waf

The waf command branch manages the WAF configuration of a vService. It has four resources and these set up a nested structure: the settings belong to the service, the host groups to the settings, the rules to the group and the inspection parts to the rule.

Layers

Layer	Command	What it defines
Service setting	waf options	The protection level, the blocking page, the blacklist, the body processing, the learning, the analysis, the report and the notifications
Host group	waf host-groups	With which WAF mode which hosts will be protected
Path rule	waf fw-rules	With which methods, at what length and at what depth a request path can be
Inspection part	waf rule-parts	The key and value restrictions in a region of the rule

Every layer is bound to the one above it with an identifier: the groups are selected with poolId, the rules with poolId and hostGroupId, and the parts with poolId, hostGroupId and ruleId.

Command Map

Command	Actions
waf options	show · update · update-many
waf host-groups	list · show · add · update · delete · update-many · add-arg-headers · reset-rules
waf fw-rules	list · show · add · update · delete · add-arg-headers
waf rule-parts	list · show · add · update · delete

The Writing of the Identity Fields

The identifier fields are required and are written with the field name and its value together; -- does not come before them.

TR7 WEB-CLI · layers

# 1) the WAF settings of the service

admin@TR7LBWAF01> waf options show poolId <vservice>

 

# 2) the host groups of that service

admin@TR7LBWAF01> waf host-groups list poolId <vservice>

 

# 3) the path rules of a group

admin@TR7LBWAF01> waf fw-rules list poolId <vservice> hostGroupId <group>

 

# 4) the inspection parts of a rule

admin@TR7LBWAF01> waf rule-parts list poolId <vservice> hostGroupId <group> ruleId <rule>

admin@TR7LBWAF01>  

WAF Modes

The mode of the host group determines what the rules will do to the matching request.

Mode	What it does
blocking	It blocks the matching request — the default
monitor	It does not block, it only records
learning	It learns rules from the traffic

Running a new group in the monitor mode first makes it possible to see the wrong matches before passing to blocking.

Things to Know

• Everything is bound to a vService. poolId is written in all four of the commands; the vService records are in the lb service command.
• The rules do not have a name. The path rules are listed with the path they match and the inspection parts in the region: key form.
• The factory set is set up from two commands. The ready header inspections are made with add-arg-headers and the returning of the rules to the factory with reset-rules; both of them are explained on the waf host-groups page.
• Bulk update is present in two resources. The waf options and waf host-groups commands have update-many; the detail is in the bulk update section on the API Commands page.
• The protection level determines the rule set. When the protection level in the waf options command changes, the tightness of the factory rule set changes as well.