How do I remove WAF protection from a vService?

Short answer

For a single vService, the vService form is used: Edit → Details → the WAF box is unchecked → Save (removing the protection). For several vServices, the checkboxes of the rows are checked in WAF-Protected vService List and Disable is clicked; this operation removes the protection immediately on all the selected vServices without asking for confirmation. The same switch is also turned off from the Edit window of the Security Modules section on the Load Balancer Management tab and in WEB-CLI with the --waf false field of the lb service update command. The removal does not delete the WAF configuration; when the protection is enabled again, the same configuration comes back.

Problem: WAF Protection Is No Longer Wanted on the vService

A vService needs to be taken out of the WAF inspection. The removal turns off the WAF switch in the vService record; the vService continues to receive traffic, only its requests do not pass through the WAF inspection (removing the protection). The WAF configuration (Virtual Host Groups, page types, the signature layer, the settings) is kept and is removed only when the vService is deleted (If I remove WAF protection, are the learned rules and settings deleted?). Since Disable in the list does not ask for confirmation, making the selection correctly is important.

Solution: Four Methods

All four methods turn off the same switch; one of them is chosen.

Your situation	Suitable method
A single vService; without the risk of other rows being selected by mistake	Method 1: vService Form → Details
Several vServices in a single operation	Method 2: WAF-Protected vService List
From the vService's Load Balancer Management tab	Method 3: Security modules
From the command line	Method 4: WEB-CLI

Method 1: vService Form → Details Recommended

• How it works The WAF switch is turned off only on the vService being edited (single service).
• Where it is openedLoad Balancer → Load Balancer vService List → vService → Edit → Details
• Requirement Modify permission in the Load Balancer and WAF areas
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

2

Adım 2 Open the Details list

Details in the upper right corner of the form is clicked.

3

Adım 3 Uncheck WAF

The WAF box is unchecked.

4

Adım 4 Save

Save is clicked; the change is applied without a separate deployment step and without dropping open connections. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1ListsTR7 side

The WAF-Protected vService List screen and the WAF-Protected vServices category in the Left Monitor Panel are checked.

ExpectedvService is in neither list

In the Security modules section on the Load Balancer Management tab, the WAF card carries the Disabled badge.

Method 2: WAF-Protected vService List

• How it works On all the rows selected with the checkboxes, WAF is turned off without a confirmation window being shown (Disable).
• Where it is opened Configuration Menu → WAF → WAF-Protected vService List → Disable
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the list

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → WAF-Protected vService List is selected (how to access).

2

Adım 2 Select the rows

The checkboxes at the beginning of the rows of the vServices to be removed are checked. Clicking a row and opening its preview does not count as a selection; the bulk selection box in the column heading selects all the rows filtered at that moment, including those on the other pages. The number of selected rows is seen as N selected in the Page Information field below the table.

3

Adım 3 Remove with Disable

Disable on the toolbar is clicked; no confirmation window appears and the protection of all the selected vServices is removed immediately. While there is no selection, the button is disabled. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1ListTR7 side

The WAF-Protected vService List screen is checked.

ExpectedThe removed vServices are not in the list

The removal through the list path is not written to the user log; it does not appear on the Log tab of the vService preview.

Method 3: Security Modules

• How it works The Edit link of the Security Modules section on the Load Balancer Management tab opens the vService form as a window reduced to only the WAF, AGS and L7 DDoS & Threat Protection boxes (Edit link).
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → Load Balancer Management → Security Modules → Edit
• Requirement Modify permission in the Load Balancer and WAF areas
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Load Balancer Management tab

In the Left Monitor Panel, the vService is clicked in the Load Balancer vServices category and the Load Balancer Management tab is opened (accessing the screen).

2

Adım 2 Open the Security modules window

Edit in the Security Modules section heading is clicked.

3

Adım 3 Uncheck WAF

The WAF box is unchecked.

4

Adım 4 Save

Save at the bottom of the window is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1WAF cardTR7 side

In the Security modules section, the WAF card is looked at.

ExpectedDisabled

Method 4: WEB-CLI

• How it works The waf field of the vService record is set to false (protection and processing switches).
• Where it is openedWEB-CLI → lb service update
• Requirement WEB-CLI access
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Turn off WAF

The ID of the vService is written in place of <vService>:

lb service update id <vService> --waf false

For several vServices, lb service update-many target selected --ids.0 <vService-1> --ids.1 <vService-2> --waf false is used; the command writes the number of records that will be affected and asks for confirmation (bulk update).

Verification

1ListTR7 side

The WAF-Protected vService List screen is checked.

ExpectedvService is not in the list

Common Mistakes

• Pressing Disable without noticing that other rows remain selected in the list. Disable does not ask for confirmation and removes the protection on all the selected vServices; for a single vService, the form path is safer.
• Assuming the rules are deleted on removal. The configuration is kept (If I remove WAF protection, are the learned rules and settings deleted?).
• Assuming it will start from Learning mode when enabled again. The Virtual Host Groups return with the modes they had before being turned off, for example in Blocking Mode.
• Looking for the removal through the list path in the user log. Enabling and disabling through the list path are not written to the user log (scope and limits).
• Using Disable in the Load Balancer vService List. That button stops the vService, it does not remove WAF (Can I enable, disable or delete multiple vServices at the same time?).
• Looking for the removal in the right-click menu of the WAF-Protected vService List. The right-click menu contains only Edit (right-click menu).

How it is done in the documentation

• How to Enable WAF? · Removing the Protection
• How to Enable WAF? · Over the List (Bulk)
• How to Enable WAF? · Over the vService Form (A Single Service)
• WAF-Protected vService List · Disable

Related questions

• If I remove WAF protection, are the learned rules and settings deleted?
• Can I enable or disable WAF on several vServices at once?
• How do I enable WAF protection on a vService?