Does traffic start being blocked as soon as I enable the WAF?

Short answer

No. A vService on which WAF is turned on for the first time starts in Learning Mode: requests go through signature scanning and are recorded for learning, but since the attack score is not accumulated, no request is blocked by a WAF decision; addresses on the blacklist are not blocked in this mode either (what is created after it is enabled). A vService whose WAF was previously on and then turned off, however, returns with its saved configuration, for example in Blocking Mode.

How Does It Work?

When WAF is turned on, the Default Host Group is created for the vService, and this group takes the default mode of the vService, that is, Learning Mode. In Learning mode, signature scanning runs, but the violations found are not added to the attack score and the structural inspections do not run (runtime behavior of the modes). Since the blocking decision is made when the score reaches the threshold, no blocking by a WAF decision occurs in this mode and no Event Logs record is produced.

Situation	Result
A vService on which WAF is turned on for the first time	Learning mode; no blocking by a WAF decision (What does the WAF do in Learning mode; are attacks blocked?)
A vService whose WAF was previously on and then turned off	Returns with its saved host groups, modes and rules (If I remove WAF protection, are the learned rules and settings deleted?)
A request coming from an address on the blacklist (Blacklist Protection)	Not blocked in Learning mode
A request whose WAF scan cannot be completed within the 2-second time limit	Let through in Learning mode; blocked only in Blocking mode (What happens to a request if the scan exceeds a certain time (2-second scan limit)?)
A request within the scope of Do not WAF static contents or Whitelist Condition	Does not enter the WAF inspection
Bot/DDoS protection or Actions on the same vService	Continue to run independently of the WAF mode; their blocking does not come from WAF

• On a WAF-enabled vService, while Wait for body for a time is off (default), the request body is received completely on TR7 before the inspection; very slow large uploads can therefore time out (Large file uploads fail; why?).
• Which security layer a block comes from: I am blocking legitimate users by mistake; how do I find out?
• Blocking starts when the Virtual Host Group is switched to Blocking Mode (What should I do first after enabling the WAF?).

Common Misconceptions

• "Once WAF is turned on, the site is protected." Learning Mode does not provide protection; requests containing attacks also pass.
• "In Learning mode, a request whose scan takes long is blocked." A request whose scan cannot be completed within the 2-second time limit is let through in Learning mode; this request is blocked only in Blocking Mode (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• "Turning WAF off and on again returns it to Learning mode." The saved mode comes back; a group in Blocking mode returns in Blocking mode.

How it is done in the documentation

• How to Enable WAF? · What Is Created After It Is Enabled?
• WAF Mode · Runtime Behavior of the Modes
• WAF Mode · Blocking Mode

Related questions

• What does the WAF do in Learning mode; are attacks blocked?
• What should I do first after enabling the WAF?
• I am blocking legitimate users by mistake; how do I find out?