Can I change the WAF settings or host group mode of several vServices at once?

Short answer

Yes, with WEB-CLI. waf options update-many writes the same WAF setting (e.g. OWASP Protection Level, Blocking Status Code, notification thresholds) to the selected or all WAF-protected vServices; waf host-groups update-many changes the WAF Mode value (learning, monitor, blocking) of the selected ones among the host groups (Virtual Host Groups) of all WAF-protected vServices with a single command. target selected opens a selection list with checkboxes, and target all targets the whole collection; the records to be affected are reported in the warning, and nothing changes unless the confirmation word (evet or yes depending on the language of WEB-CLI) is typed (bulk update). By default, if one of the targets fails validation, no target is written; with --onError skip, the ones that pass are written. If Safety Snapshot Before Critical Operations is on (default), a safety backup is taken before writing. A bulk protection level change does not rebuild the rule sets; since the default definition of Any paths is stricter only at the Aggressive level, waf host-groups reset-rules or, on a single vService, Sync with Default WAF Rules is used to rebuild the Any paths rule according to the new level when switching to Aggressive or leaving Aggressive. There is no bulk settings form across vServices in the interface.

Problem: The Same Setting Is Changed One by One on Dozens of vServices

WAF settings are kept per vService, and WAF mode per host group. When the protection level, the blocking response or the host group mode needs to be brought to the same value on many vServices, opening the WAF Management screen of each vService separately takes time and carries the risk of a vService being skipped.

Solution: Three Methods

The methods are selected according to what is to be changed; they can be used together in the same maintenance work. All three run from WEB-CLI; there is no bulk settings form across vServices in the interface (Counterparts in the interface).

Your situation	Suitable method
vService WAF settings such as the protection level, the blocking page, body limits and notifications	Method 1: waf options update-many
The WAF mode value of host groups (e.g. setting them to Monitor before maintenance)	Method 2: waf host-groups update-many
Returning the Any paths rule to its default definition or spreading the default header checks	Method 3: reset-rules and add-arg-headers

Method 1: waf options update-many Recommended

• How it works The given fields are written to the WAF settings of each selected WAF-protected vService; the fields that are not given do not change. First all targets are validated, then all of them are written in a single operation.
• Where it is opened The WEB-CLI button at the bottom right of the panel → waf options update-many
• RequirementAccess CLI over WEB on for the user and modify permission in the WAF area (permission and role scope). For a user restricted to specific vServices, only its own vServices are in the selection list and in the target all scope.
• vService type HTTP (only WAF-protected vServices are listed)
• Fields not written in bulkpoolId and --syncWithDefaultFwRules; therefore, when the protection level is changed in bulk, the Any paths rule is not rebuilt (writable fields)

Step-by-Step Configuration

1

Adım 1 Open WEB-CLI

The WEB-CLI button at the bottom right corner of the panel is clicked; the TR7 WEB-CLI window opens (terminal window).

2

Adım 2 Write the command

target is the first and only required field; then the fields to be changed are written. Example: setting the protection level to Tight (8) on the vServices to be selected. Values: 24 Elementary · 16 Normal · 8 Tight · 4 Very tight · 2 Aggressive (basic inspections).

waf options update-many target selected --owaspProtectionLevel 8

To set the blocking response to 403 on all WAF-protected vServices:

waf options update-many target all --blockingStatusCode 403

3

Adım 3 Mark the targets

When target selected is written and no target is given, a list with checkboxes opens; only WAF-protected vServices are listed. The space key marks a row, Ctrl+A marks all the visible ones, typed text filters the list, and Enter confirms the selection (target selection and confirmation). If target all was used, the list does not open.

4

Adım 4 Confirm

The warning states the number of records to be affected and the selected vServices (with target all, it states that all records will be updated). To continue, evet is typed (yes in the English interface); if anything else is typed, the operation is cancelled.

