WAF - WAAP license. For multiple vServices, Enable is clicked on the WAF-Protected vService List screen, and the vServices are selected in the HTTP vServices to WAF field and confirmed with Add; for a single vService, the Details → WAF box is checked in the vService form and Save is clicked. The same switch is also turned on from the Edit window of the Security Modules section on the Load Balancer Management tab and with the --waf true field of the lb service update command in WEB-CLI. The protection starts in Learning Mode and does not block requests by a WAF decision; the settings are made on the WAF Management tab.

Problem: The HTTP vService Runs Without WAF Protection

Even if the device's license includes WAF - WAAP, the protection is not turned on with a single switch across the device: unless it is enabled on a vService, that vService's traffic does not enter the WAF inspection (what enabling WAF means). The protection can be turned on only on a vService of the HTTP type; on L7 TCP and Network vServices, the WAF option is not displayed (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?).

Solution: Four Methods

All four methods change the same WAF switch in the vService record and create the same defaults (Which default settings are created when WAF is enabled?); one of them is selected.

Your situation	Suitable method
Taking multiple HTTP vServices under protection in a single operation	Method 1: WAF-Protected vService List
A single vService or a newly set up vService	Method 2: vService form → Details
From the vService's Load Balancer Management tab	Method 3: Security modules
From the command line	Method 4: WEB-CLI

Method 1: WAF-Protected vService List Recommended

• How it works With Enable on the WAF-Protected vService List screen, WAF is turned on in a single operation on all the selected HTTP vServices. The selection list contains only HTTP vServices whose WAF is off; stopped vServices are also listed.
• Where it is opened Configuration Menu → WAF → WAF-Protected vService List → Enable
• RequirementWAF - WAAP license; modify permission in the WAF area (scope and limits)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the prerequisites

The vService to be protected must be of the HTTP type; if it is not, a vService of the HTTP type is created first (During setup, should I create the Backend Service or the vService first?). For the content of HTTPS traffic to be inspected, TLS must be terminated on this vService (Can the WAF see the content of HTTPS traffic; what is required for that?). If there is a CDN or proxy in front of TR7, a Trusted Proxy profile is assigned to the vService; otherwise, WAF sees all requests as coming from the proxy's address (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?).

2

Adım 2 Open the list

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → WAF-Protected vService List is selected (how to access).

3

Adım 3 Open the Enable tab

Enable on the toolbar is clicked; a tab titled Add opens next to the list.

4

Adım 4 Select the vServices

The vServices to be protected are selected in the HTTP vServices to WAF field. While there is no selection, the field says Nothing chosen and the At least 1 must be selected warning appears below it. There is no upper limit on the number of vServices that can be selected.

5

Adım 5 Save

Add at the bottom of the tab is clicked; the tab closes and the selected vServices appear in the list. The change is applied without a separate deployment step and without dropping open connections (what is created after it is enabled). In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually. If the license does not include the WAF - WAAP product, the operation is rejected with the The license does not include this module: WAF error.

Verification

1ListTR7 side

On the WAF-Protected vService List screen, the WAF mode and OWASP Protection Level columns of the vService row are checked.

ExpectedWAF mode: 1 Learning · OWASP protection level: Very tight

Right after it is turned on, the WAF mode cell can appear empty for a short time and the OWASP Protection Level cell as Undefined; the values appear once the configuration record is created. A vService whose WAF was previously on and then turned off returns with its saved mode.

Method 2: vService Form → Details

• How it works The WAF box in the Details list of the vService form is written to the vService record together with the other changes in the form. The box does not open a separate settings section; all WAF settings are on the WAF Management tab.
• Where it is openedLoad Balancer → Load Balancer vService List → vService → Edit → Details
• RequirementWAF - WAAP license; modify permission in the Load Balancer and WAF areas
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the prerequisites

The vService must be of the HTTP type; for HTTPS content, TLS is terminated on this vService, and if there is a CDN or proxy in front of TR7, a Trusted Proxy profile is assigned (this can be done in the same form; There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?).

2

Adım 2 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected (Way 2). The protection can also be turned on from the same form while a new vService is being set up (Add).

