Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
In which mode does a host group I have just added start?
Short answer
In a group added from the interface, when the add window opens, the WAF mode of the vService comes preselected in the WAF Mode field; if it is not changed, the group is saved in this mode. Since the WAF mode of the vService is Learning by default, in a typical setup the new group opens in Learning mode. In a group added with the waf host-groups add command in WEB-CLI, if --mode is not written, the group is created in Blocking mode. The new group does not take the rules of another group; it starts with the default rule set and the suggested header inspections (1 page types on the mode card) and learns from scratch. For this reason, opening it in Blocking mode can lead to legitimate requests being blocked; the recommended order is Learning, Monitor and Blocking (recommended life cycle). To change the mode afterwards, Edit on the mode card of the group is used.
How Does It Work?
| Way of adding | Starting mode |
|---|---|
| Interface: the icon on the Virtual Host Groups band or Add in the group list | The WAF mode of the vService preselected (typical: Learning); can be changed in the window |
WEB-CLI: waf host-groups add, without writing --mode | Blocking |
WEB-CLI: waf host-groups add … --mode learning | The written mode |
| Default group (when WAF is first turned on) | The WAF mode of the vService (default Learning) (after it is enabled) |
The WAF Mode value at the vService level determines only the preselection of new groups; changing it afterwards does not change the mode of the existing groups (Is the WAF mode assigned to the vService or to the host group; how are the modes of several groups summarized on screen?).
The new group starts only with the Any Paths rule and the suggested header inspections; the learned page types of the default group are not copied (recommended life cycle). If the group is opened in Blocking mode, it works only with the Any Paths rule and the suggested header inspections; even though the legitimate parameters and structures of the application have not been learned yet, the signature scan and the limits of Any Paths are applied.
Managing the Starting Mode in TR7
- When adding: In the add window, WAF Mode = Learning Mode is selected (How is a Host Group added; what goes into the Virtual Host Patterns field?). In WEB-CLI,
--mode learningis added to the command. - Afterwards: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, on the mode card of the group, Edit at the bottom right corner of the title strip is clicked, WAF Mode is selected and Edit in the window is clicked; the change is applied within a few seconds and does not touch the rules. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent with Synchronize.
- Starting with the rules of another group: Export is taken on the Page Types screen of the source group, and Import is done on that of the new group (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?). Even if the rules are taken, the group is first tried in Monitor mode.
- Switching criteria: When should I move from Learning to Monitor and from Monitor to Blocking?
Common Misconceptions
- "A new group always starts in Learning mode." In the interface, the mode of the vService is preselected (if the vService mode has been set to Blocking, Blocking comes); in WEB-CLI, if the mode is not written, the group starts in Blocking mode.
- "A new group starts with the mature rules of the existing group." It starts with the default rule set; for this reason, opening it in Blocking mode can lead to legitimate requests being blocked.
- "Changing the mode of the vService also updates the newly added groups." The mode of saved groups changes only from their own cards.
How it is done in the documentation
