Web Application Firewall:Enable WAF for an MSE cloud-native gateway

How it works

When you integrate an MSE cloud-native gateway instance with WAF, the connection is established through SDK integration. The SDK is embedded in the cloud service and handles traffic extraction, detection, and protection. WAF does not participate in traffic forwarding. This approach avoids compatibility and stability issues that can arise from an additional forwarding layer.

Applicability

If your MSE gateway instance does not meet the following requirements, use CNAME access instead.

• Account requirements: The MSE gateway and the WAF instance must belong to the same Alibaba Cloud account, unless you have configured Resource Directory.

• Region requirements: You can enable WAF protection only for MSE gateways in the following regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Ulanqab), China (Hong Kong), Singapore, Malaysia (Kuala Lumpur), China (Zhangjiakou), China (Shenzhen), Japan (Tokyo), Germany (Frankfurt), US (Silicon Valley), and US (Virginia).

Procedure

1. Go to the console:

   Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select the resource group and region (Chinese Mainland) of your WAF instance. In the navigation pane, click Onboarding. Click the Cloud Native tab, and from the list of cloud service types on the left, select Microservices Engine (MSE) - Cloud-native Gateway.

2. Authorize the service (for first-time users only):

   Click Authorize Now to complete the service authorization. You can go to the RAM console and choose Identities > Roles to view the created service-linked role AliyunServiceRoleForWAF.

3. Add an Microservices Engine (MSE) - Cloud-native Gateway instance:

   1. Click Add. You are redirected to the Microservices Engine (MSE) console.

   2. In the top navigation bar, select a region. In the left-side navigation pane, choose Cloud-native Gateway > Gateways and find your instance.

      Instance-level protection

      In the WAF Protection column of the target instance, click the icon, click Enable Gateway Protection, and then click OK.

      Route-level protection

      1. Click the target instance ID. In the left-side navigation pane of the Basic Information page, choose Routes.

      2. On the Routes tab, click the icon in the WAF column of the target route. Then, click Enable Route-level WAF Protection (Recommended) and click OK in the dialog box that appears.

      Domain-level protection

      1. Click the target instance ID. In the left-side navigation pane of the Basic Information page, choose Routes.

      2. On the Domain tab, click the icon in the WAF column of the target domain. Then, click Enable Domain-Level WAF Protection (Recommended) and click OK in the dialog box that appears.

4. Verify the protection:

   When the WAF Protection column for the target instance or the WAF column for the target route or domain displays Enabled, the integration is successful. To verify, enter your domain followed by a web attack payload in your browser (for example, your-domain.com/alert(xss), where alert(xss) is a cross-site scripting payload for testing). If the browser returns a 405 block page, it means WAF successfully intercepted the attack and protection is active.

Next steps

View and configure protection rules

After the integration, WAF automatically creates a protected object with a -mse suffix and by default, enables protection rules for modules like basic web protection. You can view the protected object on the Protection Config > Protected Objects page in the WAF console. If the default protection rules do not meet your business needs, you can create or edit the rules. For more information, see Overview of protection configuration.

Roll back the integration

• Temporarily disable WAF protection: If you encounter issues after integration, such as a high number of false positives, you can temporarily disable WAF protection. In the WAF console, go to the Protected Objects page and turn off the WAF Protection Status switch. For more information, see Disable WAF protection for a protected object.

• Remove access: If you no longer want to use WAF to protect your MSE gateway instance, go to the Microservices Engine (MSE) console, choose Cloud-native Gateway > Gateways, and locate the target instance.

  Instance-level protection

  In the WAF Protection column of the target instance, click the icon, click Disable Gateway Protection, and then click OK.

  Route-level protection

  1. Click the target instance ID. In the left-side navigation pane of the Basic Information page, choose Routes.

  2. On the Routes tab, click Policies in the Actions column of the target route. Then, on the WAF tab, click Disable Route-level WAF Protection (Not Recommended) and click OK in the dialog box that appears.

  Domain-level protection

  1. Click the target instance ID. In the left-side navigation pane of the Basic Information page, choose Routes.

  2. On the Domain tab, click the target domain, and then go to the Policy tab. Click Disable Domain-Level WAF Protection (Not Recommended) and click OK in the dialog box that appears.

  Important

  • After you remove access, your service traffic is no longer protected by WAF, and security reports will no longer include data for this traffic.

  • If your WAF instance is on a pay-as-you-go plan, you are not charged for request processing after you remove access. However, because the WAF instance and other protection rules still exist, feature fees still apply. If you no longer want to use WAF and want to stop all WAF-related billing, see Disable WAF.

Quotas and limits

• Number of protected instances: The number of instances you can add cannot exceed the quota for your WAF edition.

  • Subscription WAF instances: Basic (up to 300), Advanced (up to 600), Enterprise (up to 2,500), and Ultimate (up to 10,000).

  • Pay-as-you-go WAF instances: Up to 10,000.

• Unsupported features:

  • Web tamper-proofing

  • Data leakage prevention

  • In bot management, the automatic Web SDK integration and legitimate bot management features for scenario-based crawler protection are not supported.

  • Bot threat intelligence

Cloud service integration vs. CNAME access

WAF supports two integration methods: cloud service integration and CNAME access.

• Cloud service integration (the method described in this topic): Quickly integrates with Alibaba Cloud service instances within the same account.

• CNAME access: Integrates with domain names and is suitable for a wide range of scenarios, including cross-account and multi-cloud environments.

These two methods cannot be used simultaneously for the same domain. Each domain must use only one integration method. A duplicate configuration causes traffic forwarding conflicts and disables protection. For a detailed comparison, see Integration overview.