Teacher traffic is not recognized; why?

Short answer

Teacher recognizes a request only when its identity matches exactly at run time. In the Teacher IP field, only IPv4 addresses and IPv4 blocks separated by a space are processed; an IPv6 address, a comma-separated list, an address with a port added or an incorrect spelling is not rejected by the form; it is silently ignored at run time, and the Learning Methods card still shows the identity as defined. If TR7 is behind a CDN or proxy and no Trusted Proxy profile is assigned to the vService, WAF sees the address of the proxy as the client. The name of Teacher Cookie and Teacher Header is fixed (TR7-LEARN); only the value is written in the form, and the value is compared exactly, including uppercase and lowercase. Even a recognized request may leave no trace: if the host group is in Learning Mode or the request also carries a Conditional Learning identity, it is written to the learning log; in Monitor Mode and Blocking Mode, a record is written to Event Logs only when the score of the request reaches the blocking threshold or when a signature in Monitor state is triggered, and Teacher learns only from these records. If None is selected in Teaching Frequency, the records never turn into rules; records that match the WAF Log Suppression Condition do not enter the teaching. The proof of the recognition is the "Not blocked — Teacher IP matched" (or Teacher header / Teacher cookie) sentence of the Action icon in Event Logs and the Teacher series of the WAF Inspection Distribution panel on the Dashboard.

Problem: The Requests of the Test Source Do Not Appear as Teacher

Although the requests of the test team or of an automation are defined as Teacher, they are blocked in the host group in Blocking mode, appear in Event Logs with the "Attack blocked" verdict, or Teacher History stays empty. Since everything Teacher teaches loosens the rule set, why the recognition did not happen and why the recognized requests did not turn into rules are examined separately (What is Teacher; which sources can I define as Teacher (IP, header, cookie)?).

Possible Causes

Cause	How to tell it apart
The Teacher switch is off or all the identity fields are empty	On the Learning Methods card, Teacher is among the methods that are off, or the "Teacher is on but no identity is set — nothing can teach" warning
Teacher IP in an invalid format: IPv6 address, comma-separated list (203.0.113.5,203.0.113.6), address with a port added (203.0.113.5:443), typo	The card says "identified by IP"; in Event Logs, the records of the same address appear with the "Attack blocked" or "Not blocked — Monitor mode" verdict (What happens if I enter an incorrect format (invalid IP) for the Teacher identity?)
TR7 is behind a CDN or proxy and no Trusted Proxy profile is assigned	In Event Logs, Client IP is the proxy address; the real address is in the X-Forwarded-For tab of the filter strip
The request does not carry the cookie or header named TR7-LEARN, the name is written differently, or the value is not exactly the same as in the form	HTTP headers on the Request & Location tab of the Event Logs preview (What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?)
The host group is in Learning Mode or the request also carries a Conditional Learning identity (TR7-ANALYZE); the request is written to the learning log	Learning mode on the mode card; in WAF Inspection Distribution, the requests are in the Learning series; no record in Event Logs
The request does not enter the WAF inspection: it matches a Whitelist Condition or it is treated as static content	In WAF Inspection Distribution, the requests are in the Whitelisted series
The score of the Teacher request does not reach the blocking threshold and no signature in Monitor state is triggered; no Event Logs record is created	The request passes but there is no record in Event Logs; in WAF Inspection Distribution, the request is in the Clean series
Teaching Frequency None	There are "Not blocked — Teacher … matched" records in Event Logs, Teacher history is empty; even in this case, the card writes "processing period 1 minutes"
The records match the WAF Log Suppression Condition	The "WAF logging is suppressed for requests matching:" line on the Log Settings card; the request does not appear in the Event Logs list
The rule set already allows this request	Learning Suggestion = Already learned on the Attacks tab of the Event Logs preview

Definitive rules:

