What is a Virtual Host Group and what is it for?

Short answer

A Virtual Host Group is the group that divides the traffic of a WAF-protected HTTP vService according to the Host header of the request and gives every part a separate WAF Mode and a separate page type (Page Types) list. What changes per group is the name of the group, the host patterns in the Virtual Host Patterns field, the WAF Mode and the page types belonging to the group; the analysis results are also kept per group. All the settings under OWASP Protection Level, Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits and Learning & Reporting apply across the vService and are common to all the groups. If all the WAF settings of a domain name need to be separate, the domain name can be moved to a separate vService; with Virtual Hosting, this vService is opened on the same IP:Port as the existing vService, and the requests are routed to the correct vService according to the Host header (SNI in HTTPS). Typical use: while a mature domain name published from the same vService is protected in Blocking mode, a new domain name is learned in Learning mode (usage scenarios). Every vService has a default group (Default Host Group) that cannot be deleted and has no pattern; the requests that match no group's pattern fall into it. There is no rule sharing between the groups: a new group starts with the default rule set and the suggested header inspections, and the rules are moved from one group to another with Export and Import. The groups are managed from the Virtual Host Groups band at the very bottom of the WAF Management tab.

How Does It Work?

1. When a request arrives, the WAF compares the Host header of the request with the patterns of the named groups, in the creation order of the groups; the first matching group takes the request (Which host group does a request fall into; what if it matches none?).
2. If no group's pattern matches, the request falls into the default group (What is the default host group?).
3. The request is inspected in the mode of the group it falls into (Learning, Monitor or Blocking) and with the page type list of that group; the vService-wide settings (protection level, Checks, blacklist, blocking page) are the same in all the groups.

Per group	vService-wide (common to all groups)
Virtual Host Group Name and Virtual Host Patterns	OWASP Protection Level (blocking threshold) (Can I set the protection level separately for each domain / host group?)
WAF Mode (Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?)	Signature statuses and scores (OWASP Rules)
Page types, the Any Paths rule and the field inspections (Check Fields)	Checks, Whitelist & Blacklist, Blocking Page, Request Body Limits
Analysis & Learning results	Learning Methods (Teacher, Conditional Learning, AI Learning), log, report, notification and SIEM settings

Virtual Host Groups in TR7

• Where it is managed: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the Virtual Host Groups band at the very bottom. The icon at the top right of the band adds a new group, and the Edit link below it opens the group list. Every group has its own mode card at the top of the screen; the card shows the mode of the group, the patterns it matches and the page type count (host group mode cards).
• Adding a group: How is a Host Group added; what goes into the Virtual Host Patterns field?
• Moving the rules: Export on the Page Types screen of the source group, Import on that of the target group (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).
• Collective learning: While there is more than one group, Collective Analysis & Learning appears on the band; the traffic of several groups is processed in a single analysis.
• In the records: The Host Group information on the WAF Event Logs screen shows which group the request fell into.
• Full separation: If the protection level, the blocking page, Checks or the learning settings are also to differ by domain name, a host group is not enough; the domain name is moved to a separate vService. Thanks to the Virtual Hosting field in the vService form, the new vService uses the same IP:Port, and the WAF works separately on each vService with its own settings. The Virtual Hosting list of every vService that shares the IP:Port must contain its own domain names.
• Cluster: Adding, editing and deleting a group is applied the moment it is saved. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Common Misconceptions

• "A virtual host group is the Virtual hosting in Load Balancer." The Virtual Hosting field of the vService separates the vServices that share the same IP:port according to Host; WAF host groups, on the other hand, separate only the WAF mode and rules within the same vService and do not route the traffic.
• "A new group inherits the rules of the existing group." A new group starts with the default rule set and the suggested header inspections; the page type count on the mode card is 1.
• "A separate protection level can be given to every domain name." OWASP Protection Level is vService-wide; for a different threshold, the domain name is moved to a separate vService that shares the same IP:Port through Virtual Hosting.

How it is done in the documentation

• Virtual Host Groups · What Is Virtual Host Groups?
• Virtual Host Groups · The Virtual Host Groups Band on WAF Management
• WAF · Terminology
• HTTP (L7) vService · Virtual Hosting
• WAF Management · Screen Structure

Related questions

• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?
• Can I use different modes for different domains on the same vService?
• What is a Page Type?