Where do I see a vService's whole WAF configuration on one screen (WAF Management)?

Short answer

On the WAF Management tab. In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the WAF Management tab is opened on the screen that opens (accessing the screen); the same tab also opens with Edit in the right-click menu of the row in the WAF-Protected vService List and with the Edit shortcut in the header of the panel on the right of the screen. The tab is not a form; it consists of cards that summarize the settings with sentences (screen structure): at the top, the mode card of every host group (with the N page types and Analysis & Learning rows), then the signature summary strip, the Inspection & Blocking band (OWASP Protection Level, Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits), the Learning & Reporting band (Learning Methods, Log Settings, Periodic Reporting, Notifications, SIEM & Attack Details) and at the very bottom the Virtual Host Groups band. A setting is changed in the window opened with the Edit link or the pencil icon of the card. Page Types, OWASP Rules, the analysis and the report are separate tabs opened from here; Event Logs and Live Stats are fixed tabs of the same screen, while the device-wide signature layer is on the Signature & Rule Library screen. The whole screen requires monitoring permission in the WAF area; the editing entries on the cards appear only with modify permission in the WAF area.

Problem: The WAF Settings Seem to Be Spread Across Different Screens

To see in which mode the WAF of a vService works, how many page types have been learned, which traffic is left out of the inspection, which page is returned to the blocked client and who receives the notification, it seems as if the settings have to be opened one by one. The aim is to read the whole configuration at a glance and to go from there to the setting to be changed.

Solution: Three Methods

The three methods show the same configuration in different forms; selecting one of them is enough for reading.

Your situation	Suitable method
Reading the whole WAF configuration in sentences and editing it from there	Method 1: WAF Management
Seeing it as a diagram on the path that the request follows	Method 2: The flow diagram panel on the right
From the command line	Method 3: WEB-CLI

Method 1: WAF Management Recommended

• How it works The WAF Management tab shows the WAF settings of the vService as cards, on every card with sentences that describe the current state of the setting; when a setting changes, the card is updated by itself.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management
• Requirement WAF protection must be enabled on the vService (How do I enable WAF protection on a vService?). The whole screen requires monitoring permission in the WAF area; the Edit links and pencil icons on the cards appear only to users who have modify permission in the WAF area.
• vService type HTTP (the WAF works only on HTTP vServices)

Step-by-Step Configuration

1

Adım 1 Open the vService screen

In the Left Monitor Panel, WAF-Protected vServices is selected from the category tabs at the top left and the vService is clicked; the screen opens with the Dashboard tab that carries the name of the vService.

The same screen is also reached from the Configuration Menu → WAF → WAF-Protected vService List screen: when the row is right-clicked and Edit is selected, or when the row is clicked and Edit in the header of the preview that opens on the right is used, the WAF Management tab opens directly (Where do I see the list of WAF-protected vServices (WAF-Protected vService List)?).

2

Adım 2 Go to the WAF Management tab

The WAF Management tab is clicked. The whole screen requires monitoring permission in the WAF area and the tabs are not further separated by permission; for a user who has only Load Balancer permission, the screen does not open at all (tabs).

3

Adım 3 Read the cards

The cards are read from top to bottom:

Section	Content
Mode cards	One card for every host group; the large title is the mode of the group (Blocking Mode, Monitor Mode, Learning Mode). Named groups come first, and the default group comes at the very end with the name Default host group; if there is a single group, the card has no name. On the card, the N page types row opens the rule list of the group, and the Analysis & Learning row opens the analysis window.
Signature summary strip	Total Active Signatures, Unique Signature Patterns, Signature Categories, OWASP Web Coverage and OWASP API Coverage (out of 10) and the Active / Monitor / Disabled distribution of the signatures; the OWASP Rules link at the bottom right opens the signature screen of the vService.
Inspection & Blocking	OWASP Protection Level, Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits
Learning & Reporting	Learning Methods, Log Settings, Periodic Reporting (with the Generate Report link), Notifications (with the Notification Log link), SIEM & Attack Details
Virtual Host Groups	While there is a single group, an invitation to define a group; while there is more than one group, the distribution summary that starts with the sentence Requests are evaluated in N host groups, each with its own WAF mode and the Collective Analysis & Learning row; the plus icon adds a new group.

