FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file? ​

Short answer

Yes. Export on the Page Types screen downloads all the page types of the host group (including Any Paths and the Check Fields inspections of every rule) as a single JSON file without asking for confirmation; on the target vService, it is uploaded with Import on the Page types screen of the desired host group and replaces the whole rule set of that group. Only the rule list goes into the file; the name, host patterns and WAF Mode of the host group, the WAF settings of the vService (OWASP Protection Level, Checks, Request Body Limits, Blocking Page, Whitelist & Blacklist, Learning Methods, Log Settings, Notifications, Periodic Reporting, SIEM & Attack Details), the OWASP Rules changes and custom signatures of the vService and the device, the analyses and the learning data are not in the file; these are configured separately on the target. OWASP Exclusions are carried with the signature ID. Export (OpenAPI) on the same screen downloads the rule set as an OpenAPI document. There is no export or import command in WEB-CLI.

Problem: The Rule Set Is to Be Moved to Another Environment ​

Page types learned in a test environment or on another device are to be moved to production or to another host group. If it is not known what the file carries and what it does not carry, the protection level, the Checks switches or the signature changes on the target are not the same as on the source, and the same rules give a different result.

Solution: Two Methods ​

Your situationSuitable method
Moving the rule set to TR7 one-to-one or backing it upMethod 1: Export and Import
Sharing the rule set as an OpenAPI document or uploading it to another TR7 by mergingMethod 2: Export (OpenAPI)
  • How it works The rule list of the source group is taken into a file; on the target group, Import replaces all the rules of the group with the ones in the file.
  • Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the mode card of the host group → N page types → Export · Import
  • Requirement WAF protection enabled on the source and target vServices; the target host group defined
  • vService type HTTP vService with WAF protection enabled

Step-by-Step Configuration ​

1
Adım 1 Open the Page Types tab of the source group

On the source vService, the vService is clicked on the WAF-Protected vServices tab in the Left Monitor Panel, the WAF Management tab is opened and the N page types row under the mode card of the host group to be moved is clicked (accessing the screen).

2
Adım 2 Export

Export on the toolbar is clicked; no row selection is needed and no confirmation is asked. The browser downloads the .json file made up of the vService and host group names and a date-time stamp (the export steps).

3
Adım 3 Prepare the target

If WAF protection is not on in the target vService, it is turned on (How do I enable WAF protection on a vService?); if the target host group does not exist, it is added (How is a Host Group added; what goes into the Virtual Host Patterns field?). If the existing rules of the target group are to be preserved, its Export file is also taken first.

4
Adım 4 Open the Page Types tab of the target group

On the WAF Management tab of the target vService, the N page types row of the target host group is clicked. Since the file does not carry the information of which group it was taken from, it is verified from the tab title that the right group is open.

5
Adım 5 Select the file

Import on the toolbar is clicked and the file downloaded in step 2 is selected from the file picker (the import steps).

6
Adım 6 Confirm

Yes is clicked in the Are you sure? question. All the rules of the group are replaced with the ones in the file; no success notification is shown, and the list and the N page types number are updated. If there is no Any paths in the file, it is set up with its default configuration at the end of the operation (What happens to existing rules when I Import (full replacement)?). The change is applied without a separate deployment step; in a cluster setup, it is also sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually with Synchronize.

Settings that are not included in the file

On the target vService, they are configured separately from the cards in WAF Management: OWASP Protection Level, Checks (Structure checks, Argument checks, Max. Allowed Arguments, URL decoding), Request Body Limits, Blocking Page, Whitelist & Blacklist, Learning Methods, Log Settings, Notifications, Periodic Reporting and SIEM & Attack Details. The mode and host patterns of the host group are configured from the Virtual Host Groups band. The signature status, the score and custom signatures are done separately on the OWASP Rules screen of the target vService or on the Signature & Rule Library screen of the device.

Verification ​

1ListTR7 side

The Page types list of the target group is compared with that of the source group.

ExpectedThe same paths and the same N page types number
2User LogsTR7 side

On the target device, the import record is examined on the Settings → System Logs → User Logs screen.

ExpectedN WAF rules are imported from file for group@vService

Method 2: Export (OpenAPI) ​

  • How it works The rule set is downloaded as an OpenAPI 3 document; when the document produced by TR7 is uploaded with Import (OpenAPI), the rules come losslessly from the TR7-specific section of the document and are merged with the existing rules.
  • Where it is opened Page types → Export (OpenAPI) · Import (OpenAPI)
  • Requirement WAF protection enabled on the source and target vServices
  • vService type HTTP vService with WAF protection enabled

Step-by-Step Configuration ​

1
Adım 1 Download the document

Export (OpenAPI) is clicked on the Page types tab of the source group; the document is downloaded as .json. Glob paths are converted into the {param} template, and methods and parameters into OpenAPI fields; the full rule definition and the Any paths configuration are carried in the TR7-specific x-tr7-waf section of the document (the produced document).

2
Adım 2 Upload it on the target

Import (OpenAPI) is clicked on the Page types tab of the target group, the document is selected and Yes is clicked in the Are you sure? question. The paths in the document replace the rules with the same path, and the rules that are not in the document remain; in the TR7 output, the Any paths configuration is also replaced with the one in the document (Can I generate rules automatically from my OpenAPI / Swagger file?).

Verification ​

1Notification and listTR7 side

After the upload, the notification and the Page types list are examined.

ExpectedOpenAPI import: N path applied · the paths in the document in the list

Common Mistakes ​

  • Thinking that the file also carries the vService settings. The file is only the rule list; the protection level, Checks, the blocking page and the other cards are configured separately on the target.
  • Thinking that Import adds to the existing rules. JSON Import is a full replacement; if merging is wanted, the OpenAPI path is used (What happens to existing rules when I Import (full replacement)?).
  • Thinking that the table export (Excel, CSV, PDF) is a backup. The Export Table output is only the columns visible in the table and cannot be restored (Export Table).
  • Not checking the exclusions given to vService-specific signatures. OWASP exclusions are carried with the signature ID; since the custom signatures added on the OWASP rules screen of the source vService do not exist on the target, these exclusions do not function on the target.
  • Uploading to the wrong group. The file does not carry group information; Import replaces the rule set of the group that is open.

How it is done in the documentation

Related questions