When different routes on a cloud-native gateway require different security policies, instance-level WAF protection alone is insufficient. Route-level WAF protection in Microservices Engine (MSE) integrates with Web Application Firewall (WAF) 3.0 to apply targeted security rules to individual routes, so you can protect specific endpoints without affecting other routes on the same gateway.
How instance-level and route-level WAF protection work together
MSE supports two levels of WAF protection. You can use them independently or together.
| Level | Scope | When to use |
|---|---|---|
| Instance-level | All routes on a gateway | You want uniform WAF protection across the entire gateway |
| Route-level | A specific route | You want to apply WAF protection to specific routes only, or you need different protection policies per route |
Prerequisites
Before you begin, make sure that you have:
An MSE cloud-native gateway with at least one route configured
Permissions to manage WAF settings in the MSE console
Enable route-level WAF protection for a route
-
Log on to the MSE console, and select a region in the top navigation bar.
-
In the left-side navigation pane, choose Cloud-native Gateway > Gateways. On the Gateways page, click the ID of the gateway.
-
In the left-side navigation pane, click Routes. Then, click the Routes tab.
Click the name of the target route. On the route details page, click the Policies tab, and then click WAF.
In the WAF section, click Enable Route-level WAF Protection (Recommended).
In the confirmation dialog box, click OK.
Default protections after enablement
After you enable route-level WAF protection, WAF detects and filters all access traffic to the route. The following two protection features are enabled by default:
| Feature | Protection scope |
|---|---|
| Protection rules engine | Common web attacks: SQL injections, cross-site scripting (XSS) attacks, and webshell uploads |
| HTTP flood protection | HTTP flood attacks |
All other WAF features are disabled by default. To enable additional protection features or configure custom protection rules, see Overview of WAF features.
See also
Enable WAF protection: Enable instance-level WAF protection for an entire gateway