• Teacher does not block a recognized request in any mode, whatever its score; a Teacher request whose scan cannot be completed within the time limit is also passed. In Monitor mode and Blocking mode, the inspection of the request is completed; if the score reaches the blocking threshold or a signature in Monitor state is triggered, the record is written to Event Logs with the "Not blocked — Teacher … matched" verdict. Teacher requests whose score reaches the blocking threshold are counted in the Teacher series in WAF Inspection Distribution, and those that stay below the threshold in the Clean series.
• Teacher learns only from the Event Logs records of the requests it recognizes itself; the Country filter, Only browsers, Only Valid Domain Names and Skip Blacklist IPs filters and the Required thresholds of AI learning are not applied to Teacher. A single Teacher record is enough for learning (How long until Teacher traffic becomes a rule; is a single request enough?).
• In every period, Teacher evaluates the records of the latest window equal to the period length (with a two-minute margin for periods in minutes). For example, while 30 minutes is selected, the last 32 minutes are read; older Teacher records are not evaluated in later periods.
• IPv6 clients cannot be identified by IP; for these clients, Teacher cookie or Teacher header is used (Can I define an IPv6 address for Teacher?).
• In a cluster setup, the Teacher evaluation runs on the first device of the cluster, and the suggestions that come from the Teacher records of the two devices are merged.

Where Is It Monitored?

Screen	Path	What it shows
Learning Methods card	WAF-Protected vServices → vService → WAF Management → Learning & Reporting	The "Teacher is on — teaching sources are identified by … (processing period …)" sentence
Event Logs	WAF-Protected vServices → vService → Event Logs	"Not blocked — Teacher IP matched" (or Teacher header, Teacher cookie) when the Action icon is hovered over
WAF Inspection Distribution	WAF-Protected vServices → vService → Dashboard → Summary	The Teacher series
Teacher Tracking	WAF-Protected vServices → vService → Teacher Tracking (AI Learning & Teacher Tracking if AI learning is also on) → View	The learning suggestions to be applied in the next period
Teacher History	Same tab → View	The learnings applied by Teacher

How to Diagnose?

1. Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened. The Teacher sentence on the Learning Methods card in the Learning & Reporting section is read; the "nothing can teach" warning, or Teacher being listed among the methods that are off, shows that the identity is not defined.
2. On the same screen, the mode card of the host group is examined. In a host group in Learning mode, the requests are already written to the learning log; Teacher leaves no trace in this host group.
3. The Event Logs tab is opened; Date Range is selected so that it covers the time of the Teacher requests and Save & Get Logs is clicked. On the Client IP tab of the filter strip, the address of the Teacher source is selected.
4. The Action icon of the records is hovered over. If "Not blocked — Teacher … matched" is seen, the recognition is working; the diagnosis continues with step 8. If "Attack blocked" or "Not blocked — Monitor mode" is seen, the request has not been recognized.
5. The preview of a record that was not recognized is opened; the client address on the Summary tab is compared with the addresses in the Teacher IP field. If the address is a CDN or proxy address, Trusted Proxy is missing.
6. In the HTTP Headers section on the Request & Location tab of the preview, the TR7-LEARN header or cookie is searched for; the name and the value are compared exactly with those in the form.
7. If there is no record at all in Event Logs for the requests that come from the Teacher source, in which series the requests are counted is examined in the WAF Inspection Distribution panel under Dashboard → Summary: Learning points to the learning log, Whitelisted to being outside the inspection, Clean to being below the threshold.
8. If the records appear as Teacher but no learning happens, the Teacher Tracking tab is opened, Teacher Tracking is selected from the View list and Refresh is clicked. If the list has entries, the learning will be applied in the next period; the period on the Learning methods card and Teaching frequency are reviewed. If the list is empty, either the records match the suppression condition or the rule set already allows these requests.

Solution

All the settings that affect the recognition and the learning are in the Learning methods window. If TR7 is behind a CDN or proxy, the real client address is resolved first: The logs show the proxy / CDN IP instead of the client IP; what should I do?. If the records do not enter the teaching because of WAF Log Suppression Condition, the condition is narrowed: Why does a request that received 418 not appear in Event Logs?

Correcting the Teacher Identity and Period

• How it works The requests whose identity matches are not blocked; the requests whose score reaches the blocking threshold or that trigger a signature in Monitor state are written as Teacher records and are cleared from the rules as false positives at the end of the selected period (Teacher).
• Where it is opened WAF-Protected vServices → vService → WAF Management → Learning & Reporting → Learning Methods card
• Requirement Modify permission in the WAF area; the host group in Monitor mode or Blocking mode
• Scope The whole vService; all host groups

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

Left Monitor Panel → WAF-Protected vServices → vService → WAF Management is opened.

