What's New

1

Response Header added on the custom Block Page

A response header can be specified for custom alarm pages if you set Page Template to Custom.

Commercial use

Modifying the Alarm Page

2

Downloading events function no longer available

The function of downloading protection event logs has been moved from WAF to the LTS console.

Commercial use

Enabling LTS for WAF Protection Event Logging

3

New layout for protection rules page

The dashboard, basic web protection, CC attack protection, and precise protection rule configuration pages have been optimized.

Commercial use

Configuring Basic Web Protection to Defend Against Common Web Attacks

4

New Dashboard page

Some strings on the Dashboard page have been optimized.

Commercial use

Viewing the Dashboard Page

5

Layer 3 source IP address added to the sub-field.

Layer 3 source IP address is added to the sub-field corresponding to the IPv4/IPv6 field.

Commercial use

Condition Field Description

6

Scanning Protection available

The scanning protection module identifies scanning behaviors and scanner features to prevent attackers or scanners from scanning websites at scale. WAF will automatically block heavy traffic web attacks and directory traversal attacks and block the source IP addresses for a period of time, helping reduce intrusion risks and junk traffic.

Commercial use

Configuring a Scanning Blocking Rule to Automatically Block Heavy-Traffic Attacks

7

Response condition fields supported

The Response Code, Response Length, Response Time, Response Header, and Response Body fields are supported in rule conditions.

Commercial use

Condition Field Description

1

Optimizing the cloud mode domain access page

The page for adding websites to cloud WAF was optimized, which is easier to use.

Commercial use

Connecting a Website to WAF (Cloud Mode - CNAME Access)

2

Optimized purchase page

On the WAF purchase page, a help panel with parameter-level guide on selecting WAF edition is available.

Commercial use

Buying a Cloud WAF Instance

3

Custom time ranges selectable on the dashboard

On the Dashboard page, you can view the protection event logs of all protected websites or instances for a specified time range, including yesterday, today, past 3 days, past 7 days, or past 30 days.

You can select Yesterday, Today, Past 3 days, Past 7 days, or Past 30 days. You can also click Custom and specify a time range within 30 days.

Commercial use

Viewing the Dashboard

4

Optimized web UI for changing expansion package specifications

An independent entry is provided for changing specifications of expansion packages.

Commercial use

Changing the Cloud WAF Edition and Specifications

1

JS Challenge supported for Protective Action in CC attack protection rules

The Protective Action in CC attack protection rules can be set to JS Challenge.

JS Challenge: WAF returns a piece of JavaScript code that can be automatically executed by a normal browser to the client. If the client properly executes the JavaScript code, WAF allows all requests from the client within a period of time (30 minutes by default). During this period, no verification is required. If the client fails to execute the code, WAF blocks the requests.

Commercial use

Configuring a CC Attack Protection Rule

2

Cookie security attributes

If you set Client Protocol to HTTPS, you can enable Cookie Security Attributes. If you enable this, the HttpOnly and Secure attributes of cookies will be set to true.

Cookies are inserted by back-end web servers and can be implemented through framework configuration or set-cookie. Secure and HttpOnly in cookies help defend against attacks, such as XSS attacks to obtain cookies, and help defend against cookie hijacking.

If the AppScan scanner detects that the customer site does not insert security configuration fields, such as HttpOnly and Secure, into the cookie of the scan request, it records them as security threats.

Commercial use

Enabling the Cookie Security Attributes

3

Protection Overview part added on the Dashboard page

The Protection Overview part displays the following data:

• Protection Duration: You can learn of how long the cloud WAF or dedicated WAF you purchase the earliest protects websites in the current enterprise project.

• Domain Names: You can learn of how many domain names you add to WAF in the current enterprise project, as well as how many of them are accessible and how many of them are inaccessible.

• WAF Back-to-Source IP Addresses: In this area, you will learn of new WAF back-to-source IP addresses. A notification will be sent one month in advance if there are new WAF back-to-source IP addresses.

• Updated Rules: In this area, you can check notifications about built-in rule library updates, including emerging vulnerabilities such as zero-day vulnerabilities these rules can defend against. You can also check notifications about new functions, billing details, and critical alarms, such as alarms generated when requests to your domain name bypass WAF.

Commercial use

Dashboard

4

IP address range 0.0.0.0/0 and ::/0 supported for IP address blacklist and whitelist rules

You can configure 0.0.0.0/0 and ::/0 IP address ranges in IP address blacklist and whitelist rules to block all IPv4 and IPv6 traffic, respectively.

