Customization and configuration of exclusive clusters - Web Application Firewall

If your services require these features, configure an exclusive cluster and add your websites to it.

Exclusive cluster vs. shared cluster

Item	WAF shared cluster	WAF exclusive cluster
Cluster region	The shared cluster has 11 protection nodes deployed globally. These nodes are located in the following regions: China (Beijing), China (Hangzhou), China (Shenzhen), China (Hong Kong), Singapore, Malaysia, US West, Germany, Indonesia, Dubai, and Japan. When you add a service to the shared cluster, WAF automatically selects the optimal protection region based on the IP address of your origin server.	An exclusive cluster includes a primary and a secondary cluster. You can specify the region for the primary cluster from a list of supported regions. You cannot select the region of the secondary cluster. Important The primary cluster region cannot be changed after it is set. When you add a service to an exclusive cluster, it uses the protection resources in the primary cluster region by default. The secondary cluster provides backup services, takes over if the primary cluster fails, or helps defend against attacks.
Cluster port	If your service uses a special port, you need to specify a custom port when you add a website to WAF. The shared cluster supports specific non-standard ports. For more information, see Ports supported by WAF.	The exclusive cluster supports a wider range of non-standard ports than the shared cluster. In theory, exclusive clusters support all ports except for system ports such as 22, 53, 9100, 4431, 4646, 8301, 6060, 8600, 56688, 15001, 4985, 4986, and 4987. To use a custom port with an exclusive cluster, you must first enable the server port in the exclusive cluster settings. Then, select the enabled port when you add the website to the exclusive cluster. Note An exclusive cluster supports up to 50 custom ports. By default, only ports 80 and 443 are enabled.
SNI	After you add a service to the WAF shared cluster, HTTPS access may fail if a client is not compatible with SNI. For more information, see HTTPS access exceptions caused by SNI incompatibility.	When you configure an exclusive cluster, you can upload a default SNI certificate. This allows clients that do not support SNI to access websites protected by the exclusive cluster.
Error page	The WAF shared cluster uses a default error page. For example, it returns a default block page when it blocks an access request.	To align the error page with your website's design, use an exclusive cluster to create a custom one. You can host a static page on Alibaba Cloud CDN and set its URL as the custom WAF error page.
HTTPS encryption settings	In the shared cluster configuration, you can select appropriate TLS protocol versions and cipher suites based on your security requirements.	In the exclusive cluster configuration, you can select appropriate TLS protocol versions and cipher suites based on your security requirements.
Persistent connection timeout	Shared clusters do not support this configuration.	In the exclusive cluster settings, you can configure the persistent connection timeout to optimize resource usage by managing long-lived connections.

Adding a website to an exclusive cluster

Prerequisites

To use a WAF exclusive cluster, you must purchase a WAF Exclusive instance or upgrade your existing WAF instance to the Exclusive. For more information, see Renewal.

Procedure

After you subscribe to the WAF Exclusive edition, follow these steps to add your website to a WAF exclusive cluster for protection. This section uses port 90 as an example. Because this port is not supported by the shared cluster, you must add the website to an exclusive cluster to protect it with WAF.

Configure the exclusive cluster.
1. Log on to the Web Application Firewall console. In the top navigation bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your WAF instance.
2. In the left-side navigation pane, choose Systems > Exclusive Cluster Configurations.
3. On the Exclusive Cluster Configurations page, configure the cluster.
  
  In this example, go to the Server Port section and add port 90 for the HTTP protocol. For more information, see Configure an exclusive cluster.
4. Click Save Settings.
  
  WAF applies your settings to the exclusive cluster.
Add your service, such as an HTTP service on port 90, to the exclusive cluster.
- For websites already added to WAF
  1. In the left-side navigation pane, choose Asset Center > Website Access.
  2. Find the domain name that you want to add to the exclusive cluster for protection. In the Quick Access column, set Protection Resource to Exclusive Cluster.
    
    Note
    The Protection Resource option is available only for WAF Exclusive instances.
  3. Optional: Edit the website configurations as needed. For example, change the server port to port 90 for the HTTP protocol. For more information, see Add a domain name.
- For new websites
  1. In the left-side navigation pane, choose Asset Center > Website Access.
  2. On the Domain Names tab, click Website Access.
  3. Optional: On the Add Domain Name page, select CNAME Record for Access Mode.
    
    If CNAME Record is already selected on the current page, skip this step.
  4. Click the Manually Add tab. In the Enter Your Website Information step, set Protection Resource to Exclusive Cluster and configure your website details. For example, add port 90 for the HTTP protocol in the Server Port section.
    
    Note
    After you select Exclusive Cluster for protection, you can select a Server Port only from the ports that are enabled in the exclusive cluster settings. For more information, see Configure an exclusive cluster.
    
    For more information about other configurations, see Add a domain name.
  5. Click Next and follow the on-screen instructions to change your domain name's DNS record, which routes your service traffic through WAF.
    
    For more information, see Change the DNS record of a domain name.
If your business needs change, you may need to update your cluster and website configurations by following the instructions in Step 1 (Update cluster configurations) and Step 2 (Edit website configurations).