FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What does the flow diagram on WAF screens (Data Flow Panel) show? ​

Short answer

The flow diagram on the right of the Dashboard and WAF Management tabs (WAF - WAAP Data Flow Panel) draws how the traffic flows from the listener addresses to the WAF inspections and to the Backend Services according to the current configuration; it does not show traffic volume. The header contains the vService name and the combined status dot (green OK, red Error, yellow Warning, blue Evaluating, gray Disabled; in a cluster, the left half shows the status of this device and the right half the status of the peer device), along with the Analyze and Edit shortcuts. The LB section shows the vService type, the listener addresses and the SSL, h3, Redirect SSL marks. In the WAF section, there are the mode badge if all host groups are in the same mode (Learning Mode blue, Monitor Mode yellow, Blocking Mode red), the W/B List node, the Learning Methods card that lists only the enabled learning methods, and the Virtual Host Groups, OWASP and Checks cards. Below the decision node, the Blocked (red), Clean (blue), Monitor and/or Teacher (yellow) results are drawn, along with the WHITELISTED path on the right if a whitelist is defined and the LEARNING path on the left if there is a learning scope. The bottom strip has the Blocking Page, Request Body Limits, Log Settings, SIEM & Attack Details and Periodic Reporting icons.

Sections ​

The panel has no separate title in the interface; in the docs, it is explained under the name WAF - WAAP Data Flow Panel.

SectionWhat it shows
HeaderThe vService name and the combined status dot. Analyze (only with the WAF permission) opens a closable Analyze tab on the same screen; Edit (only with modify permission in the WAF area) switches to the WAF Management tab
Panel tabsDetails (status strip, warnings, flow diagram) · Log (the WAF-tagged change records of the vService; Excel/CSV export) · Status Logs (status transitions)
LB sectionvService type, listener addresses (two halves in a cluster; (M) / (S) on VIPs), the SSL mark for SSL termination, h3 for QUIC, Redirect SSL for redirection from HTTP to HTTPS
WAF sectionMode badge · W/B List (Whitelist & Blacklist) · Learning Methods (the Conditional Learning, Teacher, AI Learning rows that are on) · Virtual Host Groups: N (N is the number of groups other than the default group) · OWASP: level (Total Active Signatures, Checks Applied) · Checks (Structure Checks, Argument Checks; a green check mark if on, a cross if off)
Decision nodeResult icons, the WHITELISTED and LEARNING paths, the Backends node
Bottom stripSummary cards of five settings; the pencil icon leads to the setting

Colors ​

ElementColor
Status dotGreen OK · red Error · yellow Warning · blue Evaluating · gray Disabled
Mode badgeLearning Mode blue · Monitor Mode yellow · Blocking Mode red; if the modes of the host groups differ, the badge is not shown
Decision node resultsBlocked red · Clean blue · Monitor and Teacher yellow (the two are distinguished by their icons)

The colors change tone according to the selected theme; yellow is the warning color of the theme.

What Does the Diagram Depend On? ​

  • The WHITELISTED path is drawn only while a whitelist is defined, and the LEARNING path only while Conditional Learning is on or a host group is in Learning mode.
  • The results of the decision node depend on the modes of the host groups: if there is a group in Blocking mode, the Blocked icon appears; if there is a group in Monitor mode or an enabled Teacher, the Monitor / Teacher icon appears. On a vService that works only in Learning mode and whose Teacher is off, no result icon is drawn below the node.
  • In the bottom strip, only the Periodic Reporting icon is shown faded while the e-mail report is off; the other four icons stay colored even while their setting is off.
  • The same diagram is also shown in the preview on the WAF-Protected vService List screen. Its counterpart on the LB side: What does the Data Flow Panel on the right of the vService screen show?

Common Misconceptions ​

  • "The diagram shows traffic volume." The diagram is a flow picture of the configuration; the numbers are in the Dashboard panels and in Live Stats.
  • "The Monitor badge and the result strip are orange." Both are drawn in a yellow tone, with the warning color of the theme.
  • "The panel can be closed." There is no close button; it is collapsed with the handle outside its left side, resized from its left edge, and its state is remembered per user.

How it is done in the documentation

Related questions