Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
If I remove WAF protection, are the learned rules and settings deleted?
Short answer
No. The removal turns off only the WAF switch in the vService record; the WAF settings, the Virtual Host Groups and their modes, the learned Page Types, the changes in the vService-specific signature layer and the whitelist record are kept (removing the protection). When the protection is enabled again, the same configuration comes back; the Virtual Host Groups start working in the modes they had before being turned off, for example in Blocking Mode, and the defaults are written only to the missing settings. The WAF configuration is removed only when the vService is deleted. If the rule set is also to be kept separately, it is first exported with Export on the Page types screen.
How Does It Work?
Disable, unchecking the WAF box in the vService form, or lb service update id <vService> --waf false changes only the switch in the vService record. The records that belong to WAF are kept bound to the vService and are not pruned as long as the vService exists; when the vService is deleted, they are removed together with it.
| Record | When WAF is removed | When the vService is deleted |
|---|---|---|
| WAF settings (Checks, OWASP Protection Level, Blocking Page, Learning Methods…) | Kept | Deleted |
| Virtual Host Groups, their modes and Page Types | Kept | Deleted |
| vService-specific signature layer (OWASP Rules) | Kept | Deleted |
| Whitelist & Blacklist settings | Kept | Deleted |
- When the protection is enabled again, the defaults are written only to the missing settings; the changed values and the modes of the groups are preserved (Which default settings are created when WAF is enabled?).
- From the moment it is removed, the requests of the vService do not pass through the WAF inspection; the vService continues to receive traffic.
- To save the rule set to a file, Export on the Page types screen is used; the file is restored with Import.
- Removal steps: How do I remove WAF protection from a vService?
Common Misconceptions
- "When enabled again, WAF starts in Learning mode." The saved mode comes back; a group in Blocking Mode returns in Blocking mode. If learning first is wanted, the WAF Mode of the group is changed after it is enabled again.
- "Turning WAF off and on is enough to reset the configuration." Turning it off and on resets no record; the records are removed only when the vService is deleted.
- "When WAF is removed, the vService also stops." The WAF switch does not change the running state of the vService (Can I enable, disable or delete multiple vServices at the same time?).
How it is done in the documentation
