Issue
For security reasons, your application may not be exposed to the public internet or may be protected by Alibaba Cloud's Web Application Firewall (WAF). In such cases, a large volume of stress testing traffic can trigger security measures such as interception, blocking, and scrubbing, causing WAF to block traffic from Performance Testing Service (PTS).
Solutions
Solution 1: Configure a WAF header whitelist
If the application you are testing uses WAF, you can configure a website whitelist rule using a request header to allow stress testing traffic from PTS to pass through. Follow these steps:
-
Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
In the left-side navigation pane, choose Protection Configuration > Core Web Protection.
Click the
icon to the left of the whitelist, and then click New Rule in the Actions column. In the dialog box that appears, create a new website whitelist rule and set the matching condition to Header x-pts-testexists.
HTTP requests sent by PTS contain the x-pts-test header, so you need to create a new website whitelist rule and set its match condition to the presence of the x-pts-test header. For more information about website whitelist settings, see Configure a website whitelist.
Solution 2: Configure an IP whitelist
You can also add the IPs of the load generators to an IP whitelist in your security policy. Note that the stress testing IPs are not fixed. This solution requires reconfiguring the IP whitelist for each test. We recommend using Solution 1. The following steps describe how to obtain the load generator IPs:
Start the performance test directly and obtain the IP address of the load generator after the test starts. If you have an existing scenario, in the left navigation bar of the console, select . Then, on the Scenarios page, click Start in the Actions column of the target scenario to start the performance test.
After the performance test starts, on the In Progress page, you can directly view the load generator IP.
If you use a shared resource pool, you cannot obtain the load generator IPs before a test starts. To allow time for configuring the whitelist before traffic is generated, you can add a startup waiting time to your scenario. Set the waiting time based on how long you need to configure the whitelist. This waiting period consumes VUMs. The following steps describe how to set the startup waiting time in PTS and JMeter tests:
Set a startup waiting time in a PTS test
Add a delay release instruction to each business session. Set the delay duration based on the time you need to configure the whitelist. For more information about adding a delay release instruction, see Use a delay release instruction.
Set a startup waiting time in a JMeter test
In your JMeter test plan, right-click and choose Test Plan > Add > Threads (Users) > setUp Thread Group.
On the setUp Thread Group panel, select the Specify Thread lifetime checkbox and set the startup delay to the required waiting time, as shown in the following figure.
