Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I deploy the WAF on a live site without risking an outage?
Short answer
Turning WAF on does not by itself cut off traffic; a vService on which it is turned on for the first time starts in Learning Mode and does not block requests with a WAF decision (recommended life cycle). The safe order: Trusted Proxy and TLS termination are checked, WAF is turned on, learning is done until Learning Coverage flattens, the Analysis & Learning result is applied after unknown or suspicious paths are excluded from the analysis, in Monitor Mode the rule set is monitored on real traffic without blocking and the false positives in Event Logs are taught with Allow / Teach, and when no new false positive comes, the switch to Blocking Mode is made. Mode changes are applied without a separate deployment step and without dropping open connections. If there is more than one domain name, the ones that mature are moved to Blocking mode gradually with separate Virtual Host Groups. By default, the body is received completely before the inspection (Wait for body for a time off); pages that make large uploads are monitored separately.
Problem: The Risk of Incorrect Blocking on a Live Site
Deploying WAF directly in Blocking Mode can block pages that do not yet have a counterpart in the rule set, as well as legitimate requests. For this reason, the product recommends an order that goes from Learning mode to Monitor mode and from Monitor mode to Blocking mode (recommended life cycle). Even while this order is followed, the following situations can affect the user:
| Situation | Effect and precaution |
|---|---|
| The WAF scan cannot be completed within the 2-second time limit | In Learning and Monitor mode, the request is let through (if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode, it is blocked); once Blocking mode is switched to, the request is blocked and answered with the Blocking Page, and if Fail-open is on, it is let through without being scanned (What happens to a request if the scan exceeds a certain time (2-second scan limit)?) |
| The request body is received completely before the inspection | Very slow large uploads can time out (Large file uploads fail; why?) |
| WAF was turned on and then off on the vService before | The Virtual Host Groups come back with their saved modes, for example in Blocking mode (If I remove WAF protection, are the learned rules and settings deleted?) |
| Blocking response | The Blocking Status Code default is 418; the client and monitoring tools see this as an error, and it is changed if needed |
Solution: Two Methods
The two methods follow the same order; the second one advances the domain names on the same vService in separate groups at separate speeds.
| Your situation | Suitable method |
|---|---|
| A single domain name or the whole vService | Method 1: Staged mode transition |
| More than one domain name on the same vService; the mature ones should be protected first | Method 2: Gradual transition by domain name |
Method 1: Staged Mode Transition Recommended
- How it works The Virtual Host Group is taken through Learning Mode, Monitor Mode and Blocking Mode in order. In Monitor mode, the inspection is exactly the same as in Blocking mode; the blocking decision is calculated but not applied.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management · Dashboard · Event Logs
- Requirement HTTP vService; WAF - WAAP license; modify permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Check the prerequisites
If there is a CDN or proxy in front of TR7, a Trusted Proxy profile is assigned to the vService (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?); for HTTPS content, TLS is terminated on the vService (Can the WAF see the content of HTTPS traffic; what is required for that?).
2
Adım 2 Turn on WAF
WAF is turned on with the WAF box in the vService form or with Enable on the WAF-Protected vService List screen (How do I enable WAF protection on a vService?). Turning it on does not drop open connections (what is created after it is enabled).
3
Adım 3 Monitor the learning
On the Dashboard tab of the vService, the Learning view is opened; waiting continues until Learning Coverage approaches 100% and flattens, and until New shapes (accepted) in Learning Discovery Rate approaches zero.
4
Adım 4 Open the analysis window
On the WAF Management tab, the Analysis & Learning text on the mode card is clicked; the new analysis window opens (creating a new analysis).
5
Adım 5 Start the analysis
Start Analyzing is clicked; the progress is followed on the bar on the mode card.
6
Adım 6 Open the analysis result
When the analysis is finished, the New badge that appears on the Analysis & Learning row is clicked; the summary of the analysis opens (the completion of the analysis).
7
Adım 7 Open the Analyze Page Types tab
Edit in the summary is clicked; the Analyze Page Types tab opens. The tree of the learned directories is listed on the left, and the paths in the selected directory on the right.
8
Adım 8 Exclude the suspicious paths from the analysis
The paths that come out of the analysis are reviewed; only the paths for which a WAF rule will be created must remain in the list. It is recommended to exclude unknown or suspicious paths from the analysis manually: the rows are selected and Exclude from Analysis is clicked; these paths are added to the Excluded paths list and do not produce rules. The edits are written to the analysis record without a separate save step; the live rules change only with Apply.
