WAF exclusive cluster best practices - non-standard ports, SNI, custom error pages - Web Application Firewall

If your services require any of these features, configure an exclusive cluster and add your websites to it.

Exclusive clusters vs. shared clusters

Feature	WAF shared cluster	WAF exclusive cluster
Cluster region	Shared clusters have 11 global protection nodes: China (Beijing), China (Hangzhou), China (Shenzhen), China (Hong Kong), Singapore, Malaysia, US (West), Germany, Indonesia, Dubai, and Japan. WAF automatically assigns the optimal protection node based on your origin server IP.	An exclusive cluster has a primary and a secondary cluster. You specify the primary cluster region from supported regions. The secondary cluster region is automatically assigned and cannot be changed. Important The primary cluster region cannot be changed after configuration. By default, the primary cluster protects your services. The secondary cluster takes over if the primary cluster fails or provides additional defense during attacks.
Cluster ports	If your service uses a non-standard port, specify it when adding the website to WAF. Shared clusters support a specific set of non-standard ports listed in Ports supported by WAF.	Exclusive clusters support a wider range of non-standard ports. Only system ports (22, 53, 9100, 4431, 4646, 8301, 6060, 8600, 56688, 15001, 4985, 4986, and 4987) are unsupported. To use a custom port, enable it in the exclusive cluster settings first, then select it when adding your website. Note Up to 50 custom ports can be enabled. By default, only ports 80 and 443 are enabled.
SNI	In shared clusters, clients incompatible with SNI may fail to access HTTPS services. HTTPS access exceptions due to SNI incompatibility.	You can upload a default SNI certificate to ensure clients that do not support SNI can still access your websites.
Error page	Shared clusters return a default error page when blocking malicious traffic.	You can configure a custom error page that matches your website design. Upload a custom static page to Alibaba Cloud CDN and set its URL as the WAF error page.
HTTPS encryption settings	Select TLS protocol versions and cipher suites based on your security requirements.	Select TLS protocol versions and cipher suites based on your security requirements.
Persistent connection timeout	Not supported.	Set a custom persistent connection timeout to reduce resource consumption from connection issues.

Add a website to an exclusive cluster

Prerequisites

A WAF Exclusive instance is required. Purchase a new instance or upgrade to the Exclusive. Renewal instructions.

Procedure

This example uses HTTP port 90, a non-standard port unsupported by shared clusters. To protect services on this port, use an exclusive cluster.

Configure the exclusive cluster.
1. Log on to the WAF console. In the top navigation bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your WAF instance.
2. In the left-side navigation pane, choose Systems > Exclusive Cluster Configurations.
3. On the Exclusive Cluster Configurations page, configure the exclusive cluster based on your service requirements.
  
  In this example, go to the Server Port section and add port 90 for the HTTP protocol. Configure an exclusive cluster.
4. Click Save Settings.
  
  WAF applies your exclusive cluster settings.
Add your service (for example, an HTTP service on port 90) to the exclusive cluster.
- For an existing website
  1. In the left-side navigation pane, choose Asset Center > Website Access.
  2. Find the domain name that you want to add to the exclusive cluster. In the Quick Access column, set Protection Resource to Exclusive Cluster.
    
    Note
    The Protection Resource option is available only for WAF instances of the Exclusive.
  3. Optional: Edit the website configurations as needed. For example, change the server port to port 90 for the HTTP protocol. Add a domain name.
- If you are adding a new website
  1. In the left-side navigation pane, choose Asset Center > Website Access.
  2. On the Domain Names tab, click Website Access.
  3. Optional: On the Add Domain Name page, set Access Mode to CNAME Record.
    
    If CNAME Record is already selected, skip this step.
  4. Click the Manually Add tab. In the Enter Your Website Information step, set Protection Resource to Exclusive Cluster and enter your service details. For example, add port 90 for the HTTP protocol in the Server Port section.
    
    Note
    After you select Exclusive Cluster as the protection resource, only ports enabled in the exclusive cluster settings are available for Server Port. Configure an exclusive cluster.
    
    Other configurations: Add a domain name.
  5. Click Next and follow the on-screen instructions to update the DNS record for your domain to route traffic through WAF.
    
    Modify the DNS record of a domain.
If your service requirements change, update the cluster and website configurations in Step 1 (Update cluster configurations) and Step 2 (Edit website configurations).