The site is not working after I enabled the WAF; what should I check first?

Short answer

First, whether the error comes from the WAF is distinguished by the status code (what is created after it is enabled). In a WAF that is turned on for the first time, the host group starts in Learning Mode and the attack score does not block any request. If 418 and the blocking page are seen, the host group is in Blocking mode; there are two possible reasons for this: if the WAF was previously turned on and off on this vService, the host groups come back with the modes they had before it was turned off, for example in Blocking Mode; a group added with WEB-CLI without specifying a mode starts in Blocking mode. In Blocking mode, the most likely reason for a 418 that has no record in Event Logs is that the WAF scan of the request could not be completed within the 2-second time limit. A 408 or uploads that are cut off midway are the HTTP Request Timeout caused by waiting for the request body while the WAF is on. If Blocking Status Code has not been changed, a 403, a CAPTCHA or a connection that drops without a response points to another protection layer. In order, the mode card in WAF Management, Event Logs and the Security Action value in the Debug Mode Logs record are examined. In an emergency, the host group is set to Monitor Mode, or the WAF is removed with Disable in the WAF-Protected vService List; removal does not delete the configuration.

Problem: The Site Broke When the WAF Was Enabled

Immediately after the WAF is enabled on a vService, pages do not open, forms or file uploads fail, and API calls return errors. Since Bot/DDoS, Load Balancer actions and AGS can also run together with the WAF on the same vService, the layer that produces the error is determined first (Does traffic start being blocked as soon as I enable the WAF?).

Possible Causes

Symptom	Possible cause	Where to look
418 and the blocking page; there is a record in Event Logs	The host group is in Blocking Mode: the group came back with its old mode because the WAF was previously turned on and off, or the group was added with WEB-CLI without specifying a mode. If the source IP is on the blacklist, it is also blocked in Blocking mode	Mode card; Event Logs → Attacks
418 and the blocking page; no record in Event Logs	The host group is in Blocking mode and the WAF scan could not be completed within the 2-second time limit (while Fail-open is off, the default)	Debug Mode Logs → Security Action
408 or the upload is cut off midway	While the WAF is on, the request body is held in a buffer and waited for; if the buffered part does not arrive within HTTP Request Timeout (default 30 s), 408 is returned	Debug Mode Logs → Termination State = During request · Client timeout
403, CAPTCHA or a connection that drops without a response	A layer other than the WAF (Bot/DDoS, the Block action, Quarantine, AGS)	Debug Mode Logs → Security Action; Legitimate users are being blocked; how do I find which rule is blocking them?

Definitive rules:

• When the WAF is turned on for the first time on a vService, the WAF settings of the vService are created with the defaults and the host group starts in Learning Mode (What does the WAF do in Learning mode; are attacks blocked?). In Learning mode, the attack score and the blacklist do not block the request; no Event Logs record is produced either.
• When the WAF is removed, the settings and host groups are not deleted; when it is turned on again, the groups run with the modes they had before it was turned off (If I remove WAF protection, are the learned rules and settings deleted?).
• In a new host group added from the interface, the WAF Mode field comes preselected with the default mode of the vService; in WEB-CLI, if --mode is not written in the waf host-groups add command, the group is created with blocking.
• The scan timeout blocks only in Blocking mode and while Fail-open is off; in Learning and Monitor Mode, a request whose scan cannot be completed is passed (the only exception is when the scan is cut off while the WAF rules are being loaded and before the host group is determined: if the vService has a group in Blocking mode, this request is blocked (WAF Mode · Blocking Mode)). The blocked request is not written to Event Logs (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
• While the WAF is on and Wait for body for a time is not selected (default), the request body is held in a buffer and waited for; this wait is subject to the HTTP Request Timeout duration.

Where Is It Monitored?