Commercial use

Configuring IP Address Blacklist and Whitelist Rules to Block or Allow Specified IP Addresses

5

Case-sensitive path supported by JavaScript-based anti-crawler rules

If a JavaScript-based anti-crawler rule is set to Protect all requests or Protect specified requests, a case-sensitive parameter is added to the condition list. When Field is set to Path, you can enable this parameter to let the rule match case-sensitive paths.

Commercial use

Configuring Anti-Crawler Rules

6

Custom block page supported by precise protection rules

In a precise protection rule, if Protective Action is set to Block, a custom error page can be configured.

Commercial use

Configuring Custom Precise Protection Rules

1

JS Challenge supported for Protection Action in precise protection rules

The Protection Action in precise protection rules can be set to JS Challenge.

JS Challenge: WAF returns a piece of JavaScript code that can be automatically executed by a normal browser to the client. If the client properly executes the JavaScript code, WAF allows all requests from the client within a period of time (30 minutes by default). During this period, no verification is required. If the client fails to execute the code, WAF blocks the requests.

Commercial use

Configuring Custom Precise Protection Rules

2

CNAME access and ELB access to cloud WAF

The ELB access mode is included as one of the cloud access modes.

When adding your website to WAF, you can select Cloud - CNAME or Cloud - Load balancer for Proteciton.

Commercial use

Adding a Website to WAF (Cloud Mode - ELB Access)

3

The OR relationship can be used for condition groups in global protection whitelist.

When configuring a global protection whitelist rule, you can add three groups of conditions. These groups are in the OR relationship. The rule works if any of the three condition groups is matched.

Commercial use

Configuring a Global Protection Whitelist Rule to Ignore False Alarms

1

ELB-mode WAF available

If your service servers are deployed on Huawei Cloud, you can add the domain name or IP address of the website to ELB-mode WAF so that the website traffic can be forwarded to ELB-mode WAF for inspection.

• To use ELB-mode WAF, you need to submit a service ticket to enable it for you first. ELB WAF is available in some regions. For details, see Functions.
• If you have purchased cloud WAF standard, professional, or platinum edition, you can also use the ELB mode. Your ELB-mode WAF instances can use the domain name, bandwidth, and rule extension packages you have purchased along with cloud WAF.

Commercial use

Adding a Website to WAF (ELB Mode)

1

Renaming Bandwidth Expansion Package as QPS Expansion Package

The bandwidth expansion package is officially renamed QPS expansion package. 

The service bandwidth limit is the amount of normal traffic a WAF instance can protect. A QPS expansion package contains:

• For web applications deployed on Huawei Cloud

  Service bandwidth: 50 Mbit/s

  QPS: 1,000 (Each HTTP GET request is a query.)

• For web applications not deployed on Huawei Cloud

  Service bandwidth: 20 Mbit/s

  QPS: 1,000 (Each HTTP GET request is a query.)

Commercial use

Introduction to Cloud WAF QPS Expansion Packages

2

Requests to All WAF instances counted for triggering a CC attack protection rule

If Protective Action in a CC attack protection rule is set to Verification code, you can set a time range for Lock Verification.

If a visitor fails verification code authentication, verification is required for all access requests within the specified period.

Commercial use

Configuring a CC Attack Protection Rule

3

Periodic security reports

WAF can generate daily, weekly, monthly, or custom security reports based on the report template you have created. Reports will be sent to you by the way and within the time range you configure.

Commercial use

Configuring a Report Template

4

Obtaining IP addresses from the network layer

If you want to use a TCP connection IP address to mark the client IP address, set IP Tag to $remote_addr.

Commercial use

Configuring a Traffic Identifier for a Known Attack Source

1

Migrating domain names to other enterprise projects

WAF allows you to share domain names of an enterprise project with other enterprise projects.

Commercial use

Migrating Domain Names to Other Enterprise Projects

2

Forwarding custom header fields

You can use WAF to add additional header information, for example, $request_id, to associate requests on the entire link. WAF can follow your configurations to insert additional fields into a header and forward requests to origin servers. Note that the key value of a custom header field cannot be the same as any native Nginx fields.

Commercial use

Forwarding Custom Header Fields

3

TLS v1.3 supported

WAF supports TLS v1.3. TLS v1.3 is incompatible with other TLS versions.

