Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the vService blacklist and the IP intelligence list?
Short answer
Frontend Blacklist is a manually written IP and CIDR list specific to the WAF inspection of a single vService. IP Intelligence & Reputation, on the other hand, is a reputation database kept device-wide; it consists of the User blacklist, External and attack type categories. While Blacklist Protection is on, WAF evaluates the two together and a match in either list produces the same 100-point Blacklisted IP violation; the difference is the scope, the content and where they are managed. The Blacklist IP Category filter narrows only the IP Intelligence categories; Frontend blacklist is independent of this filter and is always evaluated while Blacklist Protection is checked. Outside WAF, the IP Intelligence data is also used in other layers, such as IP Reputation Protection in Bot & DDoS Protection, the Blacklist IP Category condition and blocking at the network layer. Frontend Blacklist Exclusions cancels the matches of both lists on this vService.
Comparison
| Frontend blacklist | IP Intelligence & Reputation | |
|---|---|---|
| Scope | The WAF inspection of a single vService | Device-wide; also used in the layers outside WAF (where it is used) |
| Content | Manually written IP and CIDR lines | User blacklist, External and attack type categories (supported categories) |
| Where it is managed | Whitelist & Blacklist window; Event Logs → Attacker IP menu → (vService name) options | IP Intelligence & Reputation screen; Event Logs → Attacker IP menu → (IP intelligence) options |
| Update | Manual | Online update (Online Update Period: Off by default, Daily, Weekly, Monthly) and external sources |
| Blacklist IP Category filter | Not affected | If Filter is selected, only the selected categories |
| Exclusion | Frontend Blacklist Exclusions (only this vService; cancels both lists) | IP Intelligence whitelist (device-wide) |
| Result in WAF | Blacklisted IP, 100 points | The same |
| Removal | Deleting from the list or Remove from blacklist (vService name) | A user record is removed with Remove from Blacklist (IP intelligence); a record that comes from an external source cannot be removed, it is whitelisted |
- Which one when: For an attacker specific to a single application, the vService list is used (its effect is narrow and it is easy to undo); a malicious source that concerns all vServices is added to the IP Intelligence user blacklist.
- Editing the lists: How do I define a vService-specific IP blacklist (Frontend Blacklist) and its exclusions (Frontend Blacklist Exclusions)?
- Category selection in WAF: Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?
- Condition layer: Can I block known malicious IPs (IP Reputation / blacklist category)?
Common Misconceptions
- "The vService list is subject to the category filter." The filter affects only the IP Intelligence categories; Frontend blacklist is independent of this filter and is always evaluated while Blacklist Protection is checked.
- "IP Intelligence is only for WAF." The same data is also used in Bot & DDoS Protection, in conditions and at the network layer.
- "While Blacklist protection is off, IP Intelligence still blocks in WAF." WAF evaluates both lists only while Blacklist protection is on; the other layers depend on their own settings.
How it is done in the documentation
