Configure aggregate rate limiting to ensure service availability during major promotions - Web Application Firewall

You can configure aggregate rate limiting in Web Application Firewall (WAF) to allow only a fixed number of queries per second (QPS) or a specific percentage of traffic to reach your business servers. This helps protect your servers against anomalous traffic during major promotions. This topic describes how to configure aggregate rate limiting.

Scope

A subscription WAF instance that runs the Pro edition or higher, or a pay-as-you-go WAF instance is activated.
A protected object exists. Your web service is added to WAF. If your service is not added, see Overview.
Protected objects added in cloud native mode (ALB, MSE, FC) are not supported.

Template types

Aggregate rate limiting provides the following two types of protection templates.

Protection template	Description	Effective objects
Default protection template	WAF does not provide an initial default protection template. You must manually create one.	When you create the template, protected objects and object groups that are not associated with custom protection templates are selected as effective by default. Protected objects added later are also automatically added to the default protection template. You can manually adjust the selection.
Custom protection template	A custom protection template. You must manually create one.	You must configure Apply To. The template takes effect only on the protected objects and object groups associated with it.

Create a protection template

Aggregate rate limiting does not provide an initial default protection template. To enable aggregate rate limiting rules, you must create a protection template.

Step 1: Create an aggregate rate limiting template

Log on to the Web Application Firewall 3.0 console. In the top menu bar, select the resource group and region of your WAF instance (Chinese Mainland, Outside Chinese Mainland). In the left-side navigation pane, choose Protection Config > Core Web Protection. In the Peak Traffic Throttling section in the lower part of the page, click Create Template.

In the Peak Traffic Throttling panel, complete the following configurations and click OK.

Configuration item	Description
Template Name	Enter a name for the template. The name must be 1 to 255 characters in length, and can contain Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-).
Save as Default Template	Specify whether to set the template as the default template of the current protection module. Each protection module allows only one default template. A default template does not require Apply To. It applies by default to all protected objects and object groups that are not associated with custom protection templates, including protected objects and object groups that are added later or removed from custom protection templates. You can also manually remove them from the default template.
Rule Configuration	You can click Create Rule to create custom rules for the aggregate rate limiting template. You can also skip this setting and create rules for the template after the template is created. For more information about how to create custom rules, see Step 2: Create rules in the aggregate rate limiting template.
Apply To	From the added protected objects and object groups, select the Protected Objects and Protected Object Groups to which the template applies. A protected object or object group can be associated with only one template in the current protection module. For more information about how to add protected objects and object groups, see Configure protected objects and protected object groups. If you set a default protection template, all protected objects and object groups that are not associated with an aggregate rate limiting template are selected as effective by default. If you do not set a default template, no protected objects or object groups are selected as effective by default. You can manually change the effective objects.

Step 2: Create rules in the aggregate rate limiting template

An aggregate rate limiting template provides protection only after you add protection rules.

In the Peak Traffic Throttling section, find the template for which you want to create a rule and click Create Rule in the Actions column. In the Create Rule dialog box, complete the following configurations and click OK.

