---
title: Configuring Edge WAF deployments using the Next-Gen WAF API
summary: null
url: >-
  https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/configuring-edge-waf-deployments-using-the-next-gen-waf-api
---

> **IMPORTANT:** This guide only applies to customers who want to deploy the Edge WAF on a Compute service and cannot access the Next-Gen WAF in the Fastly control panel or want to deploy the Edge WAF on a CDN service that meets one of the following conditions:
>
> - The service doesn't have the [`ngwaf_oob_enabled` parameter](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-architecture-types/#determining-your-deployment-management-method) set.
> - The service has the `ngwaf_oob_enabled` parameter disabled (`false`) and uses [mutual TLS (mTLS)](https://docs.fastly.com/products/tls-service-options#mutual-tls-authentication).
>
> If you don't meet these requirements, refer to the [Fastly control panel guide](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-deployment-using-the-fastly-control-panel) instead.

After [deploying the Edge WAF](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/setting-up-edge-waf-deployments-using-the-next-gen-waf-api), you can:

- change the [percentage of traffic](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/configuring-edge-waf-deployments-using-the-next-gen-waf-api#changing-the-percentage-of-traffic-sent-to-the-waf) that is sent to the WAF.
- use [request headers](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/configuring-edge-waf-deployments-using-the-next-gen-waf-api#customizing-inspection-with-headers) to customize inspection.
- [re-assign the Fastly service](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/configuring-edge-waf-deployments-using-the-next-gen-waf-api#re-mapping-a-fastly-cdn-service-to-a-different-workspace-site) to a different workspace (site).

## Changing the percentage of traffic sent to the WAF

You can control the amount of traffic inspected by the Edge WAF using the `Enabled` dictionary key. This value is available in the `Edge_Security` dictionary and is automatically created when you attach a CDN service.

The default value is 0, with numbers greater than zero representing a percentage of the traffic being inspected. This means that unless you change the value of the `Edge_Security` Edge dictionary, your WAF will be enabled but won't inspect any traffic. If the value is set to 100, all traffic (100%) will be passed through the Edge WAF. If the value is less than 100, a random sample of the specified percentage will be sent through the Edge WAF.

> **HINT:** >As the `Edge_Security` Edge dictionary no longer uses the `DISABLED` field, set `Enabled` to 0 if you don't want the WAF to inspect any traffic. Alternatively, you can [use the control panel](https://www.fastly.com/documentation/guides/next-gen-waf/about-the-protection-mode#changing-the-protection-mode-agent-mode) to control blocking and logging behavior of the Edge WAF or to turn off agent configurations entirely.

## Customizing inspection with headers

You can use [`X-SigSci-` headers](https://www.fastly.com/documentation/guides/next-gen-waf/developer/x-sigsci-headers#adding-headers-to-customize-inspection-for-edge-waf-deployments) to customize when the Next-Gen WAF inspects traffic.

### Forcing inspection

When testing your Next-Gen WAF deployment, you can use the curl command line tool to force the Next-Gen WAF to inspect a request by adding the `x-sigsci-force-inspection` header to the request:

```term copy
$ curl ${REQUEST_URL} -H 'x-sigsci-force-inspection: true'
```

### Disabling inspection

The `x-sigsci-no-inspection` header prevents the Next-Gen WAF from inspecting requests that meet user-defined conditions. For example, you can use this header to bypass the WAF and allow traffic to access static content.

To disable inspection for select requests, add the `x-sigsci-no-inspection` header to your service and then associate a condition to the title:

1.   Log in to the [Fastly control panel](https://manage.fastly.com).

2.   From the [**Home**](https://manage.fastly.com/home) page, select the appropriate service. You can use the search box to search by ID, name, or domain.

3.   Click **Edit configuration** and then select the option to clone the active version.

4.   Click **Content**.

5. In the **Headers** area, click **Create a header**.

   ![Create x-sigsci-no-inspection header](/img/ngwaf/create-x-sigsci-no-inspection-header.png)

6. Fill out the **Create a header** fields as follows:
   - In the **Name** field, enter `x-sigsci-no-inspection`.
   - From the **Type** menu, select **Request**, and from the **Action** menu, select **Set**.
   - In the **Destination** field, enter `http.x-sigsci-no-inspection`.
   - In the **Source** field, enter `true`.
   - From the **Ignore if set** menu, select **No**.
   - In the **Priority** field, enter the order the header rules execute.

