Can I back up my WAF rules?

Short answer

Yes, at two levels. The rule set of a host group (the page types, Any paths and the Check fields inspections of every rule) is taken as a JSON file with Export on the Page Types screen and restored with Import on the same screen; Import replaces all the existing page types of the group. Export requires modify permission in the WAF area, and the name, the pattern and the mode of the host group, the vService WAF settings and the signature changes are not included in the file. The backup that covers all of these is the system backup on the Settings → Backup & Restore screen: it is taken instantly with Add, and automatically according to the plan in Backup Settings (default Classic (daily), every day at 00:00). Applying a system backup with Apply Backup File returns the whole configuration of the device to that backup and is not transferred to the peer device in a cluster; the rules of a single vService are extracted from an old system backup with Export WAF Rules in the backup preview and imported. The Export (OpenAPI) file is not used instead of a backup, because its restore is a merge.

Problem: There Is No Copy to Return to If the Rule Set Is Broken

The rule set built up through learning, analysis and manual editing may need to be returned to its previous state after a faulty Import, Merge, applying of an analysis or bulk deletion. Because the applying of analyses and Import cannot be undone, a copy taken before the change is needed.

Solution: Four Methods

Methods 1 and 2 are used together (take a backup, restore it when needed). Methods 3 and 4 take the same system backup from the interface or from WEB-CLI; this backup covers the WAF settings and the signature layers as well as the rule set.

Your situation	Suitable method
Backing up the rule set of a host group before a change	Method 1: Page Types Export
Restoring the backed-up rule set	Method 2: Restoring with Import
Backing up everything, including the WAF settings and the signature layers	Method 3: System backup
Taking the system backup from the command line	Method 4: WEB-CLI
Taking the rules in an old system backup back to a single vService	Can I extract only the WAF rules from an old system backup (Export WAF Rules)?

Method 1: Page Types Export Recommended

• How it worksExport downloads all the page types of the selected host group, the Any paths rule and the Check fields inspections of the rules as a single JSON file. The operation does not change the configuration.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card → N page types → Export
• Requirement Modify permission in the WAF area (the request of a WAF read-only user is rejected)
• vService type HTTP
• Not included in the file The name of the host group, Virtual Host Patterns and WAF mode; the vService WAF settings (protection level, Checks, Whitelist & Blacklist, Blocking page, body limits, learning, report and notification settings); OWASP rules and Signature & Rule Library changes

Step-by-Step Configuration

1

Adım 1 Open the Page Types screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the WAF Management tab is opened. The N page types row on the mode card of the host group to be backed up is clicked; the Page Types tab that carries the name of the host group opens (accessing the screen).

2

Adım 2 Click the Export button

The Export button on the toolbar is clicked. The operation is independent of the selection in the table and does not ask for a confirmation; the file is downloaded named with the vService name, the host group name and the date-time (for the default group, e.g. Web_Servisi-DEFAULT_HOST_GROUP_20261002_1430.json; spaces become _) (export steps). The file is a detailed map of the protection; it is stored in a place with restricted access.

3

Adım 3 Repeat for the other host groups

If there are multiple host groups on the vService, the Page types screen of every group is opened from its own mode card and Export is done separately; a file carries the rules of only one group.

Verification

1User LogsTR7 side

On the User Logs screen, Field = WAF and Action type = Export are filtered.

ExpectedN WAF rules are exported for group@vService

N is the same as the page types count on the mode card (including Any paths).

Method 2: Restoring with Import

• How it worksImport loads the rules in the file into the selected host group; all the existing page types of the group are deleted and the ones in the file take their place. If the file does not contain the Any paths rule, Any paths is recreated with its default configuration.
• Where it is opened The Page Types screen of the target host group → Import
• Requirement Modify permission in the WAF area; a file taken with Export
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Page types screen of the target group

The N page types row on the mode card of the host group into which the rules will be loaded is clicked. The file does not carry the information of which group it was taken from; if it is loaded into the wrong group, the rule set of that group changes.

2

Adım 2 Back up the existing set

For a return point, the current rule set of the group is first downloaded with Export (Method 1).

3

Adım 3 Click the Import button

The Import button on the toolbar is clicked; the file picker opens (import steps).

4

Adım 4 Select the file

The .json file taken with Export that is to be restored is selected.

5

Adım 5 Confirm

Yes is clicked at the Are you sure? question. If the file cannot be read as JSON, the Corrupted WAF rules file error is given; if the pattern of a rule is invalid, the Invalid WAF pattern (...) error is given, and the existing set does not change (validation and errors). On a successful load, no separate notification is shown; it is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Rule listTR7 side

The Page types list and the counter on the mode card are examined; in User Logs, Field = WAF, Action type = Import are filtered.

ExpectedN WAF rules are imported from file for group@vService

Method 3: System Backup

• How it works The system backup contains the whole configuration of the device. In terms of WAF, it covers the vService WAF settings, the host groups (name, pattern, mode) and the rule sets, the OWASP rules layer of the vServices, the device-wide layer in Signature & Rule Library, and the shared Load Balancer objects such as the Whitelist condition and the blocking page content profile. Traffic records such as Event Logs are not included in the backup.
• Where it is opened Configuration Menu → Settings → Backup & Restore → Add
• Requirement Modify permission in the Settings area; among the built-in roles, only Admin has it (WAF manager cannot see this screen).
• Scope The whole configuration of the device; the backup is kept on the device it is taken on

Step-by-Step Configuration

1

Adım 1 Open the screen

Configuration Menu → Settings → Backup & Restore is opened; the File List tab appears.

2

Adım 2 Click the Add button

The Add button on the toolbar is clicked; the Add Backup File tab opens.

3

Adım 3 Select the source and the name

In the Backup Source field, System (current) (default) is left selected; a descriptive name (e.g. waf-degisikligi-oncesi) is written in the Backup Name field. If the name is left empty, TR7 gives one.

4

Adım 4 Submit

The Submit button is clicked; the backup is added to the File List.

Automatic backup, off-device copy and restore

The automatic backup is taken with the Backup Plan on the Backup Settings tab; backups are downloaded with Download backup file in the preview or sent to an external target with File Forwarding. Apply backup file returns the whole configuration of the device (including the device users) to its state in the backup; it cannot be applied by selecting a single vService or only WAF, and it is not transferred to the peer device in a cluster. Details: Can I back up and restore the configuration?

Verification

1ListTR7 side

The new row in File list is clicked and the Details section of the preview is examined.

ExpectedBackup trigger: User

Method 4: WEB-CLI

• How it works The settings backup create command takes the system backup in Method 3 (settings backup · Command Summary). Page types Export and Import have no WEB-CLI equivalent.
• Where it is openedWEB-CLI
• Requirement CLI access and modify permission in the Settings area for the user
• Scope The entire configuration of the device

Step-by-Step Configuration

1

Adım 1 Take a backup

A backup is created by giving it a name (create):

settings backup create --name waf-degisikligi-oncesi

2

Adım 2 See the backup in the list

The backups of the last 7 days are listed (list):

settings backup list

Verification

1OutputTR7 side

The settings backup list output is examined.

ExpectedThe backup named waf-degisikligi-oncesi in the list

Common Mistakes

• Applying the system backup to revert only the WAF. Apply Backup File returns the whole configuration and the device users to the moment of the backup; for the rules of a single vService, the Can I extract only the WAF rules from an old system backup (Export WAF Rules)? path is used.
• Thinking that the rule file also carries the settings. The Page types file is only the rule list; the protection level, Checks, the blocking page, the learning settings, the mode of the host group and the signature changes are not included (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).
• Keeping the Export (OpenAPI) file as a backup. Import (OpenAPI) does a merge: the paths in the document are replaced, but the rules added after the backup are not deleted. For an exact return, the plain Export is used.
• Thinking that the Export Table file of the table is a backup. The Excel, CSV or PDF file carries only the visible columns and is not loaded with Import.
• Considering a single Export enough for multiple host groups. The rules of every group are taken into a separate file.
• Not taking a backup before Import. Import and the applying of analyses cannot be undone; the file taken with Export before the change is the only way back (What happens to existing rules when I Import (full replacement)?).

How it is done in the documentation

• Export · What Is Export?
• Import · The Validation and the Errors
• Backup & Restore · What Is Backup & Restore?
• Backup & Restore · Preview of the Selected Backup File

Related questions

• Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?
• Can I extract only the WAF rules from an old system backup (Export WAF Rules)?
• Can I back up and restore the configuration?