Switching WAF Working Mode

Prerequisites

The domain name of the website to be protected has been connected to WAF.

Constraints

• The Bypassed mode is available only when Protection is set to Cloud.
• Before switching to the bypass mode, ensure that the service port of the origin server has been enabled.

Application Scenarios

• Enabled: In this mode, WAF defends your website against attacks based on configured policies.
• Suspended: If a large number of normal requests are blocked, for example, status code 418 is frequently returned, then you can switch the mode to Suspended. In this mode, your website is not protected because WAF only forwards requests. It does not scan for or log attacks. This mode is risky. You are advised to use the global protection whitelist (formerly false alarm masking) rules to reduce false alarms.
• Bypassed: Requests are directly sent to backend origin servers without passing through WAF. Before enabling this mode, enable the service port of origin servers to let requests go to origin servers. Switch the mode to Bypassed only if one of the following conditions is met:
  • Website services need to be restored to the status when the website is not connected to WAF.
  • You need to investigate website errors, such as 502, 504, or other incompatibility issues.
  • No proxy is configured between the client and WAF.

Impact on the System

In Suspended mode, your website is not protected because WAF only forwards requests. It does not scan for attacks. To avoid normal requests from being blocked, configure global protection whitelist rules, instead of using the Suspended mode.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall under Security.
4. In the navigation pane on the left, choose Website Settings.
5. In the row containing the target domain name, click in the Mode column and select a mode you want.