5

Adım 5 Read the result report

The report shows, for each target, the result (e.g. applied, unchanged, failed), the applied fields and the fields that are not active on that target. The --onError default is abort: if one of the targets fails validation, no target is written and the error shows the blocking target with its ID. If the targets that pass should still be written, --onError skip is added to the command:

waf options update-many target all --maxOwaspExclusions 25 --onError skip

The change is applied without a separate deployment step. Before writing, if Safety Snapshot Before Critical Operations is on in Backup Settings (default), a safety backup is taken; if a backup was taken in the last 5 minutes or there has been no change since the last backup, this backup is skipped. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Giving targets in a script

In a run without a terminal (script), the selection list cannot open; the targets are written manually in the command with the --ids.0, --ids.1 … fields; these fields are not listed in the Tab suggestions (bulk update).

Verification

1List columnTR7 side

On the Configuration Menu → WAF → WAF-Protected vService List screen, the OWASP Protection Level column is examined.

ExpectedTight on the selected vServices

2RecordTR7 side

The setting of a target vService is displayed in WEB-CLI.

Command: waf options show poolId <vService>

ExpectedowaspProtectionLevel value 8

A separate "WAF settings edited" record is created in User Logs for each target.

Method 2: waf host-groups update-many

• How it works The host groups of all WAF-protected vServices are gathered in a single list; the WAF Mode value of the selected groups changes with a single command. The only field that can be written in bulk is --mode; the group name and the host list do not change in bulk (writable fields).
• Where it is openedWEB-CLI → waf host-groups update-many
• Requirement Access CLI over WEB and modify permission in the WAF area; for a user restricted to specific vServices, only the groups of its own vServices are in the list.
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Write the command

In WEB-CLI, the target and the new mode are written; the values are blocking, monitor, learning (bulk update). Example: setting the groups to be selected to Monitor before maintenance:

waf host-groups update-many target selected --mode monitor

2

Adım 2 Mark the groups

In the selection list, each row is in the "vService → group" format; the groups of different vServices are in the same list. The groups are marked with the space key and confirmed with Enter.

3

Adım 3 Confirm

The number of groups to be affected is shown; as in Method 1, evet (yes in the English interface) is typed. The result report reports each group separately; the --onError behavior is the same as in Method 1.

4

Adım 4 Return to the previous mode when maintenance ends

The same command is run again with the previous mode. For the case where all groups are to be set to Blocking mode:

waf host-groups update-many target all --mode blocking

For a single group of a single vService, waf host-groups update poolId <vService> id <group> --mode monitor is used instead of the bulk command; the ID of the group is seen in the waf host-groups list poolId <vService> output. The mode change is applied without a separate deployment step and is synchronized in the cluster as in Method 1.

Verification

1Mode columnTR7 side

The WAF mode column on the WAF-Protected vService List screen or the mode cards on the WAF Management screen of the vService are examined.

ExpectedThe selected groups are counted as Monitor

Method 3: reset-rules and add-arg-headers

• How it workswaf host-groups reset-rules rebuilds the rules of each selected host group from the default set; the strictness of the default template follows the own OWASP Protection Level value of each vService: at Aggressive, the strict set is used (narrower length limits, only GET, HEAD and OPTIONS; JSON, XML and form bodies are completely blocked, Block Unparsed Body is selected, Raw Body Size is at most 16,384 bytes, there is no allowed upload type), and at the other levels, the standard set is used. scope defaultRule rebuilds only the Any paths rule (including the default header checks), and the path-specific and learned rules remain; scope all deletes all the rules of the group. waf host-groups add-arg-headers applies the default header check set to the Any paths rule of the selected groups; it does not touch the rest of the rule.
• Where it is openedWEB-CLI → waf host-groups reset-rules · waf host-groups add-arg-headers
• Requirement Access CLI over WEB and modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Back up the rule set

The rule set of each host group to be reset is saved to a file with Export on its Page types screen (Can I back up my WAF rules?). The manually added and learned checks in the Any paths rule are deleted in the reset; the way back is to Import this file.

