FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

What should I do first after enabling the WAF? ​

Short answer

First, it is verified that the protection sees the correct traffic: on the WAF Management tab, the mode card must appear in Learning Mode; if there is a CDN or a proxy in front of TR7, the real client IP must be obtained with a Trusted Proxy profile; for HTTPS content, TLS must be terminated on the vService (what should be done after this). Then, time is allowed for all the sections of the site to be visited, and in Dashboard, on the Learning tab, Learning Coverage and Learning Discovery Rate are monitored. When Coverage approaches 100% and flattens, an analysis is started with Analysis & Learning; the paths that come out of the analysis are reviewed, unknown or suspicious paths are excluded from the analysis with Exclude from Analysis and the result is applied with Apply. Then, for the Virtual Host Group, the WAF Mode is set to Monitor Mode, and the false positives in Event Logs are taught with Allow / Teach; when no new false positive comes, the switch is made to Blocking Mode.

Problem: WAF Is Enabled but There Is No Protection Yet ​

When WAF is enabled, the vService starts in Learning Mode and does not block requests by a WAF decision (Does traffic start being blocked as soon as I enable the WAF?). At enabling, the rule set contains only the Any Paths rule; the page types of the site have not been learned yet. For the protection to come into effect without producing false positives, the traffic must first be learned, the rule set must be generated and the rule set must be monitored on real traffic in Monitor Mode without blocking, and only after that must the switch be made to Blocking Mode.

Solution ​

The steps follow the deployment order the product recommends (typical deployment flow). The mode is set per Virtual Host Group; if there are several groups, the steps are carried out separately for each group.

Recommended Deployment Order ​

Step-by-Step Configuration ​

1
Adım 1 Verify the enabling

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the WAF Management tab is opened (accessing the screen). The mode card at the top of the screen appears as a blue Learning Mode (mode strip).

2
Adım 2 Provide the real client IP (if needed)

If there is a CDN or a proxy in front of TR7, a Trusted Proxy profile is assigned to the vService (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?). Otherwise, the blacklist check and the learning thresholds for the number of distinct clients, countries and ASNs are calculated with the proxy address.

3
Adım 3 Terminate TLS on TR7 (if needed)

The content of HTTPS traffic is inspected only when TLS is terminated on the vService (Can the WAF see the content of HTTPS traffic; what is required for that?).

4
Adım 4 Monitor the learning

On the Dashboard tab of the same vService, the Learning view is opened. Learning Coverage shows as a percentage how much of the accepted and attack-free traffic in the last 24 hours consists of familiar request shapes; as the New shapes (accepted) line in Learning Discovery Rate approaches zero, the site has been learned. During this time, time is allowed for all the sections of the site to be visited. The Learning tab is visible while Smart Sampling (learning log) is on (default) and at least one group is in Learning mode, or while Conditional Learning is on.

5
Adım 5 Open the analysis window

On the WAF Management tab, the Analysis & Learning text on the mode card is clicked; the New analyze for window that carries the vService name opens (creating a new analysis). Analyze Date covers the last 3 months by default.

6
Adım 6 Start the analysis

Start Analyzing is clicked; the window closes and the progress is monitored on the bar on the mode card (starting the analysis).

7
Adım 7 Open the result

When the analysis is completed, the New badge appears in the Analysis & Learning row; by clicking the badge, the summary of the analysis is opened (completion of the analysis).

8
Adım 8 Open the Analyze Page Types tab

Edit in the summary is clicked; the Analyze Page Types tab opens. The tree of the learned directories is listed on the left, and the paths in the selected directory on the right.

9
Adım 9 Exclude the suspicious paths from the analysis

The paths that come out of the analysis are reviewed; only the paths for which a WAF rule will be created must remain in the list. It is recommended to exclude unknown or suspicious paths from the analysis manually: the rows are selected and Exclude from Analysis is clicked; these paths are added to the Excluded paths list and do not produce rules. The edits are written to the analysis record without a separate save step; the live rules change only with Apply.

10
Adım 10 Apply the result

Apply on the Analyze Page Types tab is clicked and the Are you sure? question is confirmed; the page types and the rule suggestions are written to the rule set of the group (applying the analysis result). The page types count on the mode card increases.

11
Adım 11 Open the mode edit window

Edit in the header strip of the mode card is clicked; the Virtual Host Group edit window opens (WAF Mode Edit screen).

12
Adım 12 Select Monitor mode

In the WAF Mode field, Monitor mode is selected.

13
Adım 13 Save

Edit at the bottom of the window is clicked; the change is applied without a separate deployment step. The card becomes an amber Monitor mode. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

14
Adım 14 Select the false positives

On the Event Logs tab of the same vService, the rows of the requests known to be legitimate are selected with the checkboxes. In Monitor mode, the requests that reach the threshold are recorded as Not blocked — Monitor mode (Action values).

15
Adım 15 Teach

Allow / Teach on the toolbar is clicked and the Are you sure? question is confirmed; the signatures triggered by the selected requests are taught to the rule set. The name of the button becomes Allow, Teach or Allow / Teach depending on the selection.

16
Adım 16 Switch to Blocking mode

When it is seen that no new false positive comes, steps 11–13 are repeated, and Blocking Mode is selected in the WAF Mode field and saved with Edit. Transition criteria: When should I move from Learning to Monitor and from Monitor to Blocking?

Verification ​

1DistributionTR7 side

On the Dashboard tab of the vService, the series in the WAF Inspection Distribution panel are checked.

ExpectedLearning → Monitor → Blocked and Clean
The traffic in Learning mode is counted in the Learning series, the requests that reach the threshold in Monitor mode in the Monitor series, and the requests blocked in Blocking mode in the Blocked series; the requests that do not reach the threshold are Clean.

Common Mistakes ​

  • Leaving it in Learning mode and assuming it is protected. In Learning Mode, the requests that contain attacks also pass.
  • Running the analysis before Learning Coverage flattens. The pages and parameters that have no counterpart in the rule set are counted as structural violations according to the Rule Creation Policy and are blocked in Blocking mode (Learning Coverage).
  • Switching to Blocking mode without monitoring in Monitor mode. The false positives are reflected directly to the users as blocking.
  • Assuming the Learning mode records show the Blocking mode behavior. In Learning mode, the signature scan runs ignoring the OWASP switches and the exceptions; what will happen in Blocking mode is shown by the Monitor mode records (runtime behavior of the modes).
  • Expecting AI learning to work in Learning mode. AI Learning evaluates the attack records; these records are produced only in Monitor mode and Blocking mode (how the rule set is formed).

How it is done in the documentation

Related questions