Connect an ASM ingress gateway to WAF - Alibaba Cloud Service Mesh

You can connect an ASM ingress gateway to a web application firewall (WAF). You can also customize the access log format to view headers that WAF adds to origin requests, which simplifies operations and maintenance. This topic describes how to connect an ASM ingress gateway to WAF and use its custom access log feature for debugging.

Prerequisites

An ingress gateway is deployed. For more information, see Create an ingress gateway.
The cluster is added to the ASM instance.
The httpbin application is deployed and exposed on port 80 of the gateway. For more information, see Deploy the httpbin application.

WAF overview

A web application firewall (WAF) provides comprehensive security for your websites or apps. WAF identifies and blocks malicious web traffic and forwards only legitimate requests to your servers. This protects your origin servers from attacks that could cause performance issues or data breaches, thereby ensuring business continuity and data security.

Step 1: Connect the ASM ingress gateway to WAF

You can connect an ASM ingress gateway to WAF by using a Layer 4 CLB instance or a CNAME record. Choose the method that best fits your needs.

Layer 4 CLB (Recommended): This method connects the CLB instance (formerly SLB) of the ASM ingress gateway to WAF. It routes all gateway traffic through WAF. All requests that arrive at the gateway's CLB are evaluated by WAF rules.
CNAME record: Use this method to protect requests for specific domain names. This is ideal if your ASM ingress gateway handles multiple domain names, but only some require WAF protection.

Note
With this method, you must update your domain name's DNS record to point to the WAF proxy, which then forwards requests to the ASM ingress gateway.

Method 1: Layer 4 CLB

Log on to the Web Application Firewall console. Based on your billing preference, click Subscription or Pay-As-You-Go. Select the desired region, review other settings, and then click Buy Now to create a WAF 3.0 instance. If you already have a WAF instance, you can use it.
In the left-side navigation pane, click Website Configuration. On the Website Configuration page, click the Cloud Native tab. Find CLB(TCP) and click Add in the Actions column.
In the Configure Instance- Layer 4 CLB Instance panel, find the CLB instance associated with your gateway and click Add Port. Select the port used by the ASM ingress gateway and click OK.

This example uses HTTP port 80. If you need to use HTTPS, you must configure an HTTPS certificate.

Note
To find the CLB instance associated with your ingress gateway, log on to the ASM console and check the gateway details page.
Select Enable Traffic Mark. Configure the three headers and click OK.

These headers indicate that WAF has processed the request. The three headers are: Custom Header customwaftag:customwaftagvalue, Originating IP Address clientrealip, and Source Port clientrealport.

Method 2: CNAME record

Log on to the Web Application Firewall console. Based on your billing preference, click Subscription or Pay-As-You-Go. Confirm the settings, such as the region, and then click Buy Now to create a WAF 3.0 instance. If you already have a WAF instance, you can use it.
In the left-side navigation pane, select Website Configuration. On the Website Configuration page, select the CNAME Record tab and click Add.
In the Configure Listener wizard, configure the listener and click Next.

WAF instances in the Chinese mainland require an ICP filing for domain names. To avoid verification failure, enter a valid domain name. This example uses the following settings:

For Website, enter the domain name that you want to protect. For Protocol, select HTTP and set Port to 80. For Layer-7 proxy (Anti-DDoS Pro/Premium or CDN) is deployed in front of WAF, select No. Expand Advanced Settings. Keep Exclusive IP disabled. For Resource, select Shared Cluster. For Resource Group, select Default Resource Group.
In the Configure Forwarding Rule wizard, set Load Balancing Algorithm to IP hash. For Origin Server Address, select IP and enter the public IP address of the ASM ingress gateway. Select Enable Traffic Mark, add the three headers, keep other settings at their default values, and then click Submit.

This configuration adds the three specified headers to requests that WAF forwards to the ASM ingress gateway. The headers are: Custom Header customwaftag:customwaftagvalue, Originating IP Address clientrealip, and Source Port clientrealport.
In the Add Completed wizard, click Copy CNAME to record the CNAME address provided by WAF, and then click Complete.

Note
If you use CNAME access, you must point your domain's DNS record to the CNAME address provided by WAF.

(Optional) Step 2: Customize ASM access log format

Requests processed by a WAF may contain special headers. For example, in Step 1, when you Configure Forwarding, a custom header and two headers that identify the source IP address and source port are added to the request. If these headers are not visible in the call chain logs after you integrate an online application with the WAF, troubleshooting the call chain can be extremely difficult. In this case, you can use the custom access log feature of ASM's observability capabilities. For more information, see Custom Data Plane Access Logs.

Step 3: Verify the WAF connection

Method 1: Layer 4 CLB

Access the gateway's IP address directly. In a browser, enter http://<ASM-ingress-gateway-IP-address>:80/status/418.

Expected output:

-=[ teapot ]=-
       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`

Method 2: CNAME record

Use the CNAME address provided by WAF. Run the following command to access the /status/418 path of the httpbin application.

curl -H "Host: <your-domain-name>" "http://<CNAME-address-provided-by-WAF>/status/418" -v

Expected output

*   Trying x.x.x.x:80...
* Connected to geszcfxxxxxxxxxxxxxxxxxxxxppbeiz.aliyunwaf1.com (x.x.x.x) port 80 (#0)
> GET /status/418 HTTP/1.1
> Host:xxxx
> User-Agent: curl/7.84.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 418 Unknown
< Date: Wed, 22 Feb 2023 05:07:23 GMT
< Content-Length: 135
< Connection: keep-alive
< Set-Cookie: acw_tc=0bc1599a16770424432844282e82xxxxxxxxxxxxxxxxxxx1ad989e7e5245f;path=/;HttpOnly;Max-Age=1800
< server: istio-envoy
< x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-origin: *
< access-control-allow-credentials: true
< x-envoy-upstream-service-time: 1
<
-=[ teapot ]=-
       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`

Note

This command does not use the original domain name for access. To use your original domain name, update its DNS record to point to the WAF CNAME address.

Step 4: View WAF headers in gateway logs

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Log Center.
On the Gateway Logs tab, enter 418 in the search box and click Search & Analyze.

The search results display gateway access logs where the response_code is 418 and the custom_waf_tag field is customwaftagvalue. The logs also include the originating IP address (client_real_ip) and source port (client_real_port). This confirms that the custom WAF tags and client information are recorded in the gateway logs.

After completing the integration, you can log on to the WAF console to configure advanced protection features for your website. To achieve end-to-end observability for other custom headers, follow the method described in Step 2.