1. Home
  2. Guides
  3. Next-Gen WAF
  4. Setup and configuration
  5. Edge WAF deployment

Edge WAF deployment using the Fastly control panel

IMPORTANT: This guide only applies to customers who want to deploy the Edge WAF on a Compute service and can access the Next-Gen WAF in the Fastly control panel or want to deploy the Edge WAF on a CDN service that meets one of the following conditions:

  • The service has the ngwaf_oob_enabled parameter disabled (false) and doesn't use mutual TLS (mTLS).
  • The service has the ngwaf_oob_enabled parameter enabled (true). When this condition is met, it doesn’t matter if the service uses or doesn’t use mTLS.

If you don't meet these requirements, refer to the Next-Gen WAF control panel guides instead.

The Edge WAF deployment method hosts the Next-Gen WAF on Fastly’s Edge Cloud platform via our global network of POPs, integrates with Fastly’s caching layer, and is managed by Fastly. Since security processing happens at the edge, the Next-Gen WAF can inspect all traffic before it enters your origin infrastructure and block attacks close to where they originated. You do not need to make any modifications to your own hosting environment.

Prerequisites

Before setting up an Edge WAF deployment, be sure you have the necessary prerequisites in place.

Limitations and considerations

When enabling the Next-Gen WAF for your services, keep the following in mind:

  • Enabling, disabling, or making changes to Fastly Next-Gen WAF on a service immediately impacts all service versions, including the active one.
  • A service can be linked to a maximum of one workspace. A workspace can be linked to multiple services.
  • Only users assigned the superuser role can enable and configure the Edge WAF deployment for services.

Additionally, if you're deploying the Next-Gen WAF on a CDN service, keep the following in mind:

  • Adding the Next-Gen WAF to an existing CDN service counts against the service chain limit.
  • Updates made to your origins in the Fastly control panel are automatically synched to the Edge WAF. This means you never need to manually synchronize your origins.

Setting up the deployment

  1. Fastly control panel
  2. Fastly Products API

To deploy the Next-Gen WAF on an existing CDN or Compute service, complete the following steps:

  1. Log in to the Fastly control panel.
  2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.

  3. Click Service configuration and then Security.

  4. Click the Next-Gen WAF switch to the On position.

    Enable Next-Gen WAF deployment settings

  5. In the confirmation window, click Enable on all versions. Next-Gen WAF is immediately enabled on all versions.

  6. (Optional) Use attack tooling to verify that the Next-Gen WAF is monitoring your web application and identifying malicious and anomalous requests.

Configuring the deployment

  1. Fastly control panel
  2. Fastly Products API

To update your deployment on a CDN or Compute service, complete the following steps:

  1. Log in to the Fastly control panel.
  2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.

  3. Click Service configuration and then Security.

  4. Fill out the following deployment settings on the Next-Gen WAF card.

    HINT: If the Next-Gen WAF is already enabled, click the pencil Pencil icon to edit the settings and then Submit to save the updated values.

    • From the Workspace menu, select the workspace that you want to link to the service. If your account only has one workspace, this field is read-only.
    • (CDN services only) In the % of traffic field, enter the percent of traffic that you want the Next-Gen WAF to inspect. When set to 100, all traffic to your service is inspected. When the value is less than 100, a random sample of the specified percentage is inspected.

    Edit Next-Gen WAF deployment settings

  5. Click Save.

  6. (Optional) Use attack tooling to verify that the Next-Gen WAF is monitoring your web application and identifying malicious and anomalous requests.

Disabling the deployment

To disable Edge WAF deployment for a CDN or Compute service, complete the following steps.

  1. Fastly control panel
  2. Fastly Products API
  1. Log in to the Fastly control panel.
  2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
  3. Click Service configuration and then Security.
  4. In the Next-Gen WAF card, set the Next-Gen WAF to the Off position.
  5. In the confirmation window, click Disable on all versions.

Disabling inspection

The waf.inspection.disabled VCL variable prevents the Next-Gen WAF from inspecting requests that meet user-defined conditions. For example, you can use this variable to bypass the WAF and allow traffic to access static content.

To disable inspection for select requests, create a VCL Snippet:

  1. Log in to the Fastly control panel.
  2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
  3. Click Edit configuration and then select the option to clone the active version.

  4. Click VCL.

  5. Click VCL snippets.

  6. Click Add snippet.

  7. Fill out the Add VCL snippet fields as follows:

    • Using the Type controls, select Regular to create a regular VCL snippet.

    • In the Name field, enter an appropriate name (e.g., Disable WAF inspection).

    • Using the Placement controls, select Within subroutine.

    • From the Subroutine menu, select recv (vcl_recv).

    • (Optional) In the Priority field, enter the order in which you want the snippet to execute. Lower numbers execute first.

    • In the VCL editor, add the following code:

      if (req.url.ext ~ "(?i)^(css|js|gif|png)") {
         set waf.inspection.disabled = true;
      }

  8. Click Add to create the snippet.

  9. From the Activate menu, select Activate on Production to deploy your configuration changes.

Related content

Fastly
© Fastly 2026