FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I enable or disable WAF on several vServices at once? ​

Short answer

Yes. In WAF-Protected vService List, Enable is clicked, the desired number of vServices are selected in the HTTP vServices to WAF field and WAF is enabled on them in a single operation with Add; to disable, the checkboxes of the rows in the list are checked and Disable is clicked. Disable does not ask for confirmation, and the bulk selection box in the column heading selects all the filtered rows. In WEB-CLI, with lb service update-many target selected, the vService IDs are written to the --ids.N fields and --waf true or --waf false is given (bulk update). Enabling requires a WAF - WAAP license, disabling does not. The Enable and Disable in the Load Balancer vService List, on the other hand, change the running state of the vService, not WAF.

Problem: WAF Is to Be Enabled and Disabled on Many vServices ​

WAF needs to be enabled or disabled on several vServices in a single operation, without opening the form of each one individually. Since WAF is enabled per vService (what enabling WAF means), the bulk operation changes the WAF switch of every selected vService at the same time; the settings and the modes remain separate per vService.

Solution: Two Methods ​

Your situationSuitable method
From the interfaceMethod 1: WAF-Protected vService List
From the command line or with a scriptMethod 2: WEB-CLI
  • How it worksEnable enables WAF on all the selected HTTP vServices, and Disable disables it on all the rows selected with the checkboxes. There is no upper limit on the number of vServices that can be selected; the operation is applied at once.
  • Where it is opened Configuration Menu → WAF → WAF-Protected vService List
  • Requirement Modify permission in the WAF area; a WAF - WAAP license for enabling
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the list

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → WAF-Protected vService List is selected (how to access).

2
Adım 2 To enable: open the Enable tab

Enable on the toolbar is clicked; a tab titled Add opens next to the list.

3
Adım 3 To enable: select the vServices

In the HTTP vServices to WAF field, the vServices are selected. The field lists only the HTTP vServices with WAF off; the stopped vServices are also in the list.

4
Adım 4 To enable: save

Add is clicked; the tab closes and the selected vServices appear in the list. Every vService enabled for the first time starts in Learning Mode; a vService that had WAF enabled before returns with its saved configuration.

5
Adım 5 To disable: select the rows

In the list, the checkboxes at the beginning of the rows of the vServices to be disabled are checked. The bulk selection box in the column heading selects all the rows filtered at that moment, including those on the other pages; the number of selected rows is seen as N selected in the Page Information field.

6
Adım 6 To disable: Disable

Disable on the toolbar is clicked; no confirmation window appears and WAF is turned off immediately on all the selected vServices. In both operations, the change is applied without dropping the open connections. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification ​

1ListTR7 side

On the WAF-Protected vService List screen, the WAF mode and OWASP Protection Level columns of the enabled vServices are checked.

ExpectedWAF mode: 1 Learning · OWASP protection level: Very tight
This applies to a vService enabled for the first time; the disabled vServices drop from the list.

Method 2: WEB-CLI ​

  • How it worksupdate-many writes the same waf value to all the selected vService records at once (bulk update).
  • Where it is openedWEB-CLI → lb service update-many
  • Requirement WEB-CLI access; a WAF - WAAP license for enabling
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Get the vService IDs

The IDs are read from the list:

text
lb service list
2
Adım 2 Run the bulk update

The IDs from step 1 are written in place of <vService-1> and <vService-2>; a --ids.N field is added for each vService. To disable, false is written instead of true:

text
lb service update-many target selected --ids.0 <vService-1> --ids.1 <vService-2> --waf true

If --ids.N is not given, a selection list opens. The command writes how many records will be affected and asks for confirmation; nothing is written without confirmation. With --onError at its default abort value, if one of the targets does not pass validation, no record is written.

Verification ​

1vService recordTR7 side

The record of each vService is displayed.

Command: lb service show <vService-1>

Expectedtrue in the waf row
When WAF is disabled, the waf row does not appear in the output.

Common Mistakes ​

  • Using the bulk Enable and Disable in the Load Balancer vService List. That operation starts or stops the vServices (Can I enable, disable or delete multiple vServices at the same time?).
  • Assuming the bulk selection box selects only the visible page. The box selects all the filtered rows, including those on the other pages; Disable also runs on all of them without asking for confirmation.
  • Assuming all the vServices will start in Learning mode on bulk enabling. A vService enabled for the first time starts in Learning Mode; a vService that had WAF enabled before returns with its saved mode (If I remove WAF protection, are the learned rules and settings deleted?).
  • Assuming bulk enabling also equalizes the WAF settings. Enable turns on only the WAF switch; the mode, the protection level and the other settings remain separate per vService.

How it is done in the documentation

Related questions