--- title: IIS module install summary: null url: >- https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis --- ## Requirements - Windows Server 2016 (Windows 10) or higher (64-bit) - IIS 10 or higher - Verify you have installed the [Next-Gen WAF agent](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/agent-management/installing-the-agent) for Windows. This will ensure the appropriate folder structure is in place on your file system. ## Before you begin - We only support 64-bit OSes (including 64-bit application pools). For older or 32-bit versions of Windows, it is possible to [deploy the Next-Gen WAF agent as a reverse proxy](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/reverse-proxy-deployment/configuring-agent-reverse-proxy-deployments). If you have questions or require assistance with older or 32-bit versions of Windows, [reach out to our support team](https://support.fastly.com). - IIS Module v2.0 and higher includes the utility `sigscictl.exe` which outputs diagnostic information. The information provided by this utility is useful for troubleshooting issues and checks, among other things, whether or not 32-bit app pools are enabled on your server. ## Download The latest version of the IIS module can be downloaded as an MSI installer or a legacy ZIP archive from [dl.security.fastly.com](https://dl.security.fastly.com/?prefix=sigsci-module-iis/) or [dl.signalsciences.net](https://dl.signalsciences.net/?prefix=sigsci-module-iis/). Alternatively, the IIS module is also downloadable via [Nuget](https://www.nuget.org/packages/SignalSciences.Module.IIS/). ## Installation The IIS Module is available as an [MSI installer](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis#install-using-the-msi) or as a legacy ZIP archive. The install packages contain a DLL that must be configured as an IIS native module and a configuration schema that must be registered with IIS. This configuration and registration with IIS is done automatically by the MSI package, or must be done manually if using the legacy ZIP archive. ### Install using the MSI Double-click (or right-click and select install) the MSI file to install it. Alternatively, for unattended installation, use the following command. This command will not display any output, but will install into `%PROGRAMFILES%\Signal Sciences\IIS Module` by default. It will also register the Next-Gen WAF module and configuration with IIS: > **HINT:** You may be prompted for Administrator credentials if the login session is not already running as an Administrator. ```term copy $ msiexec /qn /i sigsci-module-iis_latest.msi ``` If you require an alternative install location, specify it with the `INSTALLDIR=path` option to the `msiexec.exe` command above. For example: ```term copy $ msiexec /qn /i sigsci-module-iis_latest.msi INSTALLDIR=D:\Program Files\Signal Sciences\IIS Module ``` ### Legacy install using the ZIP archive > **IMPORTANT:** This method may not be supported in the future. It is recommended to install via MSI even if you previously used the ZIP archive. 1. Extract the ZIP archive contents to the IIS Module install directory (`C:\Program Files\Signal Sciences\IIS Module`). 2. Open a terminal running as Administrator. 3. Configure IIS to load the Next-Gen WAF module and register the configuration schema. ```term copy nolinenums $ cd "%PROGRAMFILES%\Signal Sciences\IIS Module" $ .\SigsciCtl.exe Install ``` If you need to install into an alternative location, then you will need to run the `Register-Module -file DLL-path`, `Register-Config -file XML-path` and optional `Configure-Module` commands with the `SigsciCtl.exe` utility (see `SigsciCtl.exe Help` for more information). Ensure the `SigSciIISModule.dll` is not located under the `C:\Users\` directory or its sub-directories. For security, Windows prevents DLL files from being loaded from any location under `C:\Users\`. ## Verify installation To confirm the module DLL has been registered with IIS, run the following from a terminal running as Administrator to verify the SignalSciences module is listed: ```term copy $ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Modules ``` The output should look similar to the following: ```term nolinenums IIS Global Modules: Name Image Precondition -------------------------------- ------------------------------------------------------------------------ ------------------------ HttpLoggingModule %windir%\System32\inetsrv\loghttp.dll UriCacheModule %windir%\System32\inetsrv\cachuri.dll FileCacheModule %windir%\System32\inetsrv\cachfile.dll TokenCacheModule %windir%\System32\inetsrv\cachtokn.dll HttpCacheModule %windir%\System32\inetsrv\cachhttp.dll StaticCompressionModule %windir%\System32\inetsrv\compstat.dll DefaultDocumentModule %windir%\System32\inetsrv\defdoc.dll DirectoryListingModule %windir%\System32\inetsrv\dirlist.dll ProtocolSupportModule %windir%\System32\inetsrv\protsup.dll StaticFileModule %windir%\System32\inetsrv\static.dll AnonymousAuthenticationModule %windir%\System32\inetsrv\authanon.dll RequestFilteringModule %windir%\System32\inetsrv\modrqflt.dll CustomErrorModule %windir%\System32\inetsrv\custerr.dll ApplicationInitializationModule %windir%\System32\inetsrv\warmup.dll SignalSciences C:\Program Files\Signal Sciences\IIS Module\SigsciIISModule.dll bitness64 ``` To confirm that the module configuration has been registered, run the following from a terminal running as Administrator to output the current configuration: ```term copy $ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Configs ``` The output should look similar to the following but may also list sites (workspaces) individually: ```term nolinenums C:\WINDOWS\system32\inetsrv\config\schema: Date Size Name -------------------- ------------ -------------------------------- 2020-02-13 03:12:56Z 677 SignalSciences_schema.xml "SignalSciences" Configuration