What are the WAF operating modes?

Short answer

The WAF has three operating modes: Learning Mode, Monitor Mode and Blocking Mode. In Learning mode, the path, header and field structure inspections do not run and signature hits are not added to the score, the request is not blocked and the traffic is written to the learning log; in Monitor mode, the inspection and scoring are the same as in Blocking, but the request is not blocked, and a request that reaches the threshold is written to Event Logs; in Blocking mode, a request whose attack score reaches the OWASP Protection Level threshold is blocked. The mode is assigned not to the vService but to the Virtual Host Group; on a vService that works with a single group, this is the mode of the vService. When WAF is first turned on, the default group starts in Learning mode; the mode is changed from the Edit window of the mode card on the WAF Management tab, and the product does not change the mode on its own.

Modes

	Learning mode	Monitor mode	Blocking mode
Signature scan	Yes; field-based OWASP switches and exclusions are ignored	Yes	Yes
Structural and field inspections (Check Fields)	No path, header and field structure inspections; the body size, truncated body and multipart inspections run but do not enter the score	Yes	Yes
Attack score	Not accumulated	Accumulated	Accumulated
Blocking	No	No	If score ≥ threshold, the request is blocked (Blocking Status Code, default 418)
A request whose scan cannot be completed within the 2-second time limit	Let through (blocked if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode)	Let through (blocked if the scan was cut off while the rules were being loaded and before the host group was determined, and the vService has a group in Blocking mode)	Blocked; if Fail-open is on, let through without being scanned
Event Logs record	Not written	Written	Written
Learning log	Written	-	-
WAF Inspection Distribution series	Learning	Monitor for those that reach the threshold, Clean for the others	Blocked for the blocked ones, Clean for the others
Mode card	Blue · Learning mode — rules are not enforced yet	Yellow (amber) · Attacks are only monitored, not blocked	Red · Attacks are blocked

• Scan time limit: The time the WAF can use to scan a request is 2 seconds; ordinary scans take milliseconds, and this time is not a setting. The time counts only the scan itself; waiting for the body to arrive from the network is not included in this time. If the scan cannot be completed within this time (e.g. in a very large or complex request), the WAF cannot make a decision about the request. In a group in Blocking mode, the request is blocked so that an uninspected request does not reach the Backend Service, and the client receives the usual blocking response; in Learning and Monitor modes, the request is let through (the only exception is the scan being cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is also blocked; Teacher and Conditional Learning requests are outside this exception (WAF Mode · Blocking Mode)). If these requests also need to be let through, Fail-open in the Request Body Limits window is turned on; since these requests pass without being scanned while it is on, the option is turned on only if these blocks affect the service (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• The details of how the mode is applied to which request: runtime behavior of the modes.
• The mode is separate from the learning methods under Learning Methods (Conditional Learning, Teacher, AI Learning) and from the State value of the signature (Enabled, Monitor, Disabled) (difference between WAF mode and the learning methods).
• Requests that match the whitelist side of the Whitelist & Blacklist screen (static content within the scope of Do not WAF static contents, requests that match the Whitelist Condition) are not affected by the mode, because they do not enter the WAF inspection.
• The mode change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.
• Changing the mode: When should I move from Learning to Monitor and from Monitor to Blocking?

Common Misconceptions

• "The Monitor state of a signature and Monitor mode are the same." The State value of a signature affects only that signature, whereas WAF Mode affects all the traffic in the Virtual Host Group.
• "The WAF moves to Blocking on its own when learning is finished." The product has no automatic mode transition; transitions are made manually from the mode card.
• "A 418 response seen in Learning or Monitor mode comes from the WAF." In a group in these modes, the WAF does not block the request; a request whose scan cannot be completed within the time limit is also let through (the only exception is the scan being cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is blocked (WAF Mode · Blocking Mode)). Where the 418 comes from and how to find it: Can a request be blocked with 418 even in Learning or Monitor mode?

How it is done in the documentation

• WAF Mode · What Is WAF Mode?
• WAF Mode · Runtime Behavior of the Modes
• WAF Mode · The WAF Mode Edit Screen
• Virtual Host Groups · What Is Virtual Host Groups?

Related questions

• What does the WAF do in Learning mode; are attacks blocked?
• What does the WAF do in Monitor mode?
• What does the WAF do in Blocking mode?