Activating/Deactivating an Instance

This article explains the legacy version of WAF that will undergo end-of-life on June 30, 2021. Our new version of WAF expands upon all of the capabilities offered by WAF and Rate Limiting with a simplified and centralized setup. Please upgrade to the latest version of WAF at your earliest convenience.

An instance must be activated via Rules Engine before Web Application Firewall may assess production traffic for potential threats and ensure that traffic conforms to a specific delivery profile. This activation process is a safety measure designed to ensure the following:

• Only vetted WAF profiles are applied to site traffic.

• WAF is only applied to requests that match the criteria defined in rules containing a Web Application Firewall feature.

• Instance activation via Rules Engine provides the following benefits:

  • Centralized Configuration: An instance provides a central location for changing the WAF profile used to screen traffic. This reduces the possibility for the oversight of an old WAF configuration.
  • Flexibility: The use of Rules Engine to define the type of requests that will be screened allows WAF to be configured to meet any and all organizational needs. It allows a single or multiple instances to be applied to different types of requests.

Activate an instance by performing the following steps:

1. Create or duplicate a draft.
2. Create or modify a rule to include the Web Application Firewall feature.

3. Set the Web Application Firewall feature to the desired instance.

   

4. Lock the draft as a policy.
5. Deploy the policy to the Production environment.

Consider the following items when activating an instance:

• The placement of the Web Application Firewall feature within a rule determines the type of requests that will be secured via WAF.

• Activate the Web Application Firewall feature for each type of request that should be secured via WAF.

  • Determine a rule's scope (e.g., all requests or by customer origin) by balancing the need to secure as much traffic as possible with the level of restrictive measures imposed by the WAF security profile.

    The recommended approach for instance activation is to apply the most restrictive policy to as much traffic as possible while causing minimal impact to data delivery.

  • Only a single Web Application Firewall feature should be activated per request type (e.g., all requests or origin-specific requests).

    Setting up Rules Engine to activate multiple WAF instances for a single type of request will only activate one of those instances.

  • Multiple occurrences of the Web Application Firewall feature may point to the same instance. This allows the corresponding security policy to be applied to different types of requests.
• A WAF instance may be deactivated by simply deleting the Web Application Firewall feature associated with the desired rule. This action will not affect any other previously activated WAF instances.

• The activation/deactivation of a Web Application Firewall instance is dependent on Rules Engine. Rule changes, such as adding, modifying, or deleting a rule, may take up to an hour to propagate. Additionally, all rule changes must undergo an internal review process.

  Learn more.

• Do not delete either of the following configurations:

  • A WAF instance while it is associated with the Web Application Firewall feature.
  • A WAF profile assigned to a WAF instance associated with the Web Application Firewall feature.

  View best practices for applying a new WAF instance or profile.