How is a consistent WAF policy managed across many vServices?

Short answer

In TR7, there is no single WAF policy or template object bound to several vServices: the WAF settings are kept per vService, and WAF Mode and the rule set per host group (management and operation). Consistency is achieved with four tools. On the signature side, the global layer in Signature & Rule Library applies the status, score or scope of a signature and the custom rules to all WAF-protected vServices at once; vService-specific differences stay in the OWASP Rules screen of that vService and override the global layer (rule layers). On the settings side, waf options update-many in WEB-CLI writes settings such as the protection level, the blocking page, body limits and notifications with the same value to the selected or all WAF-protected vServices. On the mode and default rules side, waf host-groups update-many, add-arg-headers and reset-rules run on the groups selected from among the host groups of all WAF-protected vServices or on all groups. On the rule set side, the Export file of a reference host group is loaded into the other groups with Import. Shared objects such as the Content Pages profile and Load Balancer conditions are changed once and are reflected in every vService that uses them. Compliance is monitored with the WAF mode and OWASP Protection Level columns of the WAF-Protected vService List, and events with Global WAF Event Log and Global WAF Report; permissions are separated with the WAF manager, WAF user and WAF read-only roles.

How Does It Work?

The WAF configuration is kept at three levels; for consistency, the own tool of each level is used.

Level	What is kept	Its scope	Consistency tool
Device	The built-in signature library and the global layer on top of it (signature status, score, scope, custom rules); the Global WAF Report setting	All WAF-protected vServices	Signature & Rule Library
vService	WAF settings: OWASP Protection Level, Checks, Whitelist & Blacklist, Blocking page, Request Body Limits, Learning methods, Log settings, Periodic reporting, Notifications, SIEM & Attack Details; the OWASP rules layer of the vService	Single vService	waf options update-many; OWASP rules differences separately on each vService
Host group	WAF mode and the rule set (page types, Any paths, Check fields)	Single host group	waf host-groups update-many, add-arg-headers, reset-rules; Export → Import

In signatures, precedence is applied field by field in the order vService layer → global layer → built-in library: a field changed in the vService layer overrides the value of the same signature in the global layer for that vService (What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?).

Consistency Tools

Task	Tool	Scope	Details
Setting a signature to Monitor everywhere, changing its score, adding a custom rule	Configuration Menu → WAF → Signature & Rule Library	All WAF-protected vServices	How do I fix the same false positive on several vServices at once (global layer)?
Aligning the protection level, the blocking response, body limits and notifications	waf options update-many	Selected or all WAF-protected vServices	Can I change the WAF settings or host group mode of several vServices at once?
Aligning the mode of host groups	waf host-groups update-many	Selected or all host groups (on all WAF-protected vServices)	Can I change the WAF settings or host group mode of several vServices at once?
Returning the Any paths rule to its default definition according to the protection level; spreading the default header checks	waf host-groups reset-rules · waf host-groups add-arg-headers	Selected or all host groups	How do I reset the rules to the default settings?
Duplicating a reference rule set	Page types → Export · in the target group, Import (full replacement) or Import (OpenAPI) (merge)	Group by group	Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?
Keeping the blocking page, the whitelist or the log suppression condition common	Using the same Blocking Page Profile and the same Load Balancer conditions	Every vService that uses the profile or the condition	Why is the 418 status code returned by default on a block; can I change it?

• Changing the global layer in Signature & Rule Library requires full permission in the WAF area (WAF manager, Traffic+WAF manager, Admin); for the OWASP rules layer of the vService, modify permission in the WAF area is enough.
• While writing the protection level in bulk, waf options update-many does not rebuild the Any paths rule. The default definition of Any paths is stricter only at the Aggressive level (narrower length limits, only GET, HEAD and OPTIONS; JSON, XML and form bodies are completely blocked, so the own page type of the endpoints that accept a body is defined beforehand); when the protection level is set to Aggressive or moved from Aggressive to another level, waf host-groups reset-rules target selected scope defaultRule is run afterwards to build the Any paths rule with the definition of the new level. This operation deletes the manually added and learned checks in the Any paths rule.
• There is no bulk settings form across vServices in the interface; bulk writing is done with WEB-CLI (Can I change the same field on multiple objects at once?).

Monitoring and Permissions in TR7

• Compliance view: On the Configuration Menu → WAF → WAF-Protected vService List screen, the WAF Mode column of each row shows the mode distribution of the host groups (e.g. "2 Blocking"), and the OWASP Protection Level column shows the protection level; with sorting and filtering by the columns, the vServices that have remained different are found (Where do I see the list of WAF-protected vServices (WAF-Protected vService List)?).
• Device-wide events: Global WAF Event Log gives the records of all WAF-protected vServices on a single screen, and Global WAF Report gives the device-wide report. Neither of them appears in the menu on accounts restricted to specific vServices (Can I see the WAF logs of all vServices on one screen (Global WAF Event Log)?, Can I get a single WAF report for the whole device (Global WAF Report)?).
• Role separation: WAF Manager has full permission in the WAF area (including the global layer); WAF User works with modify permission only on the vServices assigned to it; WAF Read-Only can only view. In bulk WEB-CLI commands, the target list and the target all scope of a user restricted to specific vServices are limited to its own vServices (Can I define users who only have monitoring rights, or who can manage only specific vServices?). Such a user cannot select, in the WAF settings of its own vService, a condition, content page or profile that is used only on the vServices of another restricted account; the save is rejected with the "… is used only on the vServices of another restricted account, which manages it …" warning, and the user is asked to create its own object with the same settings.
• Audit trail: Bulk commands leave a separate record for each target; the history of WAF changes: Where do I see the change history of WAF settings?
• Cluster: WAF settings, host groups and rule sets are also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, they are sent with Synchronize.

Common Misconceptions

• "When a template changes, the bound vServices are updated." There is no template object; the change is written to the targets with the tools each time, and the vServices added later are updated separately with the same tool.
• "A change in the global layer gives the same result on every vService." If the OWASP rules screen of the vService has a changed field for the same signature, the vService layer applies on that vService.
• "The Export file carries all the WAF settings of the vService." The file carries only the rule set of a single host group; the protection level, the blocking page, the learning settings and the OWASP rules changes are not included in the file.
• "Collective Analysis & Learning works across vServices." Collective Analysis & Learning is for the host groups of a single vService.

How it is done in the documentation

• WAF · Management and Operation
• Signature & Rule Library · The Rule Layers
• WEB-CLI waf options · Bulk Update
• WEB-CLI waf host-groups · Bulk Update
• WAF-Protected vService List · vService Listing Screen

Related questions

• Can I change the WAF settings or host group mode of several vServices at once?
• How do I fix the same false positive on several vServices at once (global layer)?
• What are the rule layers (built-in library, global layer, vService layer); which one takes precedence?
• Can I manage the WAF with WEB-CLI; which operations are not available in WEB-CLI?