Screen	Path	What it shows
Mode card	Left Monitor Panel → WAF-Protected vServices → vService → WAF Management	The mode of each host group: "Learning mode — rules are not enforced yet", "Attacks are only monitored, not blocked", "Attacks are blocked"
Event Logs	The Event Logs tab on the same vService	In Monitor and Blocking mode, the requests whose score reaches the threshold or that trigger a signature in Monitor state
Debug Mode Logs	Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking → Debug Mode Logs	Security action (the security feature that terminated the request and its decision), Termination State, the WAF box
WAF Inspection Distribution	WAF-Protected vServices → vService → Dashboard	The Whitelisted, Clean, Blocked, Monitor, Teacher and Learning distribution of the requests

How to Diagnose?

1. The status code and the page that the user sees are determined: 418 and the "Your Access To This Page Has Been Blocked!" page indicate the WAF (the default Blocking Status Code), 408 indicates the body wait, and 403 / CAPTCHA / a drop without a response indicate another layer (Legitimate users are being blocked; how do I find which rule is blocking them?).
2. Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened and the mode cards are examined. If the card says "Attacks are blocked", blocking caused by rules is the expected behavior.
3. The Event Logs tab of the same vService is opened. If there is a record, the rule that caused the block is read on the Attacks tab: My users are getting a "418" error; what is happening?. If the host group is in Learning mode, it is normal for the screen to be empty.
4. If there is no record, in the edit form of the vService on the Load Balancer → Load Balancer vService List screen, Status = Debug mode is selected, Save is clicked and the error is reproduced (What does Debug Mode record; how long should I keep it on?). Turning on Debug mode requires modify permission in the Load Balancer area, and viewing Debug Mode Logs requires monitoring permission in the Load Balancer area; for a user who has only WAF permission, these screens do not open (Logs & Tracking).
5. Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking → Debug Mode Logs is opened; the Security Action and Termination State columns are added from the Columns menu. WAF · Attack blocked — scan timed out indicates the scan timeout in Blocking mode (Why does a request that received 418 not appear in Event Logs?), During request · Client timeout indicates the body wait, and Threat Protection · … indicates a Bot/DDoS decision; if Security Action is -, neither the WAF nor Bot/DDoS terminated the request.
6. When the examination is finished, Status is set back to Enabled and saved.

Solution: Three Methods

The methods are alternatives to each other. Method 1 keeps the WAF inspection running; Method 2 removes the WAF from the vService completely.

Your situation	Suitable method
The host group is in Blocking mode; learning or the observation in Monitor mode is not complete	Method 1: Setting the host group to Learning or Monitor mode
The traffic needs to be let through immediately and completely	Method 2: Temporarily removing the WAF from the vService
The mode or the WAF is to be changed from the command line	Method 3: WEB-CLI
There is no record in Event Logs; Debug Mode Logs shows a scan timeout	Why does a request that received 418 not appear in Event Logs?
408 or the upload is cut off midway	Large file uploads fail; why? · Why is the request cut off during long operations (report, file upload); which timeout should I increase?
A specific false positive is being blocked	My users are getting a "418" error; what is happening?

Method 1: Setting the Host Group to Learning or Monitor Mode Recommended

• How it works In Learning mode, the rules are not enforced and the requests are written to the learning log; in Monitor mode, the rules run fully and requests that exceed the threshold are written to Event Logs without being blocked. In both modes, the WAF does not block the request; the blocks caused by the attack score, the blacklist and the scan timeout stop.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card → Edit
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened. If there are multiple host groups, each group has its own mode card; the default group is at the end.

2

Adım 2 Open the host group window

Edit is clicked on the mode card of the group in Blocking mode; the host group window opens (WAF Mode Edit screen).

3

Adım 3 Select the mode

In the WAF Mode field, Learning mode is selected if learning is not complete, and Monitor mode is selected if the rules are ready but their results are to be monitored before switching to blocking (When should I move from Learning to Monitor and from Monitor to Blocking?).

4

Adım 4 Save

Edit in the window is clicked; the mode is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize. Groups can be kept in different modes for different domain names: Can I use different modes for different domains on the same vService?

