Configuring Edge WAF deployments using the Next-Gen WAF API

After deploying the Edge WAF, you can:

• change the percentage of traffic that is sent to the WAF.
• use request headers to customize inspection.
• re-assign the Fastly service to a different workspace (site).

Changing the percentage of traffic sent to the WAF

You can control the amount of traffic inspected by the Edge WAF using the Enabled dictionary key. This value is available in the Edge_Security dictionary and is automatically created when you attach a CDN service.

The default value is 0, with numbers greater than zero representing a percentage of the traffic being inspected. This means that unless you change the value of the Edge_Security Edge dictionary, your WAF will be enabled but won't inspect any traffic. If the value is set to 100, all traffic (100%) will be passed through the Edge WAF. If the value is less than 100, a random sample of the specified percentage will be sent through the Edge WAF.

Customizing inspection with headers

You can use X-SigSci- headers to customize when the Next-Gen WAF inspects traffic.

Forcing inspection

When testing your Next-Gen WAF deployment, you can use the curl command line tool to force the Next-Gen WAF to inspect a request by adding the x-sigsci-force-inspection header to the request:

$ curl ${REQUEST_URL} -H 'x-sigsci-force-inspection: true'

Disabling inspection

The x-sigsci-no-inspection header prevents the Next-Gen WAF from inspecting requests that meet user-defined conditions. For example, you can use this header to bypass the WAF and allow traffic to access static content.

To disable inspection for select requests, add the x-sigsci-no-inspection header to your service and then associate a condition to the title:

1. Log in to the Fastly control panel.
2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
3. Click Edit configuration and then select the option to clone the active version.
4. Click Content.

5. In the Headers area, click Create a header.

   

6. Fill out the Create a header fields as follows:

   • In the Name field, enter x-sigsci-no-inspection.
   • From the Type menu, select Request, and from the Action menu, select Set.
   • In the Destination field, enter http.x-sigsci-no-inspection.
   • In the Source field, enter true.
   • From the Ignore if set menu, select No.
   • In the Priority field, enter the order the header rules execute.

7. Click Create.

8. In the Headers area, click Attach a condition next to the x-sigsci-no-inspection header.

   

9. Fill out the Create a new response condition fields as follows:

   • In the Name field, enter a descriptive name for the new condition (for example, x-sigsci-no-inspection condition).
   • In the Apply if field, enter the appropriate request condition that will be applied. For example, req.url.ext ~ "(?i)^(html|css|js|gif|png|jpg|jpeg|svg|woff|woff2|ttf|eot|otf)$" disables inspection for requests with a static file extension.

10. Click Save and apply to. The new condition for the header is created.

11. From the Activate menu, select Activate on Production to deploy your configuration changes.

Re-mapping a Fastly CDN service to a different workspace (site)

To re-assign the Fastly service to a different workspace (site), follow these steps:

1. If the workspace (site) is new or had a deployment type other than Edge WAF, mark the workspace (site) as an edge deployment by calling the Edge WAF deployment API endpoint:

   $ curl -X PUT "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/edgeDeployment" \
   -H "x-api-user:${SIGSCI_EMAIL}" \
   -H "x-api-token:${SIGSCI_TOKEN}" \
   -H "Content-Type: application/json"

   For more information about this API endpoint, check out the Creating the edge security service section.

2. Using the curl command line tool, call the DELETE deliveryIntegration/${fastlySID} API endpoint in a terminal application:

   $ curl -v -H "x-api-user: ${SIGSCI_EMAIL}" -H "x-api-token: ${SIGSCI_TOKEN}" \
   -H "Fastly-Key: ${FASTLY_KEY}" -H 'Content-Type: application/json' -X DELETE \
   "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/deliveryIntegration/${fastlySID}"

   This API call requires the Fastly-Key header for authentication. The Fastly API key must have write access to the Fastly service ID. This API call removes all backends from the Edge WAF deployment connected to the Fastly service and detaches the Fastly service from the Edge WAF deployment.

3. Using the curl command line tool, call the PUT deliveryIntegration/{fastlySID} API endpoint in a terminal application to map the existing Fastly service to the new ${siteName}. For example:

   $ curl -H "x-api-user:${SIGSCI_EMAIL}" -H "x-api-token:${SIGSCI_TOKEN}" \
   -H "Fastly-Key: ${FASTLY_KEY}" -H 'Content-Type: application/json' -X PUT \
   -d '{"activateVersion": true, "percentEnabled": 100}' \
   "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/deliveryIntegration/${fastlySID}"

   This API call will activate a new service version by updating the existing Next-Gen WAF VCL dynamic snippet with the new edge security service ID. It also sets the percent of traffic sent to the WAF for inspection to 100.

4. (Optional) Increase the percentage of traffic sent to the WAF for inspection.

Related content

• Using Next-Gen WAF in Compute