How is a Host Group added; what goes into the Virtual Host Patterns field?

Short answer

A host group is added with the icon at the top right of the Virtual Host Groups band at the very bottom of the WAF Management tab, or with Add in the list that opens with the Edit link of the band (adding a host group). In the form, Virtual Host Group Name (required), WAF Mode (the WAF mode of the vService comes preselected) and Virtual Host Patterns (at least one pattern, each pattern in a separate field) are filled in and Add is clicked; there is no separate deployment step. The pattern is compared with the Host header of the request as a whole: example.com matches only example.com; * stands for any sequence of characters, and *.example.com matches the subdomains but does not match example.com. The comparison is case-sensitive, and the port in the Host header is also part of the comparison; for publishing on a non-standard port, the pattern also contains the port (example.com:8443). For the root domain name and the subdomains, two patterns are written. In WEB-CLI, the waf host-groups add command is used; at least one --hosts.0 is required, if --mode is not written the group is created in Blocking mode, and * is accepted only at the beginning (*.example.com).

Problem: One Domain Name Must Be Protected Separately From the Others

If more than one domain name is published from the same vService, the WAF inspects all of them with the single mode and the single rule set of the default group. For a newly published domain name to start in learning mode, for the mature domain name to stay in Blocking mode or for the domain names to be protected with page types that differ from each other, a host group belonging to the domain name is defined (What is a Virtual Host Group and what is it for?).

Pattern writing (apart from *, the match is exact and case-sensitive):

Pattern	Matches	Does not match
example.com	example.com	www.example.com, Example.com, example.com:8443
*.example.com	www.example.com, a.b.example.com	example.com, www.example.com:8443
*.example.com:8443	www.example.com:8443	www.example.com
example.com:8443	example.com:8443	example.com
203.0.113.10:80	Requests whose Host header is 203.0.113.10:80; requests that have no Host header and come to the vService over 203.0.113.10:80	-

There is no wildcard other than *; constructs such as ?, [abc] or {a,b} are compared as plain characters. Details: Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?

Solution: 2 Methods

Prerequisite: the vService is of the HTTP type and WAF is on; if WAF is not on, the WAF Management tab does not appear (How do I enable WAF protection on a vService?).

Your situation	Suitable method
I want to add it from the interface	Method 1: Virtual Host Groups band
I want to add it from the command line	Method 2: WEB-CLI

Method 1: Virtual Host Groups Band Recommended

• How it works The group is added from the form that opens with the icon of the band or with Add in the list window. A new group is created with the default rule set and the suggested header inspections; the rules of the existing groups are not copied.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the Virtual Host Groups band at the very bottom
• Requirement Modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the WAF Management tab

The Left Monitor Panel is opened, WAF-Protected vServices is selected from the category tabs at the top left and the vService is clicked; on the screen that opens, the WAF Management tab is opened (accessing the screen).

2

Adım 2 Open the add window

The icon at the top right of the Virtual Host Groups band at the very bottom of the screen is clicked; the window titled Add opens. The same form also opens with the Add button in the Virtual Host Groups list that opens with the Edit link of the band.

3

Adım 3 Enter the name of the group

A name that identifies the group is written in the Virtual Host Group Name field (e.g. shop). The name appears on the mode cards, in the group list and in the Host Group information in Event Logs. The interface does not prevent the same name in a second group; a unique name is used to avoid confusion.

4

Adım 4 Select the WAF mode

In the WAF Mode field, the WAF mode of the vService comes preselected. For a newly published domain name, Learning Mode is selected; since the group will learn its own rules from scratch, starting it in Blocking mode carries a false positive risk (In which mode does a host group I have just added start?).

5

Adım 5 Enter the patterns

The first pattern is written in the Virtual Host Patterns field (e.g. shop.example.com); for every additional pattern, a new field is opened with the + Add link below the field (e.g. *.shop.example.com). At least one pattern is required; a field left empty is rejected with the Correct invalid inputs warning. If the pattern collides with the pattern of another group, the requests of that host go to the group created first.

6

Adım 6 Save

Add in the window is clicked; the WAF configuration is automatically regenerated and applied. Since consecutive changes are gathered into a single applying step, it may take a few seconds for the change to be reflected. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Mode cardWAF Management

The mode card of the new group appears at the top of the screen; the card body shows the patterns of the group, and the bottom of the card shows the page type count (host group mode cards).

ExpectedRequests to shop.example.com · *.shop.example.com are handled by this group · 1 page types

2The group the request falls intoEvent Logs

The Host Group information in the WAF Event Logs record of a request that comes to the new domain name is examined.

ExpectedHost Group: shop

No Event Logs record is produced in Learning mode; the verification is done while the group is in Monitor or Blocking mode.

Method 2: WEB-CLI

• How it works The group is added with the waf host-groups add command. The patterns are written to the --hosts.N fields in order.
• Where it is opened WEB-CLI → waf host-groups
• Requirement WEB-CLI access and modify permission in the WAF area
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Add the group

In place of <vService>, the ID of the vService is written; a pattern that contains * is written in single quotes:

waf host-groups add poolId <vService> name shop --mode learning --hosts.0 shop.example.com --hosts.1 '*.shop.example.com'

WEB-CLI behaves differently from the interface: if --mode is not written, the group is created in blocking mode; if at least one --hosts.0 is not written, the request is rejected; * is accepted only at the beginning (*.); the same name is not accepted in a second group. The command gives no output when it succeeds.

Verification

1Group listTR7 side

The host groups of the vService are listed.

Command: waf host-groups list poolId <vService>

ExpectedThe shop group, learning mode and two patterns

Common Mistakes

• Not writing a pattern for the root domain name. The *.example.com pattern does not match example.com; the requests that come to the root domain name fall into the default group. Two patterns are written: example.com and *.example.com.
• Not adding the non-standard port to the pattern. If the Host header is example.com:8443, the example.com pattern does not match; the pattern is written with the port.
• Not expecting uppercase Host values. The comparison is case-sensitive; a request whose Host header is Example.com does not match the example.com pattern.
• Writing colliding patterns. If two groups match the same host, the requests always go to the group created first; the order cannot be changed afterwards (Which host group does a request fall into; what if it matches none?).
• Opening a new group in Blocking mode. A new group learns from scratch; it is first run in Learning mode, then in Monitor mode (When should I move from Learning to Monitor and from Monitor to Blocking?).
• Not writing --mode in WEB-CLI. While the interface preselects the vService mode, WEB-CLI creates the group in Blocking mode by default.

How it is done in the documentation

• Virtual Host Groups · Adding and Editing a Host Group
• Virtual Host Groups · Virtual Host Patterns
• Virtual Host Groups · The Host Group Mode Cards
• WEB-CLI · Optional Fields

Related questions

• Can I use different modes for different domains on the same vService?
• How do I enable WAF protection on a vService?
• How do I add a new page type manually?