Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What does the WAF do in Blocking mode?
Short answer
Blocking Mode is the full protection mode: the request is inspected, signature matches and structural violations are scored, and if the total score reaches the threshold determined with OWASP Protection Level (is equal to or greater than it), the request is blocked without being forwarded to the Backend Service. The Blocking Page content and the Blocking Status Code (default 418) are returned to the client; if Conditional Blocking Pages are defined, the first page whose condition matches and its status code are used. The blocked request is written to Event Logs with the Attack blocked decision and is counted in the Blocked series in the WAF Inspection Distribution panel on the Dashboard. A request whose scan cannot be completed within the 2-second time limit is also blocked so that an uninspected request does not reach the Backend Service, and it is not written to Event Logs; while Fail-open in the Request Body Limits window is on, these requests are let through without being scanned. Requests that come with the Teacher and Conditional Learning identity (even if their scans cannot be completed within the time limit) and requests that match the whitelist side (Do not WAF static contents, Whitelist Condition) are not blocked in Blocking mode either.
In Blocking Mode
| Request | Result | Event Logs (Action) |
|---|---|---|
| Score ≥ threshold | Blocked (How does TR7 WAF decide whether to block a request?) | Attack blocked |
| Score < threshold | Passes | No record |
| Score < threshold, but a signature with State = Monitor matched | Passes | Not blocked — Below the blocking threshold |
| Teacher is on and the request carries the Teacher identity | Passes | If score ≥ threshold or a signature with State = Monitor matched, Not blocked — Teacher IP matched (Teacher cookie or Teacher header, depending on the identity) |
| Conditional Learning identity | Processed as in Learning mode, passes (Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?) | No record |
| Static content within the scope of Do not WAF static contents or a request that matches the Whitelist Condition | Does not enter the WAF inspection | No record |
| Blacklist Protection is on and the source IP is on the blacklist (Blacklist IP Category lists or Frontend Blacklist) | 100 points are added; since the loosest threshold is 24, it is blocked (except for the addresses in Frontend Blacklist Exclusions) | Attack blocked |
| Its scan cannot be completed within the 2-second time limit | Blocked; if Fail-open is on, let through without being scanned | No record; if Debug Mode is on for the vService, Attack blocked — scan timed out in Debug Mode Logs (What happens to a request if the scan exceeds a certain time (2-second scan limit)?) |
- The blocking decision is made after the scan is finished; all sections of the request are scanned, and all matches are written to the same record.
- If Bot/DDoS protection is also on for the vService, its blocking actions are evaluated before the blocking response of the WAF (Blocking Page).
- Where the blocked requests are monitored: the WAF Blocked Requests panel on the Dashboard and Event Logs. Finding the blocking rule: Legitimate users are being blocked; how do I find which rule is blocking them?
Common Misconceptions
- "In Blocking mode, only the requests that exceed the threshold are blocked." A request whose score is equal to the threshold is also blocked; the threshold is the OWASP Protection Level value (default Very tight, 4).
- "418 is always returned with the same page." 418 is the default Blocking Status Code value; the code can be changed, and Conditional Blocking Pages can use their own status code.
- "Learning stops in Blocking mode." The learning methods work independently of the mode; in a group in Blocking mode, new pages can be taught with Conditional Learning.
How it is done in the documentation