Configuration item	Description
Rule Name	Enter a name for the rule.
Match Condition	Set the request characteristics that the rule matches. Click Add Condition to add a condition. You can add up to five conditions to a rule. If you specify multiple conditions, a request hits the rule only when all conditions are met. Each condition consists of Match Field, Logical Operator, and Match Content. Configuration examples: Example 1: Match Field is URI, Logical Operator is contains, and Match Content is `/login.php`. A request hits the rule when the requested path contains `/login.php`. Example 2: Match Field is IP, Logical Operator is belongs to, and Match Content is `192.1X.XX.XX`. A request hits the rule when the client IP address that initiates the connection is `192.1.XX.XX`. For more information about match fields and logical operators, see Match conditions.
Access Source That Belongs to Following Regions	WAF can obtain the source IP of a request and determine the traffic origin based on the source IP. If you do not turn on this feature, the traffic origin of effective objects is not distinguished. If you turn on this feature, you can select regions in China and Outside China. Traffic from unselected regions does not pass through the rules configured in aggregate rate limiting.
Throttling Method	QPS Throttling: limits the traffic to your server by a fixed cap on queries per second (QPS). This method suits scenarios that require strict control over request counts to keep your server stable. Percentage Throttling: limits the traffic to your server by a pass-through percentage. This method suits scenarios that require dynamic control over requests during traffic spikes, and is more flexible than QPS-based rate limiting.
Throttling Threshold	Set the QPS limit. Maximum QPS: the maximum number of requests allowed per second. For example, a value of 1000 indicates that at most 1000 requests are processed per second. Note For the QPS limit, due to the complexity of the technical implementation and dynamic changes in the system environment, the actual QPS may fluctuate by about 10% around the configured value. This fluctuation is a normal behavior of the rate limiting algorithm and balances system performance with rate limiting precision. Monitor your actual traffic regularly and adjust the value as needed to achieve the best results. Set the percentage limit. Pass-through ratio: the percentage of requests allowed to pass. For example, a value of 50% indicates that only half of the requests are allowed and the other half are blocked.
Rate Limit Action	Select the action to take on requests that hit the rule. Valid values: Block: blocks the requests that hit the rule and returns a block response page to the client that initiates the requests. Note WAF uses a unified block response page by default. You can use the custom response feature to customize the block response page. For more information, see Configure custom response pages. Monitor: does not block the requests that hit the rule and only records the rule hits in logs. You can query the requests that hit the rule in WAF logs to analyze the protection effects of the rule, such as whether false positives exist. Important You can use the log query feature only after you activate the log service. For more information, see Enable or disable the Simple Log Service for WAF feature.
Effective Mode	Always effective: the rule always takes effect after it is enabled and never expires automatically. This mode suits scenarios that require long-term, stable traffic control. Effective by time period: the rule takes effect only within the specified time periods. This mode is commonly used for short-term events or traffic control in specific periods. You can select a time zone and multiple effective time periods. Effective by cycle: the rule takes effect repeatedly within the specified weekly time periods. This mode suits periodic events or traffic control during peak hours. You can select weekly cycles and a time zone.

You can create up to five rules.

Configuration examples

Example 1: Assume that you want to limit the maximum requests per second to 1000 over the long term, keep the rule always effective, limit only traffic from Ohio, United States, and select block as the protection action.

Rule name: Long-term QPS throttling
Effective mode: Always effective
Maximum QPS: 1000
Source region: Outside China - North America - United States - Ohio
Protection action: Block

Example 2: Assume that during a major promotion, you want to limit the maximum requests per second to 1000 for requests whose URI contains shopping, from 09:00 on a specific date to 18:00 on a specific date, limit only traffic from all regions in China, and select block as the throttling action.

Rule name: Promotion throttling
Effective mode: Effective by time period
Match field: URI contains shopping
Time period: from 09:00 on a specific date to 18:00 on a specific date
Maximum QPS: 1000
Source region: All regions in China
Throttling action: Block

Example 3: Assume that you want to limit the maximum requests per second to 1000 from 09:00 to 18:00 every weekend, limit only traffic from Hong Kong (China), and select monitor as the protection action.

Rule name: Weekend throttling
Effective mode: Effective by cycle
Cycle and time period: 09:00 to 18:00 every Saturday and Sunday
Maximum QPS: 1000
Time zone: the time zone of your business or the time zone of your server
Source region: Hong Kong (China)
Throttling action: Monitor

Routine maintenance

Edit a protection template

Business or project requirements may change over time. Adjusting protection templates keeps your rules aligned with your current requirements. Adjusting rules can also improve the efficiency and performance of your system or process, and reduce resource waste.

Turn on or turn off a protection template: After a protection template is created, you can use Status to turn the template on or off.
Modify a protection template: Click Edit in the Actions column of the target template. After you complete the changes, click OK at the bottom to save the changes.

Delete a protection template

You can delete protection templates that you no longer need. Before you delete a template, confirm that no protected objects are associated with it. Click the Delete button in the Actions column of the target template, and click OK in the prompt that appears.

After a template is deleted, the system automatically uses the default template to protect the objects that the deleted template previously protected.
If you delete the default template while it still contains protected objects, these protected objects are no longer protected by aggregate rate limiting.