3

Adım 3 Open the Details list

Details in the top right corner of the form is clicked; a list carrying options such as Debug, WAF and Trusted Proxy opens on the right.

4

Adım 4 Check the WAF box

The WAF box right below the Debug row is checked. If the license does not include the WAF - WAAP product or the user does not have modify permission in the WAF area, the box appears disabled.

5

Adım 5 Save

Save is clicked; the change is applied without a separate deployment step and without dropping open connections. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1WAF ManagementTR7 side

The mode card on the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab is checked.

ExpectedBlue Learning mode card

Method 3: Security Modules

• How it works The Edit link of the Security Modules section on the Load Balancer Management tab opens the vService form as a window reduced to only the WAF, AGS and L7 DDoS & Threat Protection boxes (Edit link).
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → Load Balancer Management → Security Modules → Edit
• RequirementWAF - WAAP license; modify permission in the Load Balancer and WAF areas
• vService type HTTP (the WAF card is not displayed on an L7 TCP or Network vService)

Step-by-Step Configuration

1

Adım 1 Open the Load Balancer Management tab

In the Left Monitor Panel, the vService is clicked in the Load Balancer vServices category and the Load Balancer Management tab is opened (accessing the screen).

2

Adım 2 Open the Security modules window

Edit in the Security Modules section header is clicked; the window carrying the WAF, AGS and L7 DDoS & Threat Protection boxes opens.

3

Adım 3 Check the WAF box

The WAF box is checked.

4

Adım 4 Save

Save at the bottom of the window is clicked; the change is applied without a separate deployment step. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1WAF cardTR7 side

The badge of the WAF card in the Security modules section is checked.

ExpectedLearning mode

The badge shows the dominant mode of the host groups; the Management link under the card opens the WAF Management tab.

Method 4: WEB-CLI

• How it works The waf field of the vService record is set to true (protection and processing switches).
• Where it is openedWEB-CLI → lb service update
• Requirement WEB-CLI access; WAF - WAAP license
• vService type HTTP (the --waf field exists only on an HTTP vService)

Step-by-Step Configuration

1

Adım 1 Turn on WAF

In place of <vService>, the ID of the vService is written (REST API):

lb service update id <vService> --waf true

For multiple vServices, the bulk update is used; vService IDs are written to the --ids.N fields, and if no ID is given, a selection list opens; in every case, the command writes the number of records to be affected and makes no change until the confirmation word is written (bulk update):

lb service update-many target selected --ids.0 <vService-1> --ids.1 <vService-2> --waf true

Verification

1vService recordTR7 side

The vService record is displayed.

Command: lb service show <vService>

Expectedtrue in the waf row

The vService also appears on the WAF-Protected vService List screen.

Common Mistakes

• Looking for WAF on an L7 TCP or Network vService. The WAF box and the HTTP vServices to WAF list cover only HTTP vServices (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?).
• Enabling WAF and leaving it in Learning mode. Learning Mode does not provide protection; after learning, Monitor mode and Blocking mode are switched to (What should I do first after enabling the WAF?).
• Assuming HTTPS content is inspected without TLS being terminated on TR7. WAF sees encrypted content only when TLS is decrypted on the vService (Can the WAF see the content of HTTPS traffic; what is required for that?).
• Starting learning behind a CDN without assigning Trusted proxy. All requests appear to come from the CDN addresses; the blacklist and the learning thresholds (the number of distinct clients, countries and ASNs) are calculated with these addresses.
• Mistaking Enable on the Load Balancer vService List for the WAF switch. That button changes the running state of the vService (Can I enable, disable or delete multiple vServices at the same time?).
• Thinking a disabled WAF box is only a permission problem. The box also appears disabled if the license does not include the WAF - WAAP product; the license is checked in the Modules field.

How it is done in the documentation

• How to Enable WAF? · Two Ways
• How to Enable WAF? · Way 1: Over the WAF-Protected vService List
• How to Enable WAF? · Way 2: Over the vService Form
• Load Balancer Management · Security Modules
• WEB-CLI lb service · The Protection and Processing Switches

Related questions

• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• Does traffic start being blocked as soon as I enable the WAF?
• What should I do first after enabling the WAF?