What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?

Short answer

They answer different questions and do not replace each other (the difference from WAF). The WAF looks at the content of the request: in the path, query, headers and body, it looks for attack patterns such as SQL injection, XSS and path traversal, and for structures that the application does not expect. L7 DDoS & Threat Protection (Bot/DDoS Protection by its section name in the docs), on the other hand, looks at how much, from where and from whom the request comes; it consists of the L7 DDoS Protection, IP Reputation Protection and Bot Protection protections. A request with clean content that is repeated thousands of times per second is harmless for the WAF and a flood indicator for L7 DDoS Protection; a single malicious request is the opposite. For this reason, the two are used together in an HTTP application open to the internet. If both are on in the same vService, every request is evaluated in both; when the client is responded to, the enforcement of L7 DDoS & Threat Protection comes before the WAF's blocking page (Blocking Page), and the WAF's attack record is still created. The WAF runs only on an HTTP vService, and L7 DDoS & Threat Protection on HTTP and L7 TCP vServices. For floods at the packet and connection level, L4 DDoS Protection, which is a separate layer, is used.

Comparison

	WAF	L7 DDoS & Threat Protection
The question it asks	Is the content of the request malicious?	How much, from where and from whom does the request come?
What it looks at	The content of the path, query, headers and body	Per-source and total counters, the reputation of the source, the behavior of the client
What it typically catches	SQL injection, XSS, path traversal, parameters and structures that the application does not expect	Request floods, sources with a bad reputation, scrapers, credential stuffing, botnets
Protections	Signatures (OWASP Rules), learned page types (WAF Rules), structure and argument checks (Checks), Blacklist Protection	L7 DDoS Protection, IP Reputation Protection, Bot Protection (three protections)
Decision	A request whose attack score reaches the blocking threshold is blocked	Only one of the protections applies a result; the priority is L7 DDoS → IP Reputation → Bot Protection
Operating modes	Learning, Monitor, Blocking per host group (WAF Mode)	Per protection; when turned on, L7 DDoS Protection and Bot Protection are in Monitor, IP Reputation Protection is Active (initial modes)
Response	A blocking page with the default 418 status code	Enforcements such as Block, Captcha, Quarantine, Silent drop
vService type	HTTP only	HTTP and L7 TCP
Shared data	The device-wide IP reputation database (Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?)	The same database

How Does It Work?

While WAF and L7 DDoS & Threat Protection are on in the same vService, the request is processed in the following order:

1. Measurement and score: The counters of L7 DDoS & Threat Protection are updated and the bot score is calculated.
2. WAF scan: The WAF scans the request; the attack record and the WAF counters are created at this stage.
3. L7 DDoS & Threat Protection enforcement: If a protection in enforcement mode has made a decision, it gives the response.
4. Actions: The request actions in the vService's Actions list run.
5. WAF blocking response: A request that the WAF blocked and that was not responded to in the previous stages gets the blocking page.

The result of this order: a malicious request stopped by L7 DDoS & Threat Protection is also scanned in the WAF and appears on the WAF's Event Logs screen. Whether the request was actually ended by the WAF or by L7 DDoS & Threat Protection is written in the Security Action cell of the Debug Mode Logs record if Debug is on in the vService; if both made a decision of the same weight, the cell shows the Bot/DDoS decision. All the stages: Which stages does a request go through inside TR7 before it reaches the backend?

Using Both Together in TR7

• Turning on: Both are turned on with the WAF and L7 DDoS & Threat Protection boxes in the Details list of the HTTP vService form; steps: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• Initial behavior: When WAF is turned on, the host group starts in Learning mode and does not block any request (after it is enabled). When L7 DDoS & Threat Protection is turned on, IP Reputation Protection starts directly as Active; the default rule list quarantines the critical categories and blocks the other categories except VPN IP. This difference is taken into account when the two are turned on at the same time.
• Management: The WAF settings are made on the vService's WAF Management tab, and the L7 DDoS & Threat Protection settings on the Bot/DDoS Management tab. The records of each are kept on separate Event Logs screens.
• Product and add-on: The WAF is the WAF - WAAP product, one of the four products of TR7; bot management is also within the scope of this product. L7 DDoS Protection, on the other hand, is an add-on: standard DDoS protection comes with the product license, and the add-on extends the protection to more vServices. L4 DDoS Protection is also an add-on.
• Network layer: Since half-open TCP handshakes and UDP and ICMP floods do not create an HTTP request, they are seen by neither the WAF nor L7 DDoS & Threat Protection; this traffic is handled per route table with L4 DDoS Protection.

Common Misconceptions

• "The WAF also limits the number of requests." The WAF evaluates requests one by one, according to their content; request and connection limits are in the L7 DDoS Protection protection of L7 DDoS & Threat Protection.
• "A request stopped by L7 DDoS & Threat Protection never reaches the WAF." The WAF scan runs before the enforcement; the request can appear in the WAF records and counters, while the response of L7 DDoS & Threat Protection goes to the client.
• "If one of them is on, the other is not needed." The WAF is not designed to stop a flood with clean content, and L7 DDoS & Threat Protection is not designed to stop a one-time malicious payload; the two handle different types of attack.
• "WAF can be turned on in an L7 TCP vService." The WAF runs only on an HTTP vService; in an L7 TCP vService, only L7 DDoS & Threat Protection is used (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?).

How it is done in the documentation

• Bot/DDoS Protection · The Difference from WAF
• Bot/DDoS Protection · How Does It Work?
• How to Enable Bot/DDoS Protection? · The Starting Modes of the Three Protections
• L4 DDoS Protection · The Difference from Bot/DDoS and WAF

Related questions

• How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?
• How much security does the Load Balancer module provide on its own; when do I need a WAF?
• I already have a network firewall; why would I also need a WAF?
• How does WAF inspection behave under heavy traffic?