FAQ

This topic provides answers to some commonly asked questions about Web Application Firewall (WAF).

Category	Question
Features	FAQ about pre-sales consulting Can I use WAF to protect servers that are not deployed on Alibaba Cloud? Does WAF support Cloud Web Hosting instances? Can WAF protect HTTPS services? Does WAF support custom ports? Is the QPS limit that is configured for a WAF instance in the WAF console applied to the entire WAF instance or a single domain name added to the WAF instance? Which editions of WAF can defend against SMS flood attacks? Does WAF support two-way HTTPS authentication? Does WAF support the WebSocket, HTTP/2, and SPDY protocols? Which SSL protocols does WAF support? Can WAF protect websites that use New Technology LAN Manager (NTLM) authentication? FAQ about website access configuration Can I enter the private IP address of an ECS instance as the IP address of an origin server in the WAF console? Can WAF protect IP addresses of multiple origin servers for one domain name? How does WAF balance request loads among origin servers? Does WAF support the health check feature? Does WAF support session persistence? Does latency occur when I change the IP address of an origin server in the WAF console? What are the back-to-origin CIDR blocks of WAF? Does WAF automatically add its back-to-origin CIDR blocks to security groups? Do I need to allow access requests from all client IP addresses? Can a WAF instance that uses an exclusive IP address defend against DDoS attacks? Can WAF be deployed with CDN or with Anti-DDoS Pro or Anti-DDoS Premium? Can I deploy WAF with CDN and Anti-DDoS Pro or Anti-DDoS Premium by using different Alibaba Cloud accounts? FAQ about website protection configuration How can I use WAF to defend against HTTP flood attacks? How long does it take for modifications in the WAF console to take effect? When I configure custom protection policies (ACL policies) in the WAF console, can I enter CIDR blocks in the IP field? Why does a custom protection policy in which the URL match field contains two forward slashes (//) not take effect? FAQ about website protection analysis Can I view the source IP addresses of HTTP flood attacks in the WAF console? How do I query the bandwidth usage of WAF?
Website access	How do I troubleshoot website access exceptions? HTTPS access exceptions HTTPS access exceptions arising from SNI compatibility ("Certificate not trusted") How to handle ECS intrusion? How to fix WAF blackholes?
Configuration	Supported domain suffixes If my website receives requests over an unconfigured port, is the origin server threatened? WAF access traffic flow Emergency Mode of HTTP Flood Protection How to fix error 405?
Fault analysis	What do I do if services on non-standard ports cannot be added to WAF of the Pro edition? What do I do if “The HTTPS private key format is invalid” appears when I upload an HTTPS certificate file? File upload requests blocked by Alibaba Cloud WAF How to fix the logon status loss issue? What do I do if a persistent connection times out?
Services	Product specification for Alibaba Cloud DNS version of WAF
Others	Definitions of common web vulnerabilities Why the WAF CNAME address can not be accessed directly?