Website Connection Overview
To use WAF to protect your web services, connect the web services to WAF first. WAF provides cloud CNAME, cloud load balancer, and dedicated access modes for you. You can select an appropriate access method based on how your web services are deployed.
Tutorial Video
Access Description
You can use the following access methods: cloud CNAME, cloud load balancer, and dedicated mode.
- How it works
In cloud CNAME access, DNS routes the protected domain name to the CNAME record of WAF. The web services for the domain name are routed to WAF. WAF checks received traffic, filters malicious attack traffic, and returns normal traffic to the origin server over back-to-source IP addresses.
During this process, WAF works as a reverse proxy cluster. It checks and forwards traffic of the protected website.
- Applicable scenarios
Service servers are deployed on any cloud or in on-premises data centers.
- Protected objects
Domain names
- How it works
After you connect a website to WAF, the ELB load balancer mirrors the website traffic to WAF. WAF checks the mirrored traffic and synchronizes the check result to the load balancer. The load balancer determines whether to forward client requests to the origin server based on the check result it receives.
In this method, WAF does not forward traffic. This eliminates compatibility and stability issues that might be caused by additional-layer of traffic forwarding.
- Applicable scenarios
Large enterprise websites with service servers deployed on Huawei Cloud and high security requirements for service stability.
- Protected objects
Domain names, public IP addresses, and private IP addresses
Dedicated WAF instances are not available in some regions. For details, see Notice on Web Application Firewall (Dedicated Mode) Discontinued.
- How it works
In dedicated Mode, DNS routes the protected domain name to the EIP bound to the load balancer configured for the dedicated engine. In this way, the web service traffic for the domain name is routed to WAF. WAF detects and filters out malicious attack traffic and returns normal traffic to the origin server through back-to-source IP addresses or IP address ranges of the dedicated engine.
During this process, WAF works as a reverse proxy cluster. It forwards and checks traffic of the protected website.
- Applicable scenarios
Large enterprise websites with service servers deployed on Huawei Cloud and requiring custom protection rules.
- Protected objects
Domain names, public IP addresses, and private IP addresses
Constraints
There are some restrictions on using different access modes.
| Item | Cloud CNAME | Cloud Load Balancer | Dedicated Mode |
|---|---|---|---|
| Domain name restrictions |
| N/A |
|
| ELB load balancer restrictions | -- | Only dedicated ELB load balancers with Specifications set to Application load balancing (HTTP/HTTPS) can be used. Dedicated load balancers with Specifications set to Network load balancing (TCP/UDP) are not supported. | Only dedicated ELB load balancers can be used for dedicated WAF instances. For details, see Load Balancer Types. NOTE: Dedicated WAF instances issued before April 2023 cannot be used with dedicated network load balancers. If you use a dedicated network load balancer (TCP/UDP), ensure that your dedicated WAF instance has been upgraded to the latest version (issued after April 2023). For details, see Dedicated Engine Version Iteration. |
| Service edition restrictions |
| Load balancer access is available only in the standard, professional, or enterprise edition. | -- |
| Certificate restrictions |
| -- |
|
| Protocol restrictions |
| -- | WAF supports the WebSocket protocol, which is enabled by default. Only WebSocket requests can be forwarded. It is not supported during traffic detection. |
| Protection policy restrictions | A protected website domain name can use only one policy. |
|
|
| Specification restrictions | After your website is connected to WAF, you can upload a file no larger than 1 GB each time. | After your website is connected to WAF, you can upload a file no larger than 1 GB each time. | After your website is connected to WAF, you can upload a file no larger than 1 GB each time. |
Function Constraints
The advanced settings and protection rules vary depending on the access mode.
The advanced settings vary depending on the WAF access mode.