The Checks, Whitelist & Blacklist, Learning Methods, Periodic Reporting and Notifications cards, which have an on/off state, appear dimmed while they are off and carry the Disabled label. Which task is done from which card is in the what is done where table.

4

Adım 4 Open the editing window of the card if needed

If a setting is to be changed, on the mode cards and on the Virtual Host Groups band the Edit text in the bottom right corner of the title strip is clicked, and on the cards inside the bands the pencil icon of the card is clicked. The mode card opens the host group window (with the WAF Mode field), the Virtual Host Groups band opens the group list, and the other cards open a settings window that contains only the fields of that card. The change is saved with the Edit button at the bottom of the window; there is no separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1CardTR7 side

A setting is changed in the window of a card, saved with Edit, and the tab is returned to.

ExpectedThe sentence of the card shows the new value without the screen being refreshed

Method 2: The Flow Diagram Panel on the Right

• How it works The panel that opens on the right of the screen on the Dashboard and WAF Management tabs (WAF - WAAP Data Flow Panel in the docs) draws the WAF configuration as a diagram on the request path that extends from the listener addresses to the Backend Services; elements that are not configured do not appear in the diagram.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → right panel → Details
• Requirement No additional setting is needed; WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the vService screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category. The panel appears on the right of the screen on the Dashboard and WAF Management tabs; if it has been collapsed, it is opened with the handle on its left edge.

2

Adım 2 Examine the diagram

The diagram on the Details tab of the panel is read (panel tabs): the mode of the host groups, Whitelist & Blacklist, the enabled learning methods, the protection level and the enabled checks are shown on the request path. The details of the diagram: What does the flow diagram on WAF screens (Data Flow Panel) show?

Verification

1DiagramTR7 side

The diagram is compared with the cards on the WAF Management tab.

ExpectedThe mode, lists and learning methods that appear enabled on the cards also appear in the diagram

Method 3: WEB-CLI

• How it works The WAF configuration is read layer by layer in WEB-CLI: waf options shows the WAF settings of the vService, waf host-groups shows the host groups and their modes, and waf fw-rules shows the page types of a group (layers).
• Where it is opened WEB-CLI → waf options show · waf host-groups list · waf fw-rules list
• Requirement CLI access and WAF permission for the user
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Show the WAF settings

In the poolId field, the vServices are listed with the Tab key and the vService is selected (waf options · Command Summary):

waf options show poolId <vService>

2

Adım 2 List the host groups

The id value in the output is used as the group ID in the next command (waf host-groups · Command Summary):

waf host-groups list poolId <vService>

3

Adım 3 List the page types of the group

waf fw-rules list poolId <vService> hostGroupId <group-id>

Verification

1OutputTR7 side

The command outputs are compared with the WAF Management cards.

ExpectedThe protection level, the mode of the groups and the number of page types are the same as on the cards

Common Mistakes

• Looking for the rule list in WAF Management. The page types are on the separate Page Types tab opened with the N page types row on the mode card; the Any paths rule is also included in the count.
• Trying to make device-wide signature changes from here. OWASP Rules on the signature strip opens only the signature layer of this vService; the layer that affects all WAF-protected vServices is on the Signature & Rule Library screen (What is the difference between the vService's OWASP Rules screen and the global Signature & Rule Library screen?).
• Looking for logs and metrics on this tab. Individual requests are on Event Logs, instant counters are on Live Stats, and learning suggestions are on the monitoring tab that appears if AI Learning or Teacher is on (Where do I watch what the WAF is doing?).
• Looking for the mode at the vService level. The mode applied to the traffic is always the mode of the host group, and it is changed from the mode card (Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?).

How it is done in the documentation

• WAF Management · Screen Structure
• WAF Management · What Is Done Where?
• WAF-Protected vServices · Tabs
• Dashboard · WAF - WAAP Data Flow Panel

Related questions

• What does the flow diagram on WAF screens (Data Flow Panel) show?
• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?
• How do I read the entire configuration of a vService on a single screen (Load Balancer Management)?