7. Click **Create**.

8. In the **Headers** area, click **Attach a condition** next to the `x-sigsci-no-inspection` header.

   ![Create request condition for the x-sigsci-no-inspection header](/img/ngwaf/create-no-inspection-condition.png)

9. Fill out the **Create a new response condition** fields as follows:
   - In the **Name** field, enter a descriptive name for the new condition (for example, `x-sigsci-no-inspection condition`).
   - In the **Apply if** field, enter the appropriate request condition that will be applied. For example, `req.url.ext ~ "(?i)^(html|css|js|gif|png|jpg|jpeg|svg|woff|woff2|ttf|eot|otf)$"` disables inspection for requests with a static file extension.

10. Click **Save and apply to**. The new condition for the header is created.

11.   From the **Activate** menu, select **Activate on Production** to deploy your configuration changes.

## Re-mapping a Fastly CDN service to a different workspace (site)

To re-assign the Fastly service to a different workspace (site), follow these steps:

1. If the workspace (site) is new or had a deployment type other than Edge WAF, mark the workspace (site) as an edge deployment by calling the [Edge WAF deployment API endpoint](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__edgeDeployment_put):

   ```term copy nolinenums
   $ curl -X PUT "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/edgeDeployment" \
   -H "x-api-user:${SIGSCI_EMAIL}" \
   -H "x-api-token:${SIGSCI_TOKEN}" \
   -H "Content-Type: application/json"
   ```

   For more information about this API endpoint, check out the [Creating the edge security service](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/setting-up-edge-waf-deployments-using-the-next-gen-waf-api/#creating-the-edge-security-service) section.

2. Using the curl command line tool, call the [DELETE deliveryIntegration/${fastlySID} API endpoint](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__deliveryIntegration__fastlySID__delete) in a terminal application:

   ```term copy nolinenums
   $ curl -v -H "x-api-user: ${SIGSCI_EMAIL}" -H "x-api-token: ${SIGSCI_TOKEN}" \
   -H "Fastly-Key: ${FASTLY_KEY}" -H 'Content-Type: application/json' -X DELETE \
   "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/deliveryIntegration/${fastlySID}"
   ```

   This API call requires the [Fastly-Key](https://www.fastly.com/documentation/reference/http/http-headers/Fastly-Key/) header for authentication. The Fastly API key must have write access to the Fastly service ID. This API call removes all backends from the Edge WAF deployment connected to the Fastly service and detaches the Fastly service from the Edge WAF deployment.

3. Using the curl command line tool, call the [PUT deliveryIntegration/{fastlySID} API endpoint](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__sites__siteName__deliveryIntegration__fastlySID__put) in a terminal application to map the existing Fastly service to the new `${siteName}`. For example:

   ```term copy nolinenums
   $ curl -H "x-api-user:${SIGSCI_EMAIL}" -H "x-api-token:${SIGSCI_TOKEN}" \
   -H "Fastly-Key: ${FASTLY_KEY}" -H 'Content-Type: application/json' -X PUT \
   -d '{"activateVersion": true, "percentEnabled": 100}' \
   "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/deliveryIntegration/${fastlySID}"
   ```

   This API call will activate a new service version by updating the existing Next-Gen WAF VCL dynamic snippet with the new edge security service ID. It also sets the percent of traffic sent to the WAF for inspection to `100`.

4. _(Optional)_ Increase the [percentage of traffic](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/ngwaf-api/configuring-edge-waf-deployments-using-the-next-gen-waf-api#changing-the-percentage-of-traffic-sent-to-the-waf) sent to the WAF for inspection.

## Related content

- [Using Next-Gen WAF in Compute](https://www.fastly.com/documentation/solutions/tutorials/security/using-next-gen-waf-compute/)