FAQ

This topic provides answers to some commonly asked questions about Web Application Firewall (WAF).

Type	Question
Feature FAQ	Pre-sales consulting FAQ Can I use WAF to protect servers that are not deployed in Alibaba Cloud? Does WAF support Cloud Web Hosting instances? Does WAF protect HTTPS services? Does WAF support custom server ports? Is the QPS limit that is configured for a WAF instance in the WAF console applied to the WAF instance or a single domain name of the WAF instance? Which editions of WAF can prevent SMS flooding? Does WAF support two-way HTTPS authentication? Does WAF support the WebSocket, HTTP/2, and SPDY protocols? Which SSL protocols does WAF support? Can WAF protect websites that use New Technology LAN Manager (NTLM) authentication? FAQ about website access configuration Can I enter the private IP address of an ECS instance as the IP address of an origin server in the WAF console? Can WAF protect IP addresses of multiple origin servers under one domain name? How does WAF balance request loads among origin servers? Does WAF support the health check feature? Does WAF support session persistence? Does latency occur when you change the IP address of an origin server in the WAF console? What are back-to-origin CIDR blocks of WAF? Does WAF automatically add its back-to-origin CIDR blocks to security groups? Do I need to allow accesses from all client IP addresses? Can a WAF instance that uses an exclusive IP address defend against DDoS attacks? Can WAF be deployed with CDN or with Anti-DDoS Pro or Anti-DDoS Premium? Can I deploy WAF with CDN and Anti-DDoS Pro or Anti-DDoS Premium by using different Alibaba Cloud accounts? What do I need to know about migrating website configurations across Alibaba Cloud accounts? FAQ about website protection configuration How can I use WAF to defend against HTTP flood attacks? How long does it take for modifications in the WAF console to take effect? When I configure custom protection policies (ACL policies) in the WAF console, can I enter CIDR blocks in the IP field? Why does a custom protection policy in which the URL match field contains two forward slashes (//) not take effect? FAQ about website protection analysis Can I view the source IP addresses of HTTP flood attacks in the WAF console? How can I query the bandwidth usage of WAF?
Website access FAQ	How do I troubleshoot website access exceptions? HTTPS access exceptions HTTPS access exceptions arising from SNI compatibility ("Certificate not trusted") How to handle ECS intrusion? How to fix WAF blackholes?
Configuration FAQ	Supported domain suffixes If my website receives requests over an unconfigured port, is the origin server threatened? WAF access traffic flow Emergency Mode of HTTP Flood Protection How to fix error 405?
Fault analysis FAQ	What do I do if services on non-standard ports cannot be added to WAF of the Pro edition? What do I do if “The HTTPS private key format is invalid” appears when I upload an HTTPS certificate file? File upload requests blocked by Alibaba Cloud WAF How to fix the logon status loss issue? Long connection timeout
Service FAQ	Product specification for Alibaba Cloud DNS version of WAF
Other FAQ	Definitions of common web vulnerabilities Why the WAF CNAME address can not be accessed directly?