Can the default host group be deleted?

Short answer

No. In the Virtual Host Groups list, while the default group is in the selection, the Delete button does not become enabled; Delete cannot be used in the right-click menu of the default group's row; in WEB-CLI, a deletion attempt with the waf host-groups delete command is rejected with the cannot delete default host group error. The default group is the only group that handles the requests that match none of the named groups (Virtual Host Groups); these requests are always inspected in the mode and with the rules of this group. The name and the WAF Mode value of the default group can be changed with Edit, and its page types can be edited; if Delete is applied to the Any Paths rule, the rule is reset to its default values; the rule set of the group can be returned to the default set with the waf host-groups reset-rules command in WEB-CLI (reset-rules). The role of the default group is narrowed by taking the expected domain names into named groups.

How Does It Work?

Every request falls into a host group: if the Host header fits the pattern of a named group, into that group; if not, into the default group (Which host group does a request fall into; what if it matches none?). The default group has no pattern and handles all the "remaining" traffic; for this reason, it is always present on the vService. Just as the group cannot be deleted, its edit window does not have the Virtual Host Patterns field either.

Operation	On the default group
Deleting the group	Cannot be done
Changing its name and WAF Mode value	Done with Edit at the bottom right corner of the title strip on the mode card; even if the name changes, the mode card shows the group as Default Host Group, while the saved name appears in the group list
Adding a pattern	Cannot be done; for specific domain names, a named group is added (How is a Host Group added; what goes into the Virtual Host Patterns field?)
Editing, adding, deleting page types	Done on the Page Types screen opened with the N page types row on the mode card
Resetting the Any Paths rule	Delete is applied to the Any Paths row; the rule is not deleted, it returns to its default values (Can I delete the Any Paths rule?)
Returning the rule set to the default set	WEB-CLI waf host-groups reset-rules; scope all deletes all the rules of the group and sets up the default set again (How do I reset the rules to the default settings?)

Managing the Default Group in TR7

• Narrowing its role: When named groups are added for all the expected domain names, the default group handles only unexpected Host values (requests that come directly with an IP, undefined subdomain names, requests without a Host header) (What is the default host group?). If this group is kept in Monitor or Blocking mode, these requests are also inspected and written to Event Logs.
• Backing up its rules: On the Page Types screen of the default group, the rule set is taken as a JSON file with Export; the file can later be loaded back with Import (Can I export a host group's rule set as JSON and move it to another environment; which settings are not included in the file?).

Common Misconceptions

• "When the name of the default group is changed, it turns into a normal group." The mode card still shows it as Default Host Group; the pattern field does not open and the group cannot be deleted.
• "If Delete is disabled, a permission is missing." It is disabled because the default group is in the selection; when the default group is removed from the selection, the other groups can be deleted.
• "Applying Delete to Any Paths deletes the rules of the default group entirely." The Any Paths rule returns to its default values; manually added argument inspections are lost, and the other page types stay in place.

How it is done in the documentation

• Virtual Host Groups · Delete
• WAF · Terminology
• WEB-CLI · waf host-groups reset-rules

Related questions

• Can I delete the Any Paths rule?
• How do I reset the rules to the default settings?
• What is the default host group?