:Configure CDN WAF

Prerequisites

• You have activated the Pro Edition or Business Edition of CDN WAF by submitting a ticket.

• Before you enable WAF protection on POPs, set the acceleration region for the domain name to Global or Global (Excluding the Chinese Mainland). For more information about how to change the acceleration region, see Acceleration Region.

Features

CDN WAF integrates WAF capabilities into CDN, providing protection directly on its POPs. For more information about the protection features, see What is Web Application Firewall?

Use cases

CDN WAF is ideal for industries such as finance, e-commerce, O2O, Internet+, gaming, government, and insurance. It protects your accelerated website from losses from external attacks.

Billing

After you enable WAF, CDN WAF inspects all requests to the domain name. WAF-inspected requests are aggregated across all relevant domain names under your account, and you are billed on this total.

Procedure

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the navigation pane for the domain name, click Security Settings.

5. On the Web Application Firewall tab, turn on the Edge WAF switch.

6. Click Modify.

7. Configure the settings on the Web Security, Bot Management, and Access Control/Traffic Throttling tabs.

   Item		Parameter	Description
   Web Security		Status	Turns web application protection on or off.
   		Mode	Specifies the protection mode. Valid values: Block: blocks requests immediately after an intrusion is detected. Warn: generates an alert when an intrusion is detected but does not block the request.
   		Protection Rule Group	Specifies the protection rule group. Valid values: Loose rule group: If you find that the Medium rule group causes a high number of false positives, we recommend that you select the Loose rule group. The loose mode has the lowest rate of false positives but is also more likely to miss attacks. Medium rule group: The default rule group. Strict rule group: When you need stricter protection against path traversal, SQL injection, and command execution, select Strict rule group.
   		Decoding Settings	Specifies the content formats that the WAF engine decodes and analyzes for protection. Click to open the configuration window. Select or clear the checkboxes for the formats that you want to decode. Formats that cannot be deselected: URL Decoding, JavaScript Unicode Decoding, Hex Decoding, Comment Processing, and Space Compression. Formats that can be deselected: Multipart Data Parsing, JSON Data Parsing, XML Data Parsing, Serialized PHP Data Decoding, HTML Entity Decoding, UTF-7 decoding, Base64 Decoding, and Form Data Parsing. Click OK. Note By default, the WAF engine decodes all content formats for maximum protection. If legitimate requests are frequently blocked, you can deselect the problematic format to reduce false positives.
   Bot Management (Business Edition only)	Authorized Crawler	Status	Turns the Allowed Crawlers feature on or off. Note This feature lets you whitelist legitimate search engine crawlers for your domain names. Click Configure Now to manage the whitelist.
   	Typical Bot Behavior Identification	Status	Turns typical bot behavior identification on or off. Note This feature uses a machine learning algorithm to identify typical bot behaviors. You can configure business parameters and risk thresholds to protect against advanced bots. Click Configure Now to add rules.
   	Bot Threat Intelligence	Status	Turns bot threat intelligence on or off. Note This feature uses Alibaba Cloud's threat intelligence, including malicious IP addresses and real-time bot databases. This intelligence can be used to block access to entire domain names or specific paths. Click Configure Now to manage the rules.
   Access Control/Traffic Throttling	IP Blacklist	Status	Turns IP blacklists on or off. Note This feature lets you block access from specific IP addresses, CIDR blocks, or geographic regions. Click Configure Now to add IP-based and geo-based blacklists.
   	Custom Protection Policies	Status	Turns custom protection policies on or off. Note This feature lets you create precise access control and rate limiting rules. Click Configure Now to add a policy.

Service-linked role

The first time you use CDN WAF, you must authorize it to access WAF resources. CDN automatically creates a service-linked role (SLR) named AliyunServiceRoleForCDNAccessingWAF, grants it the required permissions, and uses this role to access your WAF resources.

The AliyunServiceRoleForCDNAccessingWAF role includes permissions for the following API operations:

• DescribePayInfo

• CreatePostpaidInstance

• CreateOutputDomainConfig

• DeleteOutputDomainConfig

• DescribeDomainWebAttackTypePv

• ModifyLogServiceStatus

• DescribeProtectionModuleMode

• DescribeDomainRuleGroup

• DescribeRegions

• ModifyProtectionRuleStatus

• ModifyProtectionRuleCacheStatus

• DescribePeakValueStatisticsInfo

• DescribeDomainAccessStatus

• DescribeFlowStatisticsInfo

• DescribeDomainTotalCount

• DescribeResponseCodeStatisticsInfo

• DescribeDDosCreditThreshold

• ModifyDomainClusterType

• DescribeInstanceInfo

• DescribeOutputDomains

• CreateOutputDomain

• DeleteOutputDomain

• DeleteInstance

• DescribeInstanceSpecInfo

• DescribeDomainBasicConfigs

To delete the AliyunServiceRoleForCDNAccessingWAF role, first request to delete your CDN WAF instance and disable the feature on all domain names by submitting a ticket. Once the instance is deleted, you can delete the SLR on the RAM console.