waf host-groups

The waf host-groups command manages the WAF host groups of a vService. Every group carries a host set and the WAF mode to be applied to that set; the WAF rules are kept under the group.

Command Summary

TR7 WEB-CLI · waf host-groups

# Tab after the command

admin@TR7LBWAF01> waf host-groups

add add-arg-headers delete list reset-rules

show update update-many

 

admin@TR7LBWAF01> waf host-groups list poolId <vservice>

admin@TR7LBWAF01> waf host-groups add poolId <vservice> name <name> …

admin@TR7LBWAF01> waf host-groups update poolId <vservice> id <id> …

admin@TR7LBWAF01> waf host-groups delete poolId <vservice> <id>

admin@TR7LBWAF01>  

Required Fields

In the add command the CLI asks for the required fields in the following order, one by one; it does not show the next one before one is written. The fields are written with the field name and its value together.

Order	Field	Status	Value
1	poolId	Required	The vService record in which the group will be defined
2	name	Required	A name specific to the group; the same name cannot be used in two groups

In the update command the order is in the poolId, id form. The list, show and delete commands ask for poolId first; in the show and delete commands the identifier of the group is then written without the field name.

Optional Fields

Field	What it does	What is written after it
--mode	Determines the WAF mode of the group	blocking blocks the matching request (the default) · monitor only records without blocking · learning learns rules from the traffic
--hosts.N	Determines which hosts the group covers	The host name or the IP address; every host with its own index, the same host cannot be written twice

add-arg-headers — Applying the Factory Header Rules

It applies the ready header-argument inspection set (accept-encoding, cookie, host, referer and the like) to the default rule of every targeted host group; it refreshes the existing entries of the set with the current factory definitions. The custom rules and the rest of the default rule are not touched.

Order	Field	Status	Value
1	target	Required	selected the groups checked from the selection list · all all the groups
—	--ids.N	Conditional	The group identities for target selected. Tab does not suggest this field; the identities are checked from the selection list and are written manually in a script

reset-rules — Returning the Rules to the Factory

It sets up the WAF rules of every targeted host group again from the factory set. The factory tightness follows the own protection level of every service.

Order	Field	Status	Value
1	target	Required	selected the groups checked from the selection list · all all the groups
2	scope	Required	defaultRule returns only the default (all paths) rule to the factory, the custom and learned rules stay · all deletes all the rules of the group and sets up the factory set again
—	--ids.N	Conditional	The group identities for target selected; Tab does not suggest it

scope all cannot be reverted without a backup

According to the endpoint explanation, scope all first deletes all the rules of the group. None of them remains, including the learned and the manually written rules. The operation cannot be reverted without a backup.

Both commands show a confirmation screen before they run: they report how many groups will be affected when a selection is made, and that all the groups will be affected when target all is written.

Bulk Update

The update-many applies the same change to many host group records at once. The writing order is the same in every resource.

Step 1 Select the target

The only required field is target: selected for the records selected from the list, all for the entire collection.

Step 2 Add the fields to be written

Only the fields that can be written to many records with the same value are present; the fields specific to the record, such as the identifier, the name and the host list, do not take place in this command.

Step 3 Mark the targets from the list

When target selected is written and no id is given, a selection list with checkboxes opens.

Step 4 Confirm

A warning stating how many records will be affected appears; nothing is written until the confirmation word is typed.

Field	Status	Value
target	Required	selected — the records selected from the list · all — the whole collection
--ids.N	Conditional	The target ids for target selected. It is not suggested in the Tab list: the targets are marked from the selection list. In a script and in a pipeline it is written manually.
--onError	Optional	abort (default) — if even one of the targets does not pass the validation, nothing is written · skip — the targets that pass are written

Writable Fields

TR7 WEB-CLI · update-many · Tab output

# Tab after the command

admin@TR7LBWAF01> waf host-groups update-many

--info target

 

# Tab after the target field

admin@TR7LBWAF01> waf host-groups update-many target

all selected

 

# write -- and Tab: all the writable fields

admin@TR7LBWAF01> waf host-groups update-many target all --

--mode

admin@TR7LBWAF01>  

There is 1 field in the command; the list above is the same as what appears when -- is written and Tab is pressed on the device. What each of them does and what is written after it are in the table below.

The fields that are condition-bound in the single command (those that open according to the value of another field) are listed here without a condition: in the bulk update every target is validated separately according to its own record, and if the field is not active on a target it is skipped only on that target.

Field	What it does	What is written after it
--mode	Changes the WAF mode of the selected groups	blocking blocks · monitor only records · learning learns

Fields that exist in the single command but not here, and the reasons:

Field	Why it is not here
--name	The name is specific to the record; the same name cannot be written to more than one group
--hosts.N	The host list is the identifier of the group; it is marked as closed to bulk writing in the schema (batch: false)

Target Selection and Confirmation

TR7 WEB-CLI · selection list and confirmation

admin@TR7LBWAF01> waf host-groups update-many target selected --mode monitor

 

?  Target objects

    space: mark · ctrl+a: all · enter: confirm

    Filter: (filter by typing) · esc: cancel

 

  [x] <record-1>

  [x] <record-2>

  [ ] <record-3>

    2 selected / 3

 

⚠  2 objects will be updated

    <record-1>, <record-2>

 

Type "yes" to confirm: yes

admin@TR7LBWAF01>  

TR7 WEB-CLI · the whole collection and writing in a script

# the whole collection: the list does not open, the confirmation comes directly

admin@TR7LBWAF01> waf host-groups update-many target all --mode blocking

⚠  This operation will update ALL the objects in the collection

Type "yes" to confirm:

 

# in a script or in a pipeline: the targets are written by hand, the list does not open

admin@TR7LBWAF01> waf host-groups update-many target selected \

--ids.0 <id-1> --ids.1 <id-2> --mode monitor --onError skip

admin@TR7LBWAF01>  

The screen language depends on the user

The texts in the selection list and on the confirmation screen come according to the language preference of the signed-in user. The confirmation word is yes in the English interface and evet in the Turkish interface.

The detailed behavior of bulk update — which fields can be written in bulk and the report returned for each target — is on the API Commands page.

Examples

TR7 WEB-CLI · host groups

# a group that covers two hosts and that monitors first

admin@TR7LBWAF01> waf host-groups add poolId <vservice> name web-group \

--mode monitor --hosts.0 www.kurum.com.tr --hosts.1 kurum.com.tr

 

# passing to blocking after the monitoring ends

admin@TR7LBWAF01> waf host-groups update poolId <vservice> id <id> --mode blocking

 

# spreading the factory header inspections to all the groups

admin@TR7LBWAF01> waf host-groups add-arg-headers target all

 

# returning only the default rule to the factory

admin@TR7LBWAF01> waf host-groups reset-rules target selected scope defaultRule

admin@TR7LBWAF01>  

Things to Know

• A group belongs to a vService. In every command it is stated with poolId on the groups of which vService it is worked.
• The required fields do not take --. poolId, name, target and scope are written with the field name and its value side by side; the optional fields are in the --field value form. The detail is on the API Commands page.
• The mode determines what the rules will do. In the monitor mode the matching request is not blocked, it is only recorded; running a new group with this mode first and then taking it into the blocking mode reduces the wrong blockings.
• The host list is the identifier of the group. It is marked as closed to bulk writing in the schema; writing the same host list to more than one group is not an expected use.
• The rules are managed in separate commands. The path rules are in the waf fw-rules command and the inspection parts of those rules in the waf rule-parts command.
• The settings across the service are separate. The protection level, the blocking page, the learning and the notification settings are in the waf options command.