Web application firewall

Super WAF inspects every request before it reaches your app and blocks attacks such as SQL injection, cross-site scripting and bad bots. You set it up in the WAF Studio: Super WAF›Web App Firewall (WAF).

The rules live in a Web ACL: an ordered list of rules plus a default action. You create a Web ACL, test it, and attach it to a load balancer. Today only load balancers can be protected.

#How a Web ACL works

Each request goes through the rules in priority order. Every rule has a condition and an action. Some actions stop evaluation (for example Allow or Block): the first of those that matches decides the outcome. Others continue (for example Count or Tag): they record the match and let the next rule run. If no stopping rule matches, the Web ACL's default action applies.

#Create a Web ACL

The preview shows how many rules the template compiles to and how it treats a set of sample requests, for example Normal browser → allow and SQL injection → block. After "Web ACL created", the new Web ACL opens.

#Detect first, then enforce

To switch, use the Detect / Enforce switch in the Web ACL's header. You'll see "Now enforcing" or "Switched to detect-only".

#The Web ACL screen

The header shows the ID, Version, how many rules and compiled rules there are, how many resources it is Protecting, and the Deploy state. Click Deploy to push the current rules to everything the Web ACL protects. Changes you save are deployed automatically, and the message tells you if a deployment failed.

#Add a rule

In the Request pipeline, rules run from top to bottom. Drag a rule to reorder it (you'll see "Priorities updated"), and use its buttons to enable, disable, edit or delete it.

#Actions

Each action says whether it stops evaluation or continues. The list comes from the service and usually includes:

#Managed rules

Managed rules are ready-made protections that are maintained for you.

In the configuration drawer:

• Sensitivity runs from 1 (fewest false positives) to 4 (paranoid). Higher catches more attacks but also more real traffic.
• On match uses each rule's own action, or adds to the anomaly score instead.
• Override every rule's action sets one action for the whole group, for example count while you try it out.
• In the rules table, switch off rules that block real users, or change their action one by one.
• Optionally limit the group to some requests with Only inspect requests matching.

#Test lab

Test your Web ACL before real attackers do. Tests run against the saved Web ACL with the same engine that handles live traffic, and they don't affect your app.

Click Attack suite to send every preset at once. The summary tells you how many attacks were stopped and what happened to normal traffic: you want all attacks stopped and normal traffic allowed. In detect mode, results say would block.

For a quick check while editing rules, use the Quick test panel on the Rules pipeline tab and click Trace through pipeline. Click Clear trace when you are done.

#Protect a load balancer

You'll see "Provisioning WAF in front of the load balancer…", then whether the attachment is active, failed or degraded with the reason. The Attachments of this Web ACL table lists everything it protects. You can also protect a load balancer from its own WAF & access tab.

To remove protection, click Detach on the card and confirm. Traffic then reaches the load balancer without inspection. A load balancer protected by another Web ACL has no buttons here: detach it there first.

If the tab says No load balancers in this prefix, create one first.

#Library

Library items are shared by every Web ACL in the prefix. Changing one redeploys the Web ACLs that use it.

Click New, fill in a Name and the content, and click Save. You can't delete an item that a Web ACL still uses.

#Settings and JSON

On the Settings & JSON tab you can change how the Web ACL behaves: the default action, how much of the body is inspected, the anomaly threshold (0 turns it off), challenge settings, trusted proxies and the real IP header, and the Block response (status, content type and body). Click Save settings.

The OWASP Core Rule Set section turns on an extra, widely used rule set. Set its Paranoia level (1 to 4), and exclude rule IDs, addresses or paths (for example /health) that trigger false positives.

Under Full Web ACL as JSON you can Export and Import the whole Web ACL, view the Compiled policy, run the Dry-run attack suite, and Save JSON. Use this to copy a Web ACL to another prefix.

#Traffic and logs

The Traffic & logs tab shows how many requests were seen, blocked, challenged and counted, how many would block in detect mode, and which rules match most.

To investigate, filter Security events by action, client IP or rule ID and click Load. Each row shows when, the action, the rule, the client and country, the request and the protected resource.

#Delete a Web ACL

#Troubleshooting

• Real users are blocked. Find their requests in Traffic & logs and note the rule. Lower the managed group's sensitivity, switch off that rule, or switch back to Detect while you fix it.
• "Create or select a Web ACL first" Choose a Web ACL before clicking Protect this load balancer on the load balancer.
• The attachment is failed or degraded. Read the error on the card or in Attachments of this Web ACL, then try Protect again or contact support.
• "Add at least one condition" A custom rule needs a condition.