Can I enable TR7 WAF directly in Blocking mode without using Learning mode?

Short answer

Yes. No mode is selected when WAF is turned on, and a vService on which it is turned on for the first time starts in Learning Mode; then, for the Virtual Host Group, the WAF Mode can be changed on the WAF Management tab, in the Edit window of the mode card, directly to Blocking Mode. From that moment on, the protection blocks with the Signature & Rule Library signatures, the default inspections of the Any Paths rule and Blacklist Protection. The TR7 WAF defaults are set to keep the false positive probability low: at the default Very Tight level, Low-score signatures are not scanned and the OWASP Protection Level card shows the probability of blocking clean traffic as low, the limits of the Any paths rule are wide and it carries no parameter allow list, and since Do not WAF static contents is on, static content is not inspected. Still, the recommended path is the Learning → Monitor → Blocking transition (recommended life cycle): Learning brings the positive model against attacks without a signature into play by mapping the Page Types of the site, and Monitor shows the effect of the rule set without blocking users. If the move was made directly to Blocking, the Attack blocked records in Event Logs are monitored and false positives are taught with Allow / Teach.

Problem: What Changes When the Learning and Monitor Stages Are Skipped?

Learning Mode and Monitor Mode provide no protection; these stages exist not to delay protection but to fit the rule set to the site and to see its effect (When should I move from Learning to Monitor and from Monitor to Blocking?). When WAF is turned on, the rule set of the group contains only the Any Paths rule (Which default settings are created when WAF is enabled?). Which parts of the protection work when moving directly to Blocking Mode:

Inspection	Direct Blocking	Learning → Monitor → Blocking
Signature scan	Works; at the default Very tight level, a single Medium or higher hit blocks, Low signatures are not scanned	Same; its effect is first monitored in Monitor mode without blocking
Blacklist (Blacklist Protection)	Works (on by default)	Same
General inspections of the Any paths rule	Works; the limits are wide (path length up to 8192, depth up to 256, standard HTTP methods allowed, no parameter allow list)	Same; applied to the paths that have not been learned
Page-specific positive model (allowed parameters, methods, lengths)	None; the Page Types have not been learned yet, deviations without a signature are caught only by the Any paths limits	Works once the Analysis & Learning result is applied (Can TR7 WAF catch a zero-day attack without a signature?)
Learning log	Not written; only requests that arrive with the Conditional Learning identity are learned	In Learning mode, all traffic is written
Where a false positive is first seen	The blocked user; Attack blocked in Event Logs	Not blocked — Monitor mode in Event Logs in Monitor mode; the user is not blocked

Solution

WAF is turned on in the vService and the mode of the default group is moved to Blocking mode in the same session. Steps of the recommended three-stage transition: What should I do first after enabling the WAF?

Enabling WAF and Moving It Directly to Blocking Mode

• How it works No mode is selected when WAF is turned on; the default group of a vService on which it is turned on for the first time starts in Learning mode. The mode of the group is moved to Blocking mode from the mode card on the WAF Management tab; the change is applied without a separate deployment step and without dropping open connections.
• Where it is opened Configuration Menu → WAF → WAF-Protected vService List → Enable · Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card → Edit
• Requirement HTTP vService; WAF - WAAP license; modify permission in the WAF area (scope and limits)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the prerequisites

The vService to be protected must be of the HTTP type. The content of HTTPS traffic is inspected only when TLS is terminated on this vService (Can the WAF see the content of HTTPS traffic; what is required for that?). If there is a CDN or proxy in front of TR7, a Trusted Proxy profile is assigned to the vService; otherwise, the blacklist inspection and the client addresses in Event Logs work according to the address of the proxy (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?).

2

Adım 2 Open the WAF list

The Configuration Menu is opened with the TR7 logo at the bottom left and WAF → WAF-Protected vService List is selected (how to access).

3

Adım 3 Open the Enable tab

Enable on the toolbar is clicked; a tab titled Add opens next to the list.

4

Adım 4 Select the vService

The vService is selected in the HTTP vServices to WAF field. This tab has only the vService selection; no mode is selected. For a single vService, protection can also be turned on with the WAF box in the vService form (How do I enable WAF protection on a vService?).

5

Adım 5 Turn on WAF

Add at the bottom of the tab is clicked; the vService appears in the list. Enabling is applied without a separate deployment step and without dropping open connections. The default group of a vService on which WAF is turned on for the first time is in Learning mode; a vService whose WAF was previously on and then turned off returns with its saved mode.

