Which default settings are created when WAF is enabled?

Short answer

When WAF is turned on, the WAF settings, the Default Host Group, this group's Any Paths rule and the 21 default header rules bound to the rule, the vService-specific signature layer and the whitelist record are created automatically for the vService (what is created after it is enabled). The main values: WAF Mode Learning Mode, OWASP Protection Level Very Tight, Structure Checks and Argument Checks on, Max. Allowed Arguments 25, Do not WAF static contents on, Blacklist Protection on (all categories), Blocking Status Code 418, Rule Creation Policy Data Based, Max. Body Size to Process (kB) 4096 and Max. Body Size to Log (kB) 2. Teacher, Conditional Learning, AI Learning and Whitelist Condition are off. The values are written only to missing settings; all settings are changed from the WAF Management tab.

How Does It Work?

When WAF is turned on on a vService, the configuration is regenerated and the records belonging to WAF are created with their default values (what is created after it is enabled). The defaults are written only to missing settings: on a vService whose WAF was previously on and then turned off, the changed values and the modes of the Virtual Host Groups are preserved (If I remove WAF protection, are the learned rules and settings deleted?).

Initial Values

Setting	Card it is on	Initial value
WAF Mode (Default Host Group)	Mode card	Learning mode (What does the WAF do in Learning mode; are attacks blocked?)
OWASP Protection Level	OWASP Protection Level	Very tight (What is the default protection level?)
Max. OWASP Exclusions	OWASP Protection Level	25
Structure Checks · Argument Checks	Checks	On · On
Max. Allowed Arguments	Checks	25
URL Decoding	Checks	On
Do not WAF static contents	Whitelist & Blacklist	On (Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?)
Whitelist Condition	Whitelist & Blacklist	Off
Blacklist Protection	Whitelist & Blacklist	On; Blacklist IP Category all categories (category: All on the card); Frontend Blacklist and Frontend Blacklist Exclusions empty
Blocking Status Code	Blocking page	418
Blocking Page Source	Blocking page	Manual content: TR7's built-in English blocking page (the Your Access To This Page Has Been Blocked! title, the time of the request, the Request ID and IP Address rows), content type text/html
Rule Creation Policy	Learning methods	Data based
Teacher · Conditional Learning · AI Learning	Learning methods	Off
Max. Body Size to Process (kB) · Max. Body Size to Log (kB)	Request Body Limits	4096 · 2
Wait for body for a time	Request Body Limits	Off: the body is received completely before the inspection
Smart Sampling (learning log)	Log settings	On
Default Host Group	Virtual Host Groups	Carries no pattern, cannot be deleted; is displayed first in the Virtual Host Groups list and last on the mode cards; handles the requests that match no group
Any Paths rule	Page types	Path Length 1–8192, Path Depth at most 256, OWASP on, Allowed Methods GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE; 21 default header rules on the Header tab

• Page types are not derived automatically: at the start, the group contains only Any paths, and the row on the mode card says 1 page types. Page types are produced when Analysis & Learning is run with the traffic collected in Learning mode (typical deployment flow).
• The defaults seen in the waf options commands in WEB-CLI (e.g. Max. Allowed Arguments 15, Structure checks and Argument checks off) are the schema's defaults; waf options update writes them only to the fields that are not in the record. When WAF is turned on from the interface or with lb service update, the record is created with the values above, so these fields are not affected.

Common Misconceptions

• "With the defaults, WAF starts blocking immediately." Since WAF Mode is Learning mode, no blocking by a WAF decision is done (Does traffic start being blocked as soon as I enable the WAF?).
• "The rule set is ready when WAF is turned on." At the start, there are only the Any Paths rule and the default header rules; Page types are produced with Analysis & Learning.
• "Turning WAF off and on returns the settings to default." The defaults are written only to missing settings; changed values are preserved.

How it is done in the documentation

• How to Enable WAF? · What Is Created After It Is Enabled?
• WAF - WAAP · Typical Deployment Flow
• Checks · The Checks Edit Screen
• Whitelist & Blacklist · The Whitelist & Blacklist Edit Screen

Related questions

• What should I do first after enabling the WAF?
• What is the default protection level?
• Does traffic start being blocked as soon as I enable the WAF?