2

Adım 2 Open the Learning Methods window

The pencil icon of the Learning Methods card in the Learning & Reporting section is clicked; the Learning Methods window opens.

3

Adım 3 Turn on Teacher

The Teacher switch is turned on (it is off by default); the Teacher IP, Teacher Cookie, Teacher Header and Teaching Frequency fields appear.

4

Adım 4 Enter the identity

In the Teacher IP field, IPv4 addresses and IPv4 blocks are written separated only by a space (e.g. 203.0.113.10 203.0.113.64/27); commas, ports and IPv6 addresses are not used. Instead of the IP or together with the IP, the value that the Teacher requests will carry in the cookie or header named TR7-LEARN is written in the Teacher Cookie or Teacher Header field; not the name, only the value is entered in the field. The value is kept secret: no request that carries this value is blocked, and every such request loosens the rules.

5

Adım 5 Select the period

1 minutes, 2 minutes, 5 minutes, 30 minutes or 1 hours is selected from the Teaching Frequency list; the default value is None. While None is selected, Teacher requests are not blocked and are recorded, but they do not turn into rules.

6

Adım 6 Verify the Conditional Learning identity

If the IP of the Teacher source or a TR7-ANALYZE value is defined in the Conditional Learning fields and the Teacher source also carries this identity, the request is written to the learning log and no Teacher record is created. The saved identity continues to match even while the Conditional Learning switch is off; since the fields are visible only while the switch is on, the switch is turned on, the relevant value is deleted and the window is saved with the switch left on (What is the difference between Conditional Learning and Teacher; when should I use which?).

7

Adım 7 Save

Edit is clicked; the identity changes are applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Teacher requestClient side

If Teacher header is defined, the request to be taught is sent with the header; then the Action icon of the record in Event Logs is hovered over.

Command: curl -s -o /dev/null -w '%{http_code}' -H 'TR7-LEARN: ogretici-degeri' 'https://www.example.com/arama?q=...'

ExpectedNot blocked — Teacher header matched

The record is written only if the score of the request reaches the blocking threshold or a signature in Monitor state is triggered; the request is still not blocked, and the response code of the server is returned.

2Teacher HistoryTR7 side

After the selected period has elapsed, View → Teacher history is selected on the Teacher Tracking tab.

ExpectedA row for the taught path and inspection field

The suggestions not yet applied are seen with Refresh in the Teacher tracking view. A wrong learning can be reverted with Revert learning under the learning record on the Log tab of the WAF - WAAP Data Flow Panel to the right of the Dashboard or WAF Management tab.

Common Mistakes

• Thinking that it matches because the card shows the identity. The card looks only at whether the field is filled in; invalid IP entries are ignored at run time.
• Writing the TR7-LEARN name in the cookie or header field. The name is fixed; only the value is entered in the field.
• Thinking that clean requests will also teach. Teacher learns only from the requests for which an Event Logs record is created; a Teacher request whose score stays below the blocking threshold and that does not trigger a signature in Monitor state produces no record.
• Leaving Teaching frequency at None. The requests are not blocked, but no learning is applied; even in this case, the card shows the 1 minutes period.
• Keeping the Teacher identity wide. A wide IP block or a shared header value leads to the attacks that come from that source also being taught to the rule set; when the teaching is finished, the Teacher switch is turned off; while the switch is off, the Teacher identity recognizes no request.
• Expecting the list to fill when Teacher Tracking is opened. The Teacher tracking view does not fetch data when it opens; Refresh is clicked.

How it is done in the documentation

• Learning Methods · Teacher
• Learning Methods · Teacher IP
• Learning Methods · Teaching Frequency
• AI Learning & Teacher Tracking · The Teacher Tracking Screen
• Event Logs · The Action Values

Related questions

• What is Teacher; which sources can I define as Teacher (IP, header, cookie)?
• What happens if I enter an incorrect format (invalid IP) for the Teacher identity?
• What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?
• How long until Teacher traffic becomes a rule; is a single request enough?