Can I extract only the WAF rules from an old system backup (Export WAF Rules)?

Q: Can I extract only the WAF rules from an old system backup (Export WAF Rules)?

Yes. In the Settings → Backup & Restore list, the backup is clicked; Export WAF Rules is selected from the menu of the preview title or from the right-click menu of the row. In the window that opens, if a vService is selected in the vService field and a host group in the Host Group Name field, the rule set of that group is downloaded as JSON; if All is selected, the rules of all host groups of all vServices in the backup are downloaded as a single zip divided into vService folders. The file is in the same format as the Export file of the Page Types screen; it is loaded with Import on the Page Types screen of the target host group and replaces the existing page types of that group. In this way, the rules of a single vService are recovered from an old backup without rolling back the whole configuration of the device; the rules of a vService that existed when the backup was taken and was deleted later can also be taken into another vService. Only the page types (including the Any Paths and Check Fields checks) are included in the file; the vService WAF settings, the name, pattern and mode of the host group, and signature changes are not included. The backup screen requires Settings permission, and Import requires modify permission in the WAF area.

Short answer

Yes. In the Settings → Backup & Restore list, the backup is clicked; Export WAF Rules is selected from the menu of the preview title or from the right-click menu of the row. In the window that opens, if a vService is selected in the vService field and a host group in the Host group name field, the rule set of that group is downloaded as JSON; if All is selected, the rules of all host groups of all vServices in the backup are downloaded as a single zip divided into vService folders. The file is in the same format as the Export file of the Page Types screen; it is loaded with Import on the Page types screen of the target host group and replaces the existing page types of that group. In this way, the rules of a single vService are recovered from an old backup without rolling back the whole configuration of the device; the rules of a vService that existed when the backup was taken and was deleted later can also be taken into another vService. Only the page types (including the Any paths and Check fields checks) are included in the file; the vService WAF settings, the name, pattern and mode of the host group, and signature changes are not included. The backup screen requires Settings permission, and Import requires modify permission in the WAF area.

Problem: The Old Rules of a vService Are Wanted Back

The rule set of a vService was corrupted by a faulty Import, Merge or applying of an analysis; a Page types Export had not been taken beforehand either. Without undoing the other changes and the users on the device, only the rules of this vService need to be returned to their state in an old system backup. Applying the system backup with Apply Backup File does not achieve this, because it returns the whole configuration of the device to the moment of the backup (Can I back up and restore the configuration?).

Solution

The rules are extracted from the backup as a file and imported into the target host group. This operation has no WEB-CLI counterpart.

Export WAF Rules and Import

How it worksExport WAF Rules downloads the rule sets of the vServices and host groups in the selected backup to the browser; the configuration on the device does not change. The file is loaded into the target group with Import.
Where it is opened Configuration Menu → Settings → Backup & Restore → backup → preview menu → Export WAF Rules
Requirement The Backup & Restore screen requires Settings permission (among the built-in roles, Admin and Read-only user). For Import in the target group, modify permission in the WAF area is required; WAF protection must be on in the target vService and the target host group must exist.
Scope The page types, the Any paths rule and the Check fields checks of a host group

Step-by-Step Configuration

Adım 1 Click the Add button if the backup is not on the device

If the backup to be used is outside the device, it is first uploaded to the device: on the Configuration Menu → Settings → Backup & Restore screen, the Add button is clicked; the Add Backup File tab opens. Uploading requires modify permission in the Settings area. If the backup is in the list, steps 1–4 are skipped.

Adım 2 Select uploading from a file

From file is selected in the Backup Source field.

Adım 3 Select the backup file

The .zip file of the backup is selected in the Backup File field (at most 25 MB).

Adım 4 Submit

The Submit button is clicked; the backup is added to the File List.

Adım 5 Find and select the backup

In the File List, Time Range shows the last 30 days by default; for an older backup, the range is widened. The row of the backup is clicked; its preview opens on the right. The Content tab of the preview lists the vService names in the backup.

Adım 6 Select Export WAF Rules

Export WAF Rules is selected from the menu of the preview title; the same operation is also in the menu that opens by right-clicking the row.

Adım 7 Select the vService

In the Export WAF Rules window that opens, the vService field comes as All by default and lists the vServices that have a rule set in the backup with their names in the backup. If the rules of a single group are to be taken, the vService is selected; if all rules are to be taken as a zip, All is left as it is and step 8 is skipped.

Adım 8 Select the host group

When a vService is selected, the Host Group Name field appears; the default host group is preselected, and another group is selected if needed.

Adım 9 Accept

The Accept button at the bottom of the window is clicked. If a single group was selected, vService-group-BACKUP_YYYYMMDD_HHmm.json is downloaded, and if All was selected, waf-rules-BACKUP_YYYYMMDD_HHmm.zip is downloaded; in the zip, each vService is a folder and each host group is a separate .json file in this folder. The date in the file name is the last action date of the backup.

Adım 10 Open the Page types screen of the target group

In the Left Monitor Panel → WAF-Protected vServices → target vService → WAF Management tab, the N page types row in the mode card of the target group is clicked (accessing the screen). If the target group does not exist, it is first added from the Virtual Host Groups band (How is a Host Group added; what goes into the Virtual Host Patterns field?).

Adım 11 Back up the existing set of the target

The Export button on the toolbar is clicked; the downloaded file is kept for going back.

Adım 12 Click the Import button

The Import button is clicked; the file picker opens (import steps).

Adım 13 Select the file

The .json file downloaded in that step is selected. If a zip was downloaded, it is first extracted and the group file in the related vService folder is selected.

Adım 14 Confirm the import

At the Are you sure? question, Yes is clicked; the page types of the target group are replaced with those in the file. If the file is corrupted (Corrupted WAF rules file) or contains an invalid pattern (Invalid WAF pattern (...)), the operation is rejected and the existing set does not change. There is no separate deployment step. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Rule listTR7 side

The Page types list of the target group and the counter in the mode card are examined.

ExpectedThe paths in the backup are in the list; the counter equals the number of rules in the file

2User LogsTR7 side

On the User Logs screen, the list is filtered with Field = WAF and Action type = Import.

ExpectedN WAF rules are imported from file for group@vService

Since Export WAF Rules prepares the file in the browser, the export step does not create a separate record in User Logs.

Common Mistakes

Applying the system backup only for the WAF. Apply Backup File returns the whole configuration and the device users to the moment of the backup and is not transferred to the peer device in a cluster; for the rules of a single group, the path on this page is used.
Thinking that the settings come as well. The protection level, Checks, the blocking page, the learning settings, the mode of the host group and the OWASP rules or Signature & Rule Library changes are not included in the file; if needed, they are made separately on the target vService.
Not backing up the target group. Import is a full replacement and cannot be undone (What happens to existing rules when I Import (full replacement)?).
Importing the zip file directly. Import accepts only the .json file of a single host group; the zip is extracted and the related file is selected.
Loading the backup into the wrong group. The file does not carry which group it was extracted from; the rules of the group on whose Page types screen the Import is done are changed.
Looking for the backup screen with the WAF manager role. Backup & Restore requires Settings permission; the WAF manager role does not see this screen.

How it is done in the documentation

Can I extract only the WAF rules from an old system backup (Export WAF Rules)? ​

Problem: The Old Rules of a vService Are Wanted Back ​

Solution ​

Export WAF Rules and Import ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​