Which host group does a request fall into; what if it matches none?

Short answer

The WAF takes the Host header of the request as it is; the letter case and the :port are part of the comparison (Virtual Host Patterns). If there is no Host header, the target IP:port value is used. The named groups are tried in their creation order; if one of a group's patterns matches the entire Host value, the request falls into that group and the next groups are not examined (which group a request falls into). A narrower pattern has no priority. If no group's pattern matches, the request falls into the default group (Default Host Group); it does not remain uninspected, it is inspected in the mode of the default group and with its page types. After the group is selected, the path is matched against the page types of that group in the order Exact, Glob and Any Paths (runtime rule matching). If the patterns of two groups match the same host, the requests always go to the group created first; the order cannot be changed from the interface, the patterns are narrowed or the group with the wide pattern created first is deleted and created again so that it moves to the end of the order. The group the request falls into appears in the Host Group information of the WAF Event Logs record.

How Does It Work?

#	Step	Result
1	The Host value is taken	The Host header as it is (e.g. Shop.example.com:8443); if there is no Host header, the target IP:port (Which host group does a request without a Host Header fall into?)
2	The named groups are tried in their creation order	If one of the group's patterns matches the whole Host value, the request falls into this group; * stands for any sequence of characters, and the other characters are compared exactly and case-sensitively
3	If no group matches	The default group (What is the default host group?)
4	The mode of the group is applied	Learning, Monitor or Blocking; the mode of the other groups does not affect this request
5	Path matching is done in the group's list	Exact path → glob path → Any Paths (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?)

After it is determined which group a Host value falls into, no comparison is made again for the same value. Since adding and deleting a group and editing a pattern regenerate the WAF configuration, new patterns take effect a few seconds after they are saved.

Example: If the shop (*.example.com) and api (api.example.com) groups were created in this order:

Host header	Group it falls into	Reason
www.example.com	shop	*.example.com matches
api.example.com	shop	Since *.example.com was created first, the api group is never examined
example.com	Default Host Group	*.example.com does not match the root domain name
WWW.EXAMPLE.COM	Default Host Group	The comparison is case-sensitive

Monitoring and Correcting in TR7

• Seeing the group of the request: In the WAF Event Logs record, the Host Group information shows the group the request fell into. Groups in Learning mode produce no Event Logs records; the requests that fall into these groups are written to the learning log.
• The order of the groups: The mode cards and the Virtual Host Groups list do not change the creation order of the groups; the evaluation order is always the creation order.
• Resolving the collision: The pattern of the group created first is narrowed (e.g. www.example.com instead of *.example.com). If the wide pattern is to be kept, the rules of the group with the wide pattern are backed up with Export on the Page Types screen, the group is deleted and created again with the same pattern, and the rules are loaded back with Import; since the recreated group is added to the end of the order, the group with the specific pattern is tried first (If I delete a host group, what happens to its rules?).
• Pattern writing: Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?
• Learning analysis: Analysis & Learning also maps the lines in the learning log to the groups with the same logic; the lines that fall into a group not selected in the Virtual Host Groups field of the analysis window do not enter that analysis.

Common Misconceptions

• "The most specific pattern wins." The creation order decides; the first matching group takes the request.
• "A request that matches no group does not go through the WAF, or it is blocked." It is inspected in the default group, with its mode and rules.
• "The example.com pattern also matches subdomains and Hosts with a port." The pattern is compared with the whole Host value; separate patterns are needed for www.example.com and example.com:8443.

How it is done in the documentation

• Virtual Host Groups · Add (which group a request falls into)
• Virtual Host Groups · Virtual Host Patterns
• WAF Rules · Runtime: Rule Matching

Related questions

• How is a request that matches no page type inspected?
• Which stages does a request go through inside TR7 WAF?
• Which host group does a request without a Host Header fall into?