How ESA rules take effect - Edge Security Acceleration - Alibaba Cloud Documentation Center

To effectively manage traffic, it's essential to understand how rules are applied in Edge Security Acceleration (ESA). This guide explains the three core principles of rules: execution priority, rule behavior, and configuration scope.

Execution priority: top to bottom

Rules are processed sequentially, from top to bottom in the rule list (based on ordinal number: 1, 2, 3, and so on).

Rule configurations: A request is checked against Rule 1. If the conditions don't match, it proceeds to Rule 2, and so on.
Global Settings: If a request does not match any of the numbered rules, the Global Settings are applied as a final default.

Order	Rule	Condition
1	Rule 1	Condition A (not matched)
2	Rule 2	Condition B
3	Rule 3	Condition C
Global settings		None
Evaluation order	Rule 1 → Rule 2 → Rule 3 → Global Settings

Rule behavior: cumulative versus terminating

When a rule's conditions are met, it can behave in one of two ways: A cumulative feature supports rule to apply its action, and then the ESA continues to process subsequent rules. This allows multiple rules to apply to a single request.

For cumulative actions

A rule related to a cumulative action applies, then ESA continues to process subsequent rules. This allows multiple rules to apply to a single request.

Example: Modify outgoing request headers

If a request matches Rule 2 and Rule 3, both actions are executed.

Result: The final request sent to the origin will have two new headers: animal: cat and fruit: apple

Order	Rule	Condition	Action	Executed?
1	Rule 1	Condition A (not matched)	Add header `food: rice`	No
2	Rule 2	Condition B	Add header `animal: cat`	Yes
3	Rule 3	Condition C	Add header `fruit: apple`	Yes
Global settings		None	None	Yes

For terminating actions

The rule's action is applied, then ESA stops processing any further rules of the same type. Only the first matching rule takes effect.

Example: Rewrite URL

If a request matches Rule 2 and Rule 3, only the action for Rule 2 is executed because it's the first match in the sequence.

Result: The URL path is rewritten to /animal, and Rule 3 is never evaluated.

Order	Rule	Condition	Action	Executed?
1	Rule 1	Condition A (not matched)	Rewrite the path of the request URL to `/food`.	No
2	Rule 2	Condition B	Rewrite the path of the request URL to `/animal`.	Yes
3	Rule 3	Condition C	Rewrite the path of the request URL to `/fruit`.	No
Global settings		None	None	No

Configuration scope: feature-level versus field-level

For complex features, a single rule may contain multiple configuration fields. How these fields are applied depends on the scope of the feature.

Feature-level execution

Once a matching rule is found, all configured fields in that rule are applied. Evaluation for this feature stops immediately and no further rules are processed.

Note

If a field is not configured, the default value is used.

Example: SSL/TLS rule (terminating)

If a request matches Rule 2 and Rule 3, only the action for Rule 2 is executed, and since the TLS cipher suite is not configured, the default settings are used.

Order	Rule	Condition	SSL/TLS encryption	TLS cipher suite and protocol version	OCSP Stapling	HTTP/2	HTTP/3 (QUIC)	Executed?
1	Rule 1	Condition A (not matched)	Enabled	-	Disabled	Disabled	Disabled	No
2	Rule 2	Condition B	Enabled	-	Disabled	Disabled	Disabled	Yes
3	Rule 3	Condition C	Enabled	-	Enabled	Enabled	Enabled	No
Global settings		None	Disabled	-	Disabled	Enabled	Enabled	No

Field-level execution

Each individual field (or setting) is configured independently by the highest-priority rule that defines it.

Note

When a user request matches a rule, and its feature's fields are empty, ESA looks for the first definition for each one.

Example: Cache rule (terminating)

ESA processes the rule list from top to bottom to find a value for the first setting (such as Cache eligibility). It uses the value from the first matching rule that has this setting configured and then stops looking for that specific setting.

It then repeats the process for the second setting (such as Browser TTL), again scanning from the top of the rule list to find the first matching rule that defines it.

This continues until all settings for the feature have been determined.

Order	Rule	Condition	Cache eligibility	Browser TTL	Edge TTL	Custom CacheKey	Port cache	Cache expired responses	Cache persistence
1	Rule 1	Condition A (not matched)	Eligible	-	Honor the origin TTL (if any). Otherwise, do not cache.	-	-	Disabled	-
2	Rule 2	Condition B	Eligible	-	Honor the origin TTL (if any). Otherwise, do not cache.	-	-	Disabled	-
3	Rule 3	Condition C	Bypass cache	Do not cache	-	-	-	-	-
4	Rule 4	Condition D	Eligible	-	Ignore the origin TTL and use a custom cache TTL of 1 hour	Ignore query strings	-	Disabled	-
5	Rule 5	Condition E	Eligible	-	-	-	-	Disabled	-
Global settings		None	-	-	-	-	Disabled by default	-	Disabled by default
Result			Eligible	Do not cache	Honor the origin TTL (if any). Otherwise, do not cache.	Ignore query strings	Disabled	Disabled	Disabled

Summary: rule behavior by feature

Category	Feature	Behavior	Scope	Priority
SSL/TLS	SSL/TLS rule	Terminating	Feature-level	Higher ordinal = lower priority
SSL/TLS	HTTPS rule	Terminating	Field-level
Transform rules	Rewrite URLs	Terminating	Feature-level
	Modify request header	Cumulative	Field-level
	Modify response header	Cumulative	Field-level
Redirection	Redirect rules	Terminating	Feature-level
Cache	Cache rule	Terminating	Field-level
Content optimization	File compression	Terminating	Field-level
	Image optimization	Terminating	Field-level
	Video processing	Terminating	Field-level
Network optimization	Network optimization rule	Terminating	Field-level
Origin fetch	Origin fetch rule	Terminating	Field-level
Configuration management	Version management	Terminating	Feature-level
Traffic	Waiting room rule	Terminating	Feature-level
Traffic	Load balancing rule	Terminating	Feature-level	Higher ordinal = lower priority. Take note of whether the End action is set: If the End action is set, ESA stops matching subsequent rules after the first matched rule is executed. If the End action is not set, and multiple rules are matched, the action from the last matching rule overrides earlier actions.
Security	Security rules	Terminating	Feature-level	Higher ordinal = lower priority
	Custom rules	Terminating	Feature-level
	Rate limiting rule	Terminating	Feature-level
	Managed rule	Terminating	Feature-level
	Scan protection rule	Terminating	Feature-level
	Whitelist rule	Terminating	Feature-level
	Bots rule	Terminating	Feature-level