When your web application is protected by Web Application Firewall (WAF) or is not publicly accessible, a large volume of stress testing traffic can trigger interception, blocking, or scrubbing. This prevents PTS traffic from reaching your application.
Two solutions are available. Solution 1 is recommended because the x-pts-test header is automatically included in every PTS request, remains stable across test runs, and requires no reconfiguration.
| Solution | How it works | Reconfigure per test | Recommended |
|---|---|---|---|
| WAF header whitelist | Whitelist the x-pts-test header in WAF |
No | Yes |
| Load generator IP whitelist | Add load generator IPs to your security policy | Yes -- IPs change each run | No |
Solution 1: Create a WAF whitelist rule for the PTS header
Every HTTP request from PTS includes the x-pts-test header. Create a WAF whitelist rule that matches this header to let all PTS traffic through without triggering protection rules. Unlike IP-based whitelisting, this header does not change between test runs, so a single rule covers all future stress tests.
-
Log in to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. Select Chinese Mainland or Outside Chinese Mainland.
-
In the left-side navigation pane, choose Protection Configuration > Core Web Protection.
-
Click the
icon on the left side of the whitelist, and then click Create Rule in the Actions column. -
In the dialog box, create a whitelist rule and set Match Condition to Header
x-pts-testExists.
Once configured, this rule applies to all future stress tests without reconfiguration. For more information, see Configure a website whitelist.
Solution 2: Whitelist load generator IP addresses
Add the IP addresses of PTS load generators to the whitelist in your security policy.
Load generator IP addresses are not fixed. You must reconfigure the whitelist before each stress test.
Get the load generator IP address
In the left-side navigation pane, choose .
On the Scenarios page, find the target scenario and click Start in the Actions column.
On the Executing Test page, find the IP address of the load generator.
Handle shared resource pools
If you use a shared resource pool, the load generator IP address is available only after the stress test starts. To allow time for whitelist configuration before traffic reaches your application, set a startup waiting time.
Virtual Users Minutes (VUMs) are still consumed during the waiting period.
-
PTS stress testing
Add a delay release instruction to each business session. Set the delay to match the time needed to configure the whitelist.
For details, see Use a delay release instruction.
-
JMeter stress testing
-
In the JMeter test plan, right-click Test Plan and choose .
-
In the setUp Thread Group panel, select Specify Thread lifetime and set the startup delay to the time needed to configure the whitelist.
-