9
Adım 9 Apply the analysis result
Apply on the Analyze Page Types tab is clicked and the Are you sure? question is confirmed (applying the analysis result).
10
Adım 10 Open the mode edit window
Edit on the title strip of the mode card is clicked (WAF Mode Edit screen).
11
Adım 11 Select Monitor mode
In the WAF Mode field, Monitor mode is selected.
12
Adım 12 Save
Edit at the bottom of the window is clicked; the change is applied without a separate deployment step. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.
13
Adım 13 Review the Monitor mode records
The records are reviewed on the Event Logs tab. In the group in Monitor mode, all records appear as Not blocked — Monitor mode: requests whose score reaches the threshold are blocked in Blocking mode; requests that are caught only by a signature with State = Monitor and stay below the threshold, however, pass in Blocking mode as well. This second kind is separated with the Monitor only field in Log Filter in the server filter.
14
Adım 14 Select the false positives
The rows of the requests known to be legitimate are selected with the checkboxes.
15
Adım 15 Teach
Allow / Teach on the toolbar is clicked and the Are you sure? question is confirmed; the signatures triggered by the selected requests are taught to the rule set.
16
Adım 16 Switch to Blocking mode
When it is seen that no new false positive comes to Event Logs, steps 10–12 are repeated, and Blocking Mode is selected in the WAF Mode field and saved with Edit. Transition criteria: When should I move from Learning to Monitor and from Monitor to Blocking?
Verification
1Event LogsTR7 side
After the switch to Blocking mode, the preview of the Event Logs records is checked.
Expected
Attack blocked only on attack requests2DistributionTR7 side
The series in the WAF Inspection Distribution panel on Dashboard are checked.
Expected
The Blocked series increases only on attack requestsMethod 2: Gradual Transition by Domain Name
- How it works The mode is assigned not to the vService but to the Virtual Host Group. While the matured domain names are moved to Blocking mode in their own groups, the others stay in Learning or Monitor mode. A new group starts with its own rule set with a single rule (Any paths) and learns from its own traffic.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups band
- Requirement WAF-enabled HTTP vService; modify permission in the WAF area
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Open the group add window
The plus (+) icon on the title strip of the Virtual host groups band at the very bottom of the WAF Management tab is clicked; a window titled Add opens (adding a host group).
2
Adım 2 Define the group
Virtual Host Group Name is entered. The domain name is written in the Virtual Host Patterns field (e.g. api.example.com or *.example.com); the pattern is compared with the Host header as it is, including case and port. The WAF Mode field comes preselected with the default mode of the vService; it is selected according to the stage the group is in.
3
Adım 3 Save
Add at the bottom of the window is clicked; a separate mode card appears for the group. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.
4
Adım 4 Advance the groups separately
Each group is moved to Monitor mode and to Blocking mode separately from its own mode card, in the order in Method 1 (steps 3–16). Details: Can I use different modes for different domains on the same vService?
Verification
1Mode cardsTR7 side
The mode cards on WAF Management are checked.
Expected
Each group in its own mode; Requests to … are handled by this groupCommon Mistakes
- Skipping the Monitor mode stage. Users can be blocked before the effect of the rule set on real traffic is seen (WAF Mode Edit screen).
- Switching to Blocking mode while Learning Coverage is low. Pages and parameters that have no counterpart in the rule set can be counted as structural violations and blocked (Learning Coverage).
- Taking Learning mode records for Blocking mode behavior. In Learning mode, signature scanning runs ignoring the exceptions; what will happen in Blocking mode is shown by the Monitor mode records (the runtime behavior of the modes).
- Taking every record in Monitor mode for a request that will be blocked. Requests that are caught only by a signature with State = Monitor and stay below the threshold also appear as Not blocked — Monitor mode and pass in Blocking mode as well; these records are separated with the Monitor only field in Log Filter.
- Assuming that a vService that had WAF on before will start in Learning mode. The saved mode comes back (If I remove WAF protection, are the learned rules and settings deleted?).
- Leaving the Teacher or Conditional learning identities on after going live. Requests that carry a Teacher identity are not blocked with a WAF decision in any mode, and those that carry a Conditional Learning identity are processed within the learning scope; the identity fields are emptied when the work is done.
How it is done in the documentation
