--- title: Edge WAF architecture types summary: null url: >- https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-architecture-types --- The architecture type of your Edge WAF deployment determines the method you can use to manage your deployment and the VCL variables that are available to you. The [architecture types](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/how-the-edge-waf-works) are: - **Out-of-band:** the WAF sits on the side of the request. Your Fastly service forwards requests to the WAF agent for inspection and receives a decision about how to handle each request (e.g., allow or block) before proceeding. This architecture type supports certain Varnish features that aren't available with the other type, such as [Brotli compression](https://www.fastly.com/documentation/guides/full-site-delivery/performance/enabling-automatic-compression). - **In-band:** the WAF sits inline with the request flow. Requests are routed through the Edge WAF for inspection, and the Edge WAF forwards allowed requests to your origin. If you purchased the Next-Gen WAF on or after August 5, 2026, the out-of-band architecture type is the default. Existing customers using the in-band architecture will be migrated to the out-of-band architecture. No customer action is required for this migration. ## Verifying your architecture type If your Edge WAF deployment uses a Compute service, your architecture type is out-of-band. If it uses a CDN service, you need to check the value of the `ngwaf_oob_enabled` parameter to determine your architecture type. To check the value of the `ngwaf_oob_enabled` parameter, follow these steps: 1. Log in to the [Fastly control panel](https://manage.fastly.com) and select [**CDN**](https://manage.fastly.com/configure) from the navigation sidebar. 2. Click **VCL** and then **Complete VCL**. 3. In the VCL, search for `pragma optional_param ngwaf_oob_enabled`. 4. Check the value of the parameter. Possible values are: - **`true`:** the parameter is enabled and the deployment uses the out-of-band architecture. - **`false`:** the parameter is disabled and the deployment uses the in-band architecture. - **Not set:** the parameter is not set and the deployment uses the in-band architecture. ## Determining your deployment management method ### CDN service For Edge WAF deployments with CDN services, the value of the `ngwaf_oob_enabled` parameter determines the method you can use to manage your deployment. The following table shows which management methods are available for each parameter value: {/_ vale Fastly.Spelling["Sigsci"] = NO _/} | Management method | Out-of-band (`true`) | In-band (`false`) | In-band (not set) | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -------------------------------------- | ----------------- | | [Fastly control panel and API](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-deployment-using-the-fastly-control-panel) | ✅ | ✅ - only use for services without mTLS | ❌ | | [Fastly Terraform provider](https://registry.terraform.io/providers/fastly/fastly/latest/docs) | ✅ | ✅ - only use for services without mTLS | ❌ | | [Next-Gen WAF API](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/setting-up-edge-waf-deployments-using-the-next-gen-waf-api) | ⚠️ - only available for existing deployments that were already using this method | ✅ - only use for services with mTLS | ✅ | | [Sigsci Terraform provider](https://registry.terraform.io/providers/signalsciences/sigsci/latest/docs) | ⚠️ - only available for existing deployments that were already using this method | ✅ - only use for services with mTLS | ✅ | {/_ vale Fastly.Spelling["Sigsci"] = YES _/} ### Compute service For Edge WAF deployments with Compute services, the method you can use to manage your deployment is determined by whether you can access the WAF in the Fastly control panel. The following table shows which management methods are available for each scenario: {/_ vale Fastly.Spelling["Sigsci"] = NO _/} | Management method | Can access the WAF in the Fastly control panel | Cannot access the WAF in the Fastly control panel | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------- | | [Fastly control panel and API](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-deployment-using-the-fastly-control-panel) | ✅ | ❌ | | [Fastly Terraform provider](https://registry.terraform.io/providers/fastly/fastly/latest/docs) | ✅ | ❌ | | [Next-Gen WAF API](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/setting-up-edge-waf-deployments-using-the-next-gen-waf-api) | ⚠️ - only available for existing deployments that were already using this method | ✅ | | [Sigsci Terraform provider](https://registry.terraform.io/providers/signalsciences/sigsci/latest/docs) | ⚠️ - only available for existing deployments that were already using this method | ✅ | {/_ vale Fastly.Spelling["Sigsci"] = YES _/} ## Using VCL variables For Edge WAF deployments with CDN services, the value of the `ngwaf_oob_enabled` parameter determines the VCL variables you can use. The following table shows which management VCL variables are available for each parameter value: > **IMPORTANT:** Existing VCL variable configurations remain functional after migration to the out-of-band architecture. However, any new configurations or updates after migration must use the VCL variables specific to the out-of-band architecture. | VCL variable name | Out-of-band (`true`) | In-band (`false`) | In-band (not set) | Description | | ----------------------------------- | ----------------------------------------------------------------------------------------------- | ----------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `bereq.http.x-sigsci_no_inspection` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | Indicates the request was not inspected due to [user-defined conditions](https://www.fastly.com/documentation/guides/next-gen-waf/developer/x-sigsci-headers/#disabling-inspection). | | `req.http.x-sigsci_agent_response` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | A [code](https://www.fastly.com/documentation/guides/next-gen-waf/agent-response-codes/about-agent-response-codes) that indicates the Next-Gen WAF agent's decision to allow or block a request to your web application. The 200 agent response code indicates the request should be allowed, and agent response codes greater than or equal to 301 indicate the request should be blocked. | | `req.http.x-sigsci_decision_ms` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | The time the WAF takes to enrich a request with headers and potentially block it. This VCL variable can only be used in [VCL](https://www.fastly.com/documentation/guides/full-site-delivery/caching/manipulating-the-cache-key). | | `req.http.x-sigsci_tags` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | A CSV string of comma-separated signals that are associated with a request. The VCL variable includes both [system and custom signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/about-signals) (e.g., `SQLI, XSS, NOUA, TOR, SITE.CUSTOM-SIGNAL`). | | `req.http.x-sigsci_origin_status` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | The status of the origin request. | | `req.http.x-sigsci_origin_error` | ⚠️ - only available for existing configurations. New configurations must not use this variable. | ✅ | ✅ | The error message for the origin request. | | `waf.inspection.agentresponse` | ✅ | ❌ | ❌ | A [code](https://www.fastly.com/documentation/guides/next-gen-waf/agent-response-codes/about-agent-response-codes) that indicates the Next-Gen WAF agent's decision to allow or block a request to your web application. The 200 agent response code indicates the request should be allowed, and agent response codes greater than or equal to 301 indicate the request should be blocked. | | `waf.inspection.decision_ms` | ✅ | ❌ | ❌ | The time the WAF takes to enrich a request with headers and potentially block it. This VCL variable can only be used in [VCL](https://www.fastly.com/documentation/guides/full-site-delivery/caching/manipulating-the-cache-key). | | `waf.inspection.tags` | ✅ | ❌ | ❌ | A CSV string of comma-separated signals that are associated with a request. The VCL variable includes both [system and custom signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/about-signals) (e.g., `SQLI, XSS, NOUA, TOR, SITE.CUSTOM-SIGNAL`). | | `waf.inspection.disabled` | ✅ | ❌ | ❌ | Indicates if the WAF inspection is disabled. |