Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?
Short answer
The WAF mode is assigned to the host group; the mode applied to a request is always the WAF Mode value of the host group the request falls into. The WAF Mode value at the vService level determines only the preselected mode of groups newly added from the interface; changing it afterwards does not change the mode of the existing groups (scope and limits). While the vService has only the default group, the mode of the vService is in effect the mode of this group. While there are several groups, on the WAF Management screen each group appears with its own colored mode card (Learning blue, Monitor yellow, Blocking red) and the modes of the groups are not merged into a single strip. The Virtual Host Groups band at the bottom of the screen summarizes the distribution in the form Requests are evaluated in N host groups, each with its own WAF mode — 2 Blocking, 1 Learning; the same summary also appears in the WAF Mode column of the WAF-Protected vService List. The badge on the WAF card of the Load Balancer Management screen shows the dominant mode of the groups. Changing the mode of one group does not change the mode of the other groups or the rules of the group.
How Does It Work?
| Level | What it determines |
|---|---|
| Host group | The mode applied to the request: Learning, Monitor or Blocking (runtime behavior of the modes) |
| vService | The mode the default group takes when WAF is first turned on (default Learning) and the mode that comes preselected in the form when a new group is added from the interface (In which mode does a host group I have just added start?) |
The mode is applied to all the requests of a group. Some behaviors are independent of the mode and are the same in every group: requests that come with the Teacher identity are not blocked because of the threshold; requests that come with the Conditional Learning identity are processed as in Learning mode, independently of the mode of the group.
Summary on Screen
| Place | Single group | Several groups |
|---|---|---|
| WAF Management mode cards (mode strip) | A single card; only the mode, without the group name and the host sentence | One card per group; named groups first, Default Host Group at the very end; the card color shows the mode of the group |
| Virtual Host Groups band | Define virtual host groups to apply a different WAF mode and learning setup per host | Requests are evaluated in N host groups, each with its own WAF mode — 2 Blocking, 1 Learning; the groups are counted by mode from the most to the least, and the learning methods that are on (e.g. +Teacher) are added at the end |
| WAF-Protected vService List · WAF Mode column | A summary in the same form (e.g. 1 Learning) | The same distribution summary as the band |
| Load Balancer Management · WAF card (WAF) | The mode of the group: Blocking Mode (red), Monitor Mode (yellow) or Learning Mode (blue) | The mode that repeats most among the groups; in a tie, the mode of the default group |
Changing the Mode in TR7
- The mode of a single group: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, on the mode card of the group, Edit at the bottom right corner of the title strip is clicked, WAF Mode is selected and Edit in the window is clicked (WAF Mode Edit screen). The change is applied within a few seconds. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent with Synchronize. Step-by-step description: Can I use different modes for different domains on the same vService?
- The mode of several groups: In WEB-CLI, the mode of the selected groups is changed at once with the
--modefield of thewaf host-groups update-manycommand (bulk update); details: Can I change the WAF settings or host group mode of several vServices at once? - Before switching the mode: Before the group is put into Blocking mode, it is verified in Monitor mode that it does not produce false positives (When should I move from Learning to Monitor and from Monitor to Blocking?).
Common Misconceptions
- "Changing the WAF Mode value of the vService changes the mode of all the groups." It affects only the preselection of groups to be newly added from the interface; the mode of the existing groups is changed from their own cards.
- "A mode change resets the rules of the group." A mode change does not touch the page types and the rules.
- "The signature status (Monitor) on the OWASP Rules screen is the mode of the group." The signature status determines the behavior of a single signature, while WAF Mode determines the host group as a whole; the two are independent of each other.
How it is done in the documentation
