Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Where do I see the list of WAF-protected vServices (WAF-Protected vService List)?
Short answer
On the WAF-Protected vService List screen under Configuration Menu → WAF. The list contains all HTTP vServices whose WAF protection is enabled; on every row, the status, the name, the listened addresses, WAF Mode (the mode distribution of the host groups, e.g. 2 Blocking, 1 Learning; with the +Teacher and +Conditional learning suffixes if Teacher or Conditional Learning is on), OWASP Protection Level and the Periodic Reporting frequencies appear (listing screen). The same screen is the place where the protection is turned on and off: on the tab opened with Enable, HTTP vServices are selected and the protection is started; with Disable, the protection of the selected rows is removed without a confirmation being asked; the removal does not delete the WAF configuration. Edit in the right-click menu of the row opens the WAF Management tab of the vService, while Dashboard in the preview opens the WAF Dashboard screen of the vService. For monitoring, the same list appears in the WAF-Protected vServices category in the Left Monitor Panel, by default together with the number of blocked requests. The screen requires WAF permission; an account whose vServices are restricted sees only the vServices defined for it (scope and limits).
Problem: It Is Not Known on Which vServices the WAF Is Enabled
When there are many vServices on the device, the aim is to see on which of them the WAF protection is enabled, and in which mode and at which protection level each of them works, without opening the vService forms one by one; the place where the protection is turned on and off is also looked for.
Solution: Two Methods
The two methods list the same vServices: WAF-Protected vService List is used for management and bulk turning on and off, and the Left Monitor Panel is used for continuous monitoring.
| Your situation | Suitable method |
|---|---|
| Seeing the mode, the protection level and the report settings; turning the protection on and off | Method 1: WAF-Protected vService List |
| Monitoring on the left of the screen, always open, with the numbers of blocked requests | Method 2: Left Monitor Panel |
| Seeing the total of the WAF events of all vServices | The WAF tab of the Home screen: Can I see the WAF status of all vServices at a glance on the home page? |
Method 1: WAF-Protected vService List Recommended
- How it worksWAF-Protected vService List lists the HTTP vServices whose WAF protection is enabled with a summary of their settings; the list is updated by itself as the configuration changes.
- Where it is opened Configuration Menu → WAF → WAF-Protected vService List
- Requirement WAF permission; modify permission in the WAF area to turn the protection on and off
- vService type HTTP (L7 TCP and Network vServices are not included in the list)
Step-by-Step Configuration
1
Adım 1 Open the list
The Configuration Menu is opened by clicking the TR7 logo at the bottom left; on the WAF tab, WAF-Protected vService List is selected (how to access). It is also opened by typing the screen name in the search bar at the bottom left of the screen (Alt + T on Windows).
2
Adım 2 Read the columns
| Column | Content |
|---|---|
| Status | The status of the vService; in a cluster, the circle is two halves for the two devices. |
| Name | The name of the vService |
| Address column | The listened addresses and ports; in a cluster, a separate column for every device, with the name of the device in the header |
| WAF Mode | The mode distribution of the host groups, from most to fewest (e.g. 2 Blocking, 1 Learning); the enabled learning methods with the +Teacher and +Conditional learning suffixes |
| OWASP Protection Level | The protection level (e.g. Very Tight) |
| Periodic Reporting | The frequencies of the e-mail report; - if the report is off |
Selecting and filtering the columns: Columns, Filter. How the mode of a host group is summarized on the screen: Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?
3
Adım 3 Open the preview
The row is clicked; the preview of the vService opens on the right. Edit in the header opens the WAF Management tab, and Dashboard opens the WAF Dashboard screen of the vService. The Details tab shows the WAF configuration as a diagram on the request path, and the Status Logs tab shows the status transitions (preview).
4
Adım 4 Go to WAF Management if needed
The row is right-clicked and Edit is selected from the single-action menu; the WAF Management tab of the vService opens (Where do I see a vService's whole WAF configuration on one screen (WAF Management)?).
Turning the protection on and off
Enable on the toolbar opens a tab titled Add next to it; in the HTTP vServices to WAF field, HTTP vServices whose WAF is off are selected and the protection is started with the Add button. A vService whose WAF is turned on for the first time starts with the Very Tight protection level and Learning mode; a vService that was turned on and off before, on the other hand, returns with its previous rules, settings and host group modes. Disable removes the protection of the vServices selected with the boxes at the beginning of the rows without asking for a confirmation; the rules, host groups and settings are not deleted, and when the protection is turned on again, the same configuration is in effect. Turning the protection on requires a WAF license. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize. Details: Can I enable or disable WAF on several vServices at once?
Verification
1ListTR7 side
After the mode of a vService's host group is changed in WAF Management, the list is returned to.
Expected
The WAF Mode column shows the new distribution without a refreshMethod 2: Left Monitor Panel
- How it works The WAF-Protected vServices category in the Left Monitor Panel lists the same vServices with a status color and a selected metric; the default metric is the WAF Blocked Requests total of the last day.
- Where it is opened Left Monitor Panel → category selector → WAF-Protected vServices
- Requirement WAF permission
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Select the category
WAF-Protected vServices is selected from the category tabs at the top left of the Left Monitor Panel (accessing the screen). If the category is not in the list, the user does not have WAF permission or the category has been removed with Edit Tabs.
2
Adım 2 Open the View Settings window if needed
If the displayed metric is to be changed, the Settings button of the panel (or the metric info row) is clicked; the View Settings window opens. If the metric is not to be changed, steps 2–4 are skipped.
3
Adım 3 Select the Primary Metric
In the Primary Metric field, WAF mode or OWASP protection level is selected from the Static group; this makes the mode or the protection level appear on every row instead of the number of blocked requests.
4
Adım 4 Accept
The Accept button at the bottom of the window is clicked. The setting is stored per user and per category.
5
Adım 5 Open the vService
The row is clicked; the WAF Dashboard tab of the vService opens on the main screen. The vService List button in the panel opens the WAF-Protected vService List screen.
Verification
1Number of rowsTR7 side
The rows in the panel are compared with the rows in WAF-Protected vService List.
Expected
The same vServices in the two listsCommon Mistakes
- Assuming that Disable will ask for a confirmation. Disable removes the protection of all selected rows the moment it is clicked; the selection is reviewed before the button is pressed. Clicking a row and opening the preview does not select the row; the selection is made with the boxes at the beginning of the rows.
- Thinking that Disable deletes the WAF settings. Only the protection is turned off; the rules, host groups and settings are kept (If I remove WAF protection, are the learned rules and settings deleted?).
- Looking for a vService whose WAF is off in the list. Only HTTP vServices whose protection is enabled appear in the list; the ones that are off are in the selection list on the tab opened with Enable.
- Looking for WAF setting changes on the Log tab of the preview. The Log tab in the preview of this screen lists Load Balancer records; for the change history of the WAF settings: Where do I see the change history of WAF settings?
How it is done in the documentation
