Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Is the WAF's IP reputation information shared with IP Reputation protection in L7 DDoS & Threat Protection?
Short answer
The data is shared, the decision is separate (where and how it is used). The WAF's Blacklist Protection setting and the IP Reputation Protection protection of L7 DDoS & Threat Protection read the same device-wide IP Intelligence & Reputation blacklist: the TR7 reputation database, the defined external sources and the manually entered Blacklist Content are merged, and the addresses in Whitelist Content are removed. The same list is also used in the Blacklist IP Category condition in the Load Balancer, in Bot Protection and in the Blacklist rule of L4 DDoS Protection; when the list is updated, all of them work with the new data. What differs is the result of the match. In the WAF, a blacklisted source is written as a 100-point Blacklisted IP violation and exceeds the blocking threshold on its own; if the host group is in Blocking mode, the request is blocked, and in Monitor mode, it is reported and passed (mode behavior). Which categories are counted is determined with the Blacklist IP Category field, and the exclusions with Frontend Blacklist Exclusions. In IP Reputation Protection, on the other hand, the enforcement bound to the category rows (such as Quarantine, Block, Captcha) is applied, and the protection starts in Active mode as soon as it is turned on. If both are on together, the same source is caught in both: since the WAF scan runs first, the WAF record and counters are created, while the response of IP Reputation Protection goes to the client. The WAF's vService-specific Frontend Blacklist list is used only in the WAF.
Comparison
| WAF · Blacklist Protection | L7 DDoS & Threat Protection · IP Reputation Protection | |
|---|---|---|
| Data | The device-wide IP Intelligence & Reputation blacklist; in addition, the vService-specific Frontend Blacklist | The same device-wide blacklist |
| Default | Checked when WAF is turned on; Blacklist IP Category = All | Active when the protection is turned on; two default rule rows (default rules) |
| Category selection | Blacklist IP Category: All or the categories selected with Filter | A category group and an enforcement in every rule row (IP Reputation Actions) |
| Result of the match | A 100-point Blacklisted IP violation; in Blocking mode, the blocking page (Blocking Page) (default 418), in Monitor mode, only a record | The enforcement in the row: Quarantine, Block (default 403), Captcha, Tarpit, redirect, showing content, Silent drop |
| Exclusion | Frontend Blacklist Exclusions (the request continues to go through WAF inspection) | IP Reputation Whitelist Condition and whitelist entries |
| Record | WAF Event Logs | Bot/DDoS Event Logs |
| vService type | HTTP | HTTP and L7 TCP |
How Does It Work?
- The list is created: On the IP Intelligence & Reputation screen, the reputation database, the external sources and Blacklist Content are merged into a single blacklist; the addresses in Whitelist Content are removed (how it works). For this reason, an address added to Whitelist Content is exempt in all layers.
- The WAF evaluates: In a request that enters the WAF's inspection, if the source address is in the blacklist (according to the Blacklist IP Category filter) or in the Frontend Blacklist and is not in Frontend Blacklist Exclusions, a 100-point violation is written. Requests that match the Whitelist Condition or that do not enter the inspection because they are static content do not enter the blacklist inspection either.
- Enforcement: If IP Reputation Protection is Active and the category matches a rule row, the enforcement of the row returns to the client. If there is no enforcement and the WAF host group is in Blocking mode, the WAF's blocking page returns.
The source address is the resolved client address if a Trusted Proxies profile is assigned to the vService; both see the same address (If there is a CDN / proxy in front of TR7, how does the WAF see the real client IP?).
In Which Layer Is the Enforcement in TR7?
- Only WAF on: The blacklist is applied in the WAF; if the host group is in Monitor mode, the matches are only reported. Setup: Can I automatically block requests from IPs with a bad reputation (Blacklist Protection)?
- Both on together: With the defaults, both apply the same list. If the enforcement is to be differentiated per category (e.g. quarantine, CAPTCHA), the IP Reputation Protection rule rows are edited; the WAF's blacklist violations continue to appear in the records. If these violations are not wanted in the WAF records, Blacklist Protection in the WAF can be unchecked; in that case, the vService-specific Frontend Blacklist is not evaluated either.
- vService-specific list: Addresses to be blocked only for one vService are entered in the WAF's Frontend Blacklist field, and addresses to be blocked for all layers in Blacklist Content in IP Intelligence & Reputation (What is the difference between the vService blacklist and the IP intelligence list?).
- Freshness: How and how often the list is updated: Where do geolocation and IP reputation data come from and how often are they updated?
- Load Balancer and network layer: Can I block known malicious IPs (IP Reputation / blacklist category)?
Common Misconceptions
- "The WAF and IP Reputation Protection keep separate reputation lists." Both read the same device-wide blacklist; the list is managed on the IP Intelligence & Reputation screen.
- "If both are on, no WAF record is created." The WAF scan runs before the enforcement of IP Reputation Protection; the WAF record and counters are created, and the response of IP Reputation Protection goes to the client.
- "Frontend Blacklist Exclusions is a WAF whitelist." This field only cancels the blacklist match; the request continues to go through WAF inspection. For the inspection to be skipped entirely, Whitelist Condition is used.
- "While the WAF is in Monitor mode, a blacklisted address is blocked." In Monitor mode, the match is only reported; blocking happens in Blocking mode or while IP Reputation Protection is Active.
How it is done in the documentation