2

Adım 2 Write the command

To build the Any paths rule with the default definition of the new level after the protection level has been set to Aggressive in bulk or moved from Aggressive to another level (reset-rules):

waf host-groups reset-rules target selected scope defaultRule

The strict Any paths rule of Aggressive blocks methods such as POST and PUT and JSON, XML and form bodies in requests that match no page type. Therefore, the own page type of the endpoints that accept a body (forms, APIs, upload pages) is defined before the command (Analysis & Learning or Add); the switch can be made while the host group is in Monitor Mode, and the group can be returned to Blocking mode after Event Logs has been reviewed.

To spread only the current default header checks (add-arg-headers):

waf host-groups add-arg-headers target selected

3

Adım 3 Mark the groups

In the selection list, the groups are marked with the space key and confirmed with Enter.

4

Adım 4 Confirm

The warning states the number of groups to be affected; the operation is confirmed by typing evet (yes in the English interface). Before writing, the safety backup in Method 1 is taken; the change is synchronized in the cluster as in Method 1.

scope all

scope all deletes all the learned and manually written page types of the group; it cannot be undone without a backup. All the options for returning the rules to the default: How do I reset the rules to the default settings?

Verification

1Page typesTR7 side

On the Page types screen of the target group, the Any paths row is opened.

ExpectedAny paths in its default definition; path-specific rules in place

Counterparts in the Interface

There is no bulk settings form across vServices in the interface; the host group mode is also changed one by one in the interface, from the mode card of each group. What can be done in bulk in the interface:

Task	Its place in the interface	Scope
Turning on or removing WAF protection	Configuration Menu → WAF → WAF-Protected vService List → Enable / Disable (Can I enable or disable WAF on several vServices at once?)	Selected vServices
Rebuilding the Any paths rule according to the protection level	OWASP Protection Level card → Sync with Default WAF Rules	All host groups of a single vService
Changing the status, score or scope of a signature	Configuration Menu → WAF → Signature & Rule Library (global layer; How do I fix the same false positive on several vServices at once (global layer)?)	All WAF-protected vServices

Common Mistakes

• Using target all without seeing the scope. target all targets all WAF-protected vServices or all host groups; it is first tried on a small set with target selected.
• Building the Any paths rule of Aggressive before page types are defined. Since the strict set blocks JSON, XML and form bodies and the methods other than GET, HEAD, OPTIONS, the POST traffic coming to endpoints without a page type is cut off; the endpoints that accept a body are first defined with their own page type, or the switch is tried in Monitor mode.
• Thinking that a bulk protection level change also changes the Any paths rule. --syncWithDefaultFwRules is not in the bulk command; only the threshold changes. When switching to Aggressive or leaving Aggressive, Method 3 or, on a single vService, Sync with Default WAF Rules is used to build the Any paths rule with the default definition of the new level.
• Not reading the report after --onError skip. The change has not been written to the vServices in the failed rows; these targets are corrected separately.
• Trying to change the host group name or the host list in bulk. waf host-groups update-many takes only --mode; the name and the host list are changed group by group with waf host-groups update.
• Splitting the command into multiple lines. WEB-CLI runs each line as a separate command; the command is written on a single line.
• Looking for a bulk settings form in the interface. Bulk settings across vServices are made only with WEB-CLI (Can I change the same field on multiple objects at once?).

How it is done in the documentation

• WEB-CLI waf options · Bulk Update
• WEB-CLI waf host-groups · Bulk Update
• WEB-CLI waf host-groups · reset-rules: Returning the Rules to the Default Set
• API Commands · Bulk Update (update-many)
• Backup & Restore · Safety Snapshot Before Critical Operations

Related questions

• Can I enable or disable WAF on several vServices at once?
• Can I use different modes for different domains on the same vService?
• How do I reset the rules to the default settings?
• Can I change the same field on multiple objects at once?