| Function | Cloud CNAME | Cloud Load Balancer | Dedicated Mode |
|---|---|---|---|
| Supported | This function is not supported. You can configure TLS on the ELB console. For details, see Configuring TLS Security Policies for Encrypted Communication. | Supported | |
| Supported by professional and enterprise editions | This function is not supported. ELB load balancer access uses an out-of-path detection architecture. WAF only performs out-of-path detection and cannot restore sessions or negotiate HTTP/2 with the client. Therefore, this function is not supported. | Supported HTTP/2 is automatically enabled for dedicated WAF instances provisioned in May 2023 and later. | |
| submit a service ticket to enable it | |||
| Supported | This function is not supported. In this access mode, WAF checks traffic using an out-of-path method. Real packets are transmitted between the ELB load balancer and the origin server. WAF only receives traffic copies mirrored by the load balancer for check and has only read-only permissions. WAF does not have permission to modify the original traffic. So it cannot insert or delete any headers. | Supported | |
| Supported | The Custom page template is supported, but the Redirection page template is not supported. | Supported | |
| Supported | Supported | Supported | |
| Supported by professional and enterprise editions | The cloud load balancer access mode and dedicated mode support IPv6 as long as the load balancers used for the dedicated mode and cloud load balancer access mode support IPv6. | ||
| Supported | This function is not supported. With load balancer access, the ELB load balancer schedules traffic, and WAF does not participate in back-to-origin request forwarding. The load balancing module built in WAF cannot distribute traffic across origin servers. So you need to use the ELB load balancer to distribute requests across origin servers. | Supported | |
| Supported | This function is not supported. Cookies are written in response packets. With ELB load balancer access, WAF cannot modify the original response packets returned by the origin server or add the cookie security flag. | Supported | |
| submit a service ticket to enable it | |||
| submit a service ticket to enable it | This function is not supported. WAF needs to proactively insert a unique identifier into the request header as the trace ID. WAF load balancer access is deployed out of path. It is unable to modify packets. So, the trace ID cannot be inserted. | submit a service ticket to enable it | |
| Supported | Supported | Supported | |
| Not supported | This function is not supported. With load balancer access, the ELB load balancer schedules traffic, and WAF does not participate in back-to-origin request forwarding. The load balancing module built in WAF cannot distribute traffic across origin servers. So you need to use the ELB load balancer to distribute requests across origin servers. | Supported | |
| Configuring a Timeout for Connections Between WAF and a Website Server | Supported by standard, professional, and enterprise editions | This function is not supported. When ELB is used for access, the timeout duration is controlled by the ELB listener and origin server. WAF does not hold the TCP connection of the client and cannot independently control the connection timeout threshold. | Supported |
| Supported by default, cannot be manually disabled or modified | This function is not supported. The ELB load balancer access is deployed in out-of-path mode. WAF cannot block traffic on the main connection, deliver custom responses, or execute break protection logic. | Supported (manual enabling, disabling, and modification) | |
| Supported | This function is not supported. Trace transparent transmission cannot be performed for links if ELB load balancer access is in use. | Supported | |
Supported protection rules vary depending on the WAF access mode.
| Function | Cloud CNAME | Cloud Load Balancer | Dedicated Mode |
|---|---|---|---|
| Configuring Basic Web Protection to Defend Against Common Web Attacks | Supported | Supported | Supported |
| Configuring CC Attack Protection Rules to Defend Against CC Attacks | Supported | Supported | Supported |
| Configuring an Intelligent Rate Limiting Protection Rule to Dynamically Defend Against CC Attacks |
| Not supported | Not supported |
| Supported by standard, professional, and enterprise editions | Supported by standard, professional, and enterprise editions | Supported | |
| Configuring Blacklist and Whitelist Rules to Block or Allow Specified IP Addresses | Supported by standard, professional, and enterprise editions |
| Supported |
| Configuring Geolocation Access Control Rules to Block or Allow Requests from Specific Locations | Supported by standard, professional, and enterprise editions |
| Supported |
| Supported by professional and enterprise editions | Not supported | Supported by dedicated WAF instances versions released after September 2022 | |
| Configuring Web Tamper Protection Rules to Prevent Static Web Pages from Being Tampered With | Supported by standard, professional, and enterprise editions | Not supported | Supported |
| Not supported | Supported | |
| Configuring Information Leakage Prevention Rules to Protect Sensitive Information from Leakage | Supported by professional and enterprise editions | Not supported | Supported |
| Configuring a Global Protection Whitelist Rule to Ignore False Alarms | Supported | Supported | Supported |
| Configuring Data Masking Rules to Prevent Privacy Information Leakage | Supported by standard, professional, and enterprise editions | Supported by standard, professional, and enterprise editions | Supported |
| Configuring a Scanning Blocking Rule to Automatically Block Heavy-Traffic Attacks | Supported by professional and enterprise editions | Not supported | Supported |
| Configuring Bot Protection Rules to Defend Against Bot Behavior | You can submit a service ticket to enable this function. | Not supported | Not supported |
| Configuring AI Model Check Rules for Security and Compliance of LLM Applications | Supported by standard, professional, and enterprise editions | Not supported | Not supported |
| Creating a Reference Table to Configure Protection Metrics in Batches | Supported by standard, professional, and enterprise editions | Supported by standard, professional, and enterprise editions | Supported |
| Configuring a Known Attack Source Rule to Block Specific Visitors for a Specified Duration | Supported | Supported | Supported |
What is your overall rating for this page?
Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