Section (Global): Attribute Value -------------------------------- ---------------------------------------------------------------- agentHost agentPort 737 statusPagePath Debug False ReuseConnections False MaxPostSize 100000 AnomalySize 524288 AnomalyDurationMillis 1000 TimeoutMillis 200 ``` Full diagnostics information can be displayed with the following command: ```term copy $ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Info ``` ## Configure Configuration changes are typically not necessary. By default, the module will use port 737 to communicate with the agent (or in v2.0.0+, if the agent was configured to use an alternate port, it will use that port). The configuration can be set via the MSI installer, the new `SigsciCtl.exe` utility in v2.0.0+, IIS Manager UI, via PowerShell, or using the `appcmd.exe` utility. > **IMPORTANT:** Ensure that the same port number is used by the both the module and the agent configurations. ### Using the MSI To set a configuration option when installing the MSI, specify the option on the command line in `option=value` format. For example: ```term copy $ msiexec /qn /i sigsci-module-iis_latest.msi agentHost=203.0.113.182 agentPort=737 ``` ### Using SigsciCtl.exe You can use the `SigsciCtl.exe` utility to: - set a configuration option using the `Configure-Module` command. For example: ```term copy $ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Configure-Module agentHost=203.0.113.182 agentPort=737 ``` - view the active configuration using the `Get-Configs` command: ```term copy $ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Configs ``` This should output something similar to the following: ```term nolinenums C:\WINDOWS\system32\inetsrv\config\schema: Date Size Name -------------------- ------------ -------------------------------- 2020-02-13 03:12:56Z 677 SignalSciences_schema.xml "SignalSciences" Configuration Section (Global): Attribute Value -------------------------------- ---------------------------------------------------------------- agentHost agentPort 737 statusPagePath Debug False ReuseConnections False MaxPostSize 100000 AnomalySize 524288 AnomalyDurationMillis 1000 TimeoutMillis 200 ``` - enable debug mode for the `SigsciCtl.exe` utility: ```term copy "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Configure-Module Debug=True ``` > **HINT:** Need help from [Fastly support](https://support.fastly.com/)? Enable debug mode and send Fastly the [Event Viewer](https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524984(v=vs.90)#opening-the-event-viewer) logs. ### Using PowerShell To set a configuration option via PowerShell (modern Windows only) use the `-SectionPath "SignalSciences"` option such as follows: ```term copy $ Set-IISConfigAttributeValue -ConfigElement (Get-IISConfigSection -SectionPath "SignalSciences") -AttributeName "agentPort" -AttributeValue 737 ``` To list the configuration using PowerShell, run the following: ```term copy $ (Get-IISConfigSection -SectionPath "SignalSciences").RawAttributes ``` To reset the configuration to defaults using PowerShell, run the following: ```term copy $ Clear-WebConfiguration -Filter SignalSciences -PSPath 'IIS:\' ``` ### Using the appcmd.exe To set a configuration option via the `appcmd.exe` command line tool use the `-section:SignalSciences` option. For example: ```term copy $ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" set config -section:SignalSciences -agentPort:737 ``` To list the configuration using `appcmd.exe`, run the following. Default values will not be shown: ```term copy $ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" list config -section:SignalSciences ``` To reset the configuration to defaults using `appcmd.exe`, run the following: ```term copy $ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" clear config -section:SignalSciences ``` ## Uninstall 1. Open a terminal running as Administrator. 2. Run the following in the terminal: ```term copy nolinenums $ cd "\%PROGRAMFILES%\Signal Sciences\IIS Module" $ .\SigsciCtl.exe Uninstall ``` ## Upgrade To upgrade the IIS module, download and install the latest version of the IIS module and then verify that the module configuration is still valid. If you previously used the ZIP archive to install the module, we recommend upgrading the module via the MSI package. MSI v1.10.0 or later can be installed over top of an older ZIP file installation. > **HINT:** Check the [IIS module release notes](https://www.fastly.com/documentation/reference/changes/ngwaf-module-iis/) to see what's new in the IIS module. ### MSI package 1. Download the latest IIS Module MSI from [dl.security.fastly.com](https://dl.security.fastly.com/sigsci-module-iis/sigsci-module-iis_latest.msi) or [dl.signalsciences.net](https://dl.signalsciences.net/sigsci-module-iis/sigsci-module-iis_latest.msi). 2. [Install](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis#install-using-the-msi) the IIS module. 3. [Verify](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis#configure) the module configuration is still valid. ### ZIP archive 1. Download the latest IIS module ZIP from [dl.security.fastly.com](https://dl.security.fastly.com/sigsci-module-iis/sigsci-module-iis_latest.zip) or [dl.signalsciences.net](https://dl.signalsciences.net/sigsci-module-iis/sigsci-module-iis_latest.zip). 2. [Install](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis#legacy-install-using-the-zip-archive) the IIS module. 3. [Verify](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/iis#configure) the module configuration is still valid. ## Related content - [About module-agent deployment](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/module-agent-deployment/about-module-agent-deployment) - [Using an API with the Next-Gen WAF](https://www.fastly.com/documentation/guides/next-gen-waf/developer/using-an-api-with-the-next-gen-waf)