6

Adım 6 Open the WAF Management tab

In the Left Monitor Panel, the WAF-Protected vServices category is selected, the vService is clicked and the WAF Management tab is opened. The mode card at the top of the screen appears as a blue Learning mode (mode strip).

7

Adım 7 Open the edit window of the mode card

Edit in the title strip of the mode card is clicked; a window titled Edit opens (WAF Mode Edit screen). Edit is visible only to a user who has modify permission in the WAF area. If there are multiple Virtual Host Groups, each group has its own card, and each of them is changed separately.

8

Adım 8 Select Blocking mode

Blocking mode is selected in the WAF Mode field. The window also contains the Virtual host group name field; it is not changed.

9

Adım 9 Save

The Edit button in the window is clicked. There is no additional confirmation window; the change is applied without a separate deployment step and the card becomes a red Blocking mode. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Mode cardTR7 side

The color and the sentence of the mode card on WAF Management are examined.

ExpectedRed Blocking mode · Attacks are blocked

2Test requestClient side

A request whose query contains an SQL injection pattern is sent from a client that does not carry the Teacher or Conditional learning identity.

Command: curl -s -o /dev/null -w '%{http_code}\n' "https://www.example.com/?id=1%27%20OR%20%271%27%3D%271"

Expected418

The code is the Blocking Status Code setting of the vService (default 418). The request appears in Event Logs with the Attack blocked decision.

3False positive monitoringTR7 side

In the days after the switch, the Attack blocked records on the Event Logs tab of the vService and the WAF Blocked Requests panel on the Dashboard are monitored; the records that belong to the requests of legitimate users are picked out.

ExpectedAttack blocked records only on attack requests

If it is seen that a legitimate request has been blocked, the record is selected and taught with Allow; if there are many false positives, the group is temporarily moved to Monitor mode.

Common Mistakes

Event Logs must be monitored after the switch

In direct Blocking mode, the effect of the rule set on real traffic is not seen in advance; the first false positive comes to light when a legitimate user is blocked. After the switch, Event Logs is reviewed regularly; the record of the legitimate user's blocked request is taught with Allow / Teach (How do I allow a request that was blocked by mistake?).

• Not checking the file types that are uploaded to the application. By default, the Any paths rule carries a 14-type file type allow list for multipart uploads, and an allow list of only text/plain and application/octet-stream for raw bodies; the type is determined from the content of the file and of the body. Requests that upload a file or send a body of a type that is not on the list receive a 24-point structural violation and are blocked in Blocking mode. The types that the application accepts are added to the lists on the Form and RAW tabs of the Any paths rule (Form · Allowed Upload Mime Types, RAW · Allowed Raw Body Mime Types).
• Trying to sort out many false positives in Blocking mode. If the blocks are frequent, the group is temporarily moved to Monitor Mode; the records continue to be written as Not blocked — Monitor mode and are cleaned up without users being blocked (How do I use Monitor mode to weed out false positives?). If a single signature causes problems, only the State value of that signature is set to Monitor.
• Solving a false positive by lowering the protection level. Loosening the level also lets real attacks through; it is solved per signature or per field (Is it better to disable a signature entirely or to add an OWASP exclusion?).
• Never setting up the positive model. Since the learning log is not written in direct Blocking mode, page-specific rules do not form on their own. The site can be browsed with the Conditional Learning identity without breaking Blocking and taught with Analysis & Learning (Can I still keep learning certain traffic while in Blocking mode (Conditional Learning)?); for APIs that have an OpenAPI document, the rules are set up with Import (OpenAPI).
• Moving to Blocking mode behind a CDN without assigning Trusted proxy. All requests appear to come from CDN addresses; the blacklist inspection and the client addresses in Event Logs do not show the real client.

How it is done in the documentation

• WAF Mode · The WAF Mode Edit Screen
• WAF Mode · Recommended Life Cycle
• How to Enable WAF? · What Is Created After It Is Enabled?
• OWASP Protection Level · What Is OWASP Protection Level?
• Event Logs · Allow / Teach

Related questions

• What should I do first after enabling the WAF?
• When should I move from Learning to Monitor and from Monitor to Blocking?
• How do I tell that a legitimate request was blocked by the WAF?
• How do I use Monitor mode to weed out false positives?