Getting started with the Edge WAF
- English
- 日本語
If your web application uses a Fastly CDN or Compute service, you can integrate the Next-Gen WAF into your request flow by enabling an Edge WAF deployment. Like your CDN or Compute service, Fastly delivers the Edge WAF through our global network of POPs. This means that you don’t have to make any changes to your hosting environment (e.g., installing clients or applications locally). The Edge WAF is able to process a request within a few milliseconds.
Prerequisites
Before enabling the Edge WAF, be sure you have the following prerequisites in place:
- You must purchase the Next-Gen WAF for your Fastly account by contacting sales@fastly.com. Once purchased, our staff will give you access to the product in the Fastly control panel. Our staff will also create a Next-Gen WAF account (also known as corp) and at least one workspace (also known as site) for your use.
- If you have access to the product in the Fastly control panel, you must be assigned the superuser role in order to enable the Edge WAF. If you only have access to the product in the Next-Gen WAF control panel, you must be assigned the owner role in order to enable the Edge WAF.
- You must have an existing CDN or Compute service that you want to map to an existing Next-Gen WAF workspace (site).
Quick start
Once all prerequisites have been met, you can enable the Edge WAF for your web application. Follow the instructions in the Fastly control panel tab if you'd like to deploy the Edge WAF on a Compute service and have access to the Next-Gen WAF in the Fastly control panel or if the CDN service you're deploying the Edge WAF on meets one of the following conditions:
- The service has the
ngwaf_oob_enabledparameter disabled (false) and doesn't use mutual TLS (mTLS). - The service has the
ngwaf_oob_enabledparameter enabled (true). When this condition is met, it doesn’t matter if the service uses or doesn’t use mTLS.
Otherwise, follow the instructions in the Next-Gen WAF API tab.
- Fastly control panel
- Next-Gen WAF API
To deploy the Next-Gen WAF on an existing CDN or Compute service, complete the following steps:
- Log in to the Fastly control panel.
- From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
Click Service configuration and then Security.
Fill out the following deployment settings on the Next-Gen WAF card:
- From the Workspace menu, select the workspace that you want to link to the service. If your account only has one workspace, this field is read-only.
- (CDN services only) In the % of traffic field, enter the percentage of traffic that you want the Next-Gen WAF to inspect. When set to
100, all traffic to your service is inspected. When the value is less than 100, a random sample of the specified percentage is inspected.
Click the Next-Gen WAF switch to the On position.
In the confirmation window, click Update all versions.
(Optional) Use attack tooling to verify that the Next-Gen WAF is monitoring your web application and identifying malicious and anomalous requests.
To deploy the Next-Gen WAF on an existing CDN service, complete the following steps:
HINT: Have a Compute service? Check out our tutorial.
Using the curl command line tool, call the PUT /edgeDeployment API endpoint. Be sure to replace
${SIGSCI_EMAIL}and${SIGSCI_TOKEN}with your email and Next-Gen WAF API token and${corpName}and${siteName}with those of your account (corp) and workspace (site). You can find these values in the address of the Next-Gen WAF control panel, such ashttps://dashboard.signalsciences.net/corps/${corpName}/sites/${siteName}.$ curl -X PUT "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/edgeDeployment" \-H "x-api-user:${SIGSCI_EMAIL}" \-H "x-api-token:${SIGSCI_TOKEN}" \-H "Content-Type: application/json"Using the curl command line tool, call the PUT /deliveryIntegration/${fastlySID} API endpoint. Be sure to replace
${FASTLY_KEY}with your Fastly authentication token,${fastlySID}with the ID of your CDN service, and${SIGSCI_EMAIL},${SIGSCI_TOKEN},${corpName}, and${siteName}with the same values used in the previous step.$ curl -H "x-api-user:${SIGSCI_EMAIL}" -H "x-api-token:${SIGSCI_TOKEN}" \-H "Fastly-Key: ${FASTLY_KEY}" -H "Content-Type: application/json" -X PUT \-d '{"activateVersion": true, "percentEnabled": 100}' \"https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/deliveryIntegration/${fastlySID}"The Edge WAF starts inspecting all traffic that passes through your CDN service.
(Optional) Use attack tooling to verify that the Next-Gen WAF is monitoring your web application and identifying malicious and anomalous requests.
For detailed set up instructions, check out Setting up Edge WAF deployments using the Next-Gen WAF API.
What’s next
Learn more about how the Edge WAF works and adjust the protection of your web application as needed.