Commercial use

Configuring PCI DSS/3DS Certification Check and TLS Version

4

Protective action Log only supported for information leakage prevention rules

Protective Action for information leakage prevention rules can be set to Log only.

Commercial use

Configuring an Information Leakage Prevention Rule

5

Caching user-defined header fields

WAF can cache user-defined header fields. In the upper part of the page, click Modify Field to configure the header fields you want WAF to cache.

Commercial use

Configuring a Web Tamper Protection Rule

1

Certificate expiration alarms

WAF has a more friendly alarm notification page, with alarms for certificates before they actually expire included.

Commercial use

Enabling Alarm Notifications

1

Requests to all WAF instances counted for a CC attack protection rule

All WAF instances: This feature enables WAF to count identified requests to on one or more WAF instances according to the rate limit mode you select. By default, requests to each WAF instance are counted for triggering a CC attack rule. If you enable this, WAF will count requests to all your WAF instances for triggering the rule. To enable user-based rate limiting, Per user or Other (Referer must be configured) instead of Per IP address must be selected for Rate Limit Mode. This is because IP address-based rate limiting cannot limit the access rate of a specific user. However, in user-based rate limiting, requests may be forwarded to one or more WAF instances. Therefore, All WAF instances must be enabled for triggering the rule precisely.

Commercial use

Configuring a CC Attack Protection Rule

1

Global protection whitelist rules supported

If All protection is selected for Ignore WAF Protection, all WAF rules, including basic web protection rules and custom rules, will stop to block payload hit WAF rules.

Commercial use

Configuring a Global Protection Whitelist (Formerly False Alarm Masking) Rule

2

Shiro decryption check available

The Shiro decryption check is included in Basic Web Protection. After you enable this check, WAF uses AES and Base64 to decrypt the rememberMe field in cookies and checks whether this field is attacked. There are hundreds of known leaked keys included and checked for.

Commercial use

Configuring Basic Web Protection Rules

1

Modifiable false alarm masking rules

You can modify the false alarm masking rules you add.

Commercial use

Configuring a Global Protection Whitelist (Formerly False Alarm Masking) Rule

1

Intelligent access control against CC attacks

If you enable intelligent access control, WAF uses built-in AI-powered models to analyze traffic to your website, identify CC attacks and abnormal features in HTTP requests on the origin server, and generate specific precise protection and access control rules for your website. In this way, WAF can then automatically protect your website from CC attacks.

Commercial use

Configuring Intelligent Access Control

2

Website connection timeout protection

WAF allows you to set the timeout period for each request of a domain name. You can set the connection, read, and write timeout periods.

Commercial use

Configuring Connection Timeout

3

HTTP/2 protocol

If your website is accessible over the HTTP/2 protocol, enable HTTP/2 in WAF. The HTTP/2 protocol can be used only for access between the client and WAF on the condition that at least one origin server has HTTPS used for Client Protocol.

Commercial use

Enabling the HTTP/2 Protocol

4

IPv6 protection

WAF allows you to enable IPv6 protection for websites on the WAF console. After you enable IPv6 protection, WAF assigns an IPv6 address to your domain name. In this manner, your website can be reached using the IPv6 address. WAF adds IPv6 address resolution in CNAME record sets by default. IPv6 access requests are forwarded to WAF first. WAF detects and filters out malicious attack traffic, and returns normal traffic to the origin server to ensure that the origin server is secure, stable, and available.

Commercial use

Enabling WAF IPv6 Protection

5

Breakdown protection and connection protection

If a large number of 502 Bad Gateway and 504 Gateway Timeout errors are detected, you can enable WAF breakdown protection and connection protection to let WAF suspend your website and protect your origin servers from being crashed. When the number of 502/504 error requests and pending URL requests reach the thresholds you configure, WAF enables corresponding protection for your website.

Commercial use

Configuring Connection Protection

6

Load balancing algorithms

If you configure one or more origin server addresses, you can use a load balancing algorithm to distribute traffic across these origin servers. WAF supports the following algorithms:

• Source IP Hash: Requests from the same IP address are routed to the same backend server.
• Weighted round robin: Requests are distributed across backend servers in turn based on the weight you assign to each server.
• Session Hash: Requests identified by the same session ID are directed to the same origin server.

Commercial use

Switching the Load Balancing Algorithm