Website Connection Overview
To use Web Application Firewall (WAF) to protect your web services, the services must be connected to WAF. WAF provides three access modes for you to connect web services to WAF: cloud CNAME, cloud load balancer, and dedicated access modes. You can select a proper access method based on how your web services are deployed. This topic describes how WAF works in different access modes, their differences, and when to use them.
Application Scenarios
WAF provides the following access modes for you to connect websites to WAF.
- Cloud - CNAME access mode
- Service servers are deployed on any cloud or in on-premises data centers.
- Protected objects: domain names
- Connecting a Website to WAF (Cloud Mode - CNAME Access)
- Cloud - Load balancer access mode
- Service servers are deployed on Huawei Cloud.
This mode suitable for large enterprise websites having high security requirements on service stability.
- Protected objects: domain names and IP addresses
- Connecting a Website to WAF (Cloud - ELB Load Balancer Access Mode)
- Service servers are deployed on Huawei Cloud.
- Dedicated mode
- Service servers are deployed on Huawei Cloud.
This mode is suitable for large enterprise websites that have a large service scale and have customized security requirements.
- Protected objects: domain names and IP addresses
- Connecting a Website to WAF (Dedicated Mode)
- Service servers are deployed on Huawei Cloud.
Constraints
There are some restrictions on using different access modes.
When you connect your website to WAF in cloud CNAME access mode, pay attention to the following restrictions.
When you connect your website to WAF in cloud load balancer access mode, pay attention to the following restrictions.
- Only dedicated ELB load balancers with Specifications set to Application load balancing (HTTP/HTTPS) can be used. Dedicated load balancers with Specifications set to Network load balancing (TCP/UDP) are not supported.
- Only the professional and platinum editions allow you to specify a custom policy for Policy.
When you connect your website to WAF in dedicated mode, the restrictions are as follows:
Constraint |
Description |
---|---|
ELB load balancer |
When a website is connected to a dedicated WAF instances, only dedicated ELB load balancers are supported. For details, see Load Balancer Types.
NOTE:
Dedicated WAF instances issued before April 2023 cannot be used with dedicated network load balancers. If you use a dedicated network load balancer (TCP/UDP), ensure that your dedicated WAF instance has been upgraded to the latest version (issued after April 2023). For details, see Dedicated Engine Version Iteration. |
Domain name |
|
Proxy |
If a layer-7 proxy server, such as CDN or cloud acceleration, is used before WAF, you need to select Layer-7 proxy for Proxy Configured. By doing this, WAF can obtain real client access IP addresses from the configured header field. For details, see Configuring a Traffic Identifier for a Known Attack Source. |
Certificate |
|
WebSocket protocol |
WAF supports the WebSocket protocol, which is enabled by default.
|
Processes of Connecting a Website to WAF
The process of connecting a website to WAF varied depending on the access mode you select.
When connecting a website to WAF in CNAME access mode, refer to the process shown in Figure 1.
Procedure |
Description |
---|---|
Configure basic information, such as the domain name, protocol, and origin server. |
|
If other security software or firewalls are installed on your origin server, whitelist only requests from WAF. This ensures normal access and protects the origin server from hacking. |
|
To ensure that your WAF instance forwards website traffic normally, test the WAF instance locally and then route traffic destined for the website domain name to WAF by modifying DNS record. |
|
Connect your website to WAF in just a few clicks. For details, see Connecting a Website to WAF (Cloud Mode - Load Balancer Access).
When connecting a website to WAF in dedicated mode, refer to the process shown in Figure 2.
Impact on the System
If a non-standard port is configured, the visitors need to add the non-standard port to the end of the website address when they access the website. Otherwise, a 404 error will occur. If a 404 error occurs, see How Do I Troubleshoot 404/502/504 Errors?
Fixing Inaccessible Websites
If a domain name fails to be connected to WAF, its access status is Inaccessible. To fix this issue, see Why Is the Access Status of a Domain Name or IP Address Inaccessible?
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot