Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the two ways of enabling WAF (from the list / from the vService form)?
Short answer
The two ways produce the same result: the WAF switch in the vService record is turned on and the same defaults are created (two ways). Enable on the WAF-Protected vService List screen turns on multiple existing HTTP vServices in a single operation and requires modify permission in the WAF area. The Details → WAF box in the vService form is for a single vService, is also used while a new vService is being set up, is saved with Save together with the other changes in the form, and requires modify permission in the Load Balancer area. There is also a difference in removal: Disable in the list runs on all the selected vServices without asking for confirmation, while removal from the form affects only that vService. Turning it on and off through the list path is not written to the user log (scope and limits). In addition to these two ways, the Security Modules section on the Load Balancer Management tab and WEB-CLI also change the same switch.
Comparison
| WAF-Protected vService List → Enable | vService form → Details → WAF | |
|---|---|---|
| Scope | Multiple vServices in a single operation; no upper limit | A single vService; also while a new vService is being set up |
| Path | Configuration Menu → WAF → WAF-Protected vService List → Enable | Load Balancer → Load Balancer vService List → Edit → Details |
| vServices offered | Only HTTP vServices whose WAF is off, in the HTTP vServices to WAF field; stopped vServices included | The box exists only in the HTTP vService form |
| Permission | Modify in the WAF area; a user with only read permission sees the buttons as enabled, and the operation is rejected on the server | Modify in the Load Balancer area; if there is no modify permission in the WAF area, the box is disabled |
| License | If the license does not include the WAF - WAAP product, enabling is rejected with the The license does not include this module: WAF error | If the license does not include the WAF - WAAP product, the box is disabled (if WAF is not already on in the vService) |
| Other fields | Only the WAF switch changes | A single save together with the other changes in the form |
| Removal | Disable; no confirmation window, all the selected rows | The box is unchecked, then Save |
| User log | Turning it on and off is not written | Recorded as a vService edit |
| Result and defaults | The same (Which default settings are created when WAF is enabled?) | The same |
In both ways, the change is applied without a separate deployment step and without dropping open connections. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.
The Other Two Entry Points
| Entry point | Scope |
|---|---|
| Load Balancer Management → Security Modules → Edit | A single vService; the vService form opens as a window reduced to only the WAF, AGS and L7 DDoS & Threat Protection boxes and is saved with Save |
| WEB-CLI | A single vService with lb service update, multiple vServices with lb service update-many (protection and processing switches) |
Steps of the four entry points: How do I enable WAF protection on a vService?
Common Misconceptions
- "WAF enabled from the list comes with different defaults." All entry points turn on the same switch; a vService on which WAF is turned on for the first time starts with Learning Mode and the same defaults.
- "Enable and Disable on the Load Balancer vService List turn WAF on and off." Those buttons change the running state of the vService (Can I enable, disable or delete multiple vServices at the same time?).
- "On the WAF-Protected vService List, WAF is removed by right-clicking the row." The right-click menu contains only Edit; removal is done with Disable on the toolbar (right-click menu).
- "Who turned on WAF is seen on the vService's Log tab." Turning it on and off through the list path is not written to the user log.
How it is done in the documentation