Verification

1Mode cardTR7 side

The sentence of the mode card in WAF Management is examined.

ExpectedLearning mode — rules are not enforced yet

If Monitor mode was selected, the card says "Attacks are only monitored, not blocked".

2WAF Inspection DistributionTR7 side

The WAF Inspection Distribution panel on the Dashboard of the vService is examined.

ExpectedThe Blocked series drops to zero

Method 2: Temporarily Removing the WAF from the vService

• How it works WAF protection is turned off on the vService; requests go to the Backend Service without passing through WAF inspection. The WAF settings, host groups and learned rules are not deleted; when the WAF is turned on again, it returns with the same configuration.
• Where it is opened Configuration Menu → WAF → WAF-Protected vService List → Disable
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the list

Configuration Menu → WAF → WAF-Protected vService List is opened (how to access).

2

Adım 2 Select the vService

The box at the beginning of the row of the vService whose WAF is to be removed is checked.

3

Adım 3 Click Disable

Disable on the toolbar is clicked. No confirmation window opens; the WAF is removed from the selected vServices immediately and the vService drops off the list. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize. Details: How do I remove WAF protection from a vService?

Protection is removed

As long as the WAF is removed, attacks that come to the vService are not inspected. After the cause is found and fixed, the WAF is turned on again with Enable on the same screen; the host groups return with the modes they had before it was turned off, and a group in Blocking mode starts blocking again.

Verification

1ListTR7 side

The WAF-Protected vService List is examined.

ExpectedvService is not in the list

If the error continues, it is certain that the WAF is not its source; the other layers are examined.

Method 3: WEB-CLI

• How it works The changes in Method 1 and Method 2 are made with WEB-CLI commands.
• Where it is opened WEB-CLI → waf host-groups · lb service
• Requirement WEB-CLI access; modify permission in the WAF area for the host group, and in the Load Balancer area for removing the WAF
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 See the host groups and their modes

The id field takes the ID of the host group, not its name; the ID and the mode are read from the list (waf host-groups):

waf host-groups list poolId <vService>

2

Adım 2 Set the host group to Learning or Monitor mode

In place of <group-id>, the ID from step 1 is written; for Monitor mode, monitor is written instead of learning:

waf host-groups update poolId <vService> id <group-id> --mode learning

3

Adım 3 Remove the WAF (if needed)

lb service update id <vService> --waf false

The WAF is turned on again with --waf true.

Verification

1RecordTR7 side

The host group record is displayed again.

Command: waf host-groups show poolId <vService> <group-id>

Expectedmode learning

Common Mistakes

• Thinking that a WAF that was previously turned on and off has just been turned on for the first time. The host groups come back with the modes they had before it was turned off; the first thing to do after turning it on is to examine the mode card (What should I do first after enabling the WAF?).
• Adding a group with WEB-CLI without writing --mode. The group starts in Blocking mode and can block traffic that has not been learned yet.
• Attributing every error to the WAF. 403, CAPTCHA or a drop without a response points to another layer. In Debug Mode Logs, Security Action shows whether the request was terminated by the WAF or by Bot/DDoS; if neither terminated it, it stays - (Legitimate users are being blocked; how do I find which rule is blocking them?).
• Looking for records in Event Logs in Learning mode. In Learning mode, no Event Logs record is created; the requests are counted in the Learning series on the Dashboard.
• Leaving Debug mode on. Debug mode records every request in detail; when the examination is finished, Status is set back to Enabled.

How it is done in the documentation

• How to Enable WAF · What Is Created After It Is Enabled?
• WAF Mode · Runtime Behavior of the Modes
• WAF-Protected vService List · Disable
• Debug Logs · Termination State Values
• Debug Logs · Summary Tab

Related questions

• Does traffic start being blocked as soon as I enable the WAF?
• What should I do first after enabling the WAF?
• Can a request be blocked with 418 even in Learning or Monitor mode?
• My users are getting a "418" error; what is happening?
• Legitimate users are being blocked; how do I find which rule is blocking them?