Deploy WAAS Out-Of-Band for Hosts

Prerequisites

• You have installed a Host Defender in your workload environment.
• A TLS certificate in PEM format.

Create a WAAS Rule for Out-Of-Band Network Traffic

1. Open Console, and go to Defend > WAAS > {Container|Host} > Out-of-Band.
2. Select Add rule.

   1. Enter a Rule Name
   2. Enter Notes (Optional) for describing the rule.
3. Choose the rule Scope by specifying the resource collection(s) to which it applies.

   

   Collections define a combination of hosts to which WAAS should attach itself to protect the web application:

   

   

   Applying a rule to all hosts/images using a wild card (*) is invalid and a waste of resources. WAAS only needs to be applied to hosts that run applications that transmit and receive HTTP/HTTPS traffic.
4. (Optional) Enable API endpoint discovery

   When enabled, the Defender inspects the API traffic to and from the protected API. Defender reports a list of the endpoints and their resource path in Compute > Monitor > WAAS > API discovery.
5. (Optional) Enable Automatically detect ports for an endpoint to deploy WAAS protection on ports identified in the unprotected web apps report in Monitor > WAAS > Unprotected web apps for each of the workloads in the rule scope.

   As an additional measure, you can specify additional ports by specifying them in the protected HTTP endpoints within each app to also include the ports that may not have been detected automatically.

   By enabling both Automatically detect ports and API endpoint discovery, you can monitor your API endpoints and ports without having to add an application and without configuring any policies.
6. Save the rule.

Add an App (policy) to the Rule

1. Select a WAAS rule to add an App in.
2. Select Add app.
3. In the App Definition tab, enter an App ID.

   The combination of Rule name and App ID must be unique across In-Line and Out-Of-Band WAAS policies for Containers, Hosts, and App-Embedded.

   If you have a Swagger or OpenAPI file, click Import, and select the file to load.

   If you do not have a Swagger or OpenAPI file, manually define each endpoint by specifying the host, port, and path.

   1. In Endpoint Setup, click Add Endpoint.

      Specify endpoint in your web application that should be protected. Each defined application can have multiple protected endpoints.
   2. Enter HTTP host (optional, wildcards supported).

      HTTP hostnames are specified in the form of [hostname]:[external port].

      The external port is defined as the TCP port on the host, listening for inbound HTTP traffic. If the value of the external port is "80" for non-TLS endpoints or "443" for TLS endpoints it can be omitted. Examples: "*.example.site", "docs.example.site", "www.example.site:8080", etc.
   3. Enter App ports as the internal port your app listens on.

      (You can skip to enter App ports, if you selected Automatically detect ports while creating the rule).

      When Automatically detect ports is selected, any ports specified in a protected endpoint definition will be appended to the list of protected ports. Specify the TCP port listening for inbound HTTP traffic.

      If your application uses TLS or gRPC, you must specify a port number.
   4. Enter Base path (optional, wildcards supported):

      Base path for WAAS to match when applying protections.

      Examples: "/admin", "/" (root path only), "/*", /v2/api", etc.

      Protecting Linux-based hosts does not require specifying a WAAS port since WAAS listens on the same port as the protected application. Because Windows has its own internal traffic routing mechanisms, WAAS and the protected application cannot use the same App port. Consequently, when protecting Windows-based hosts the WAAS port should be set to the port end-users send requests to, and the App port should be set to a different port on which the protected application will listen and to which WAAS will forward traffic.
   5. If your application uses TLS, set TLS to On.

      You can select the TLS protocol (1.0, 1.1, 1.2, and 1.3 for WAAS In-Line, and 1.0, 1.1, and 1.2 for WAAS Out-Of-Band) to protect the API endpoint and enter the TLS certificate in PEM format.

      Limitations

      1. TLS connections using extended_master_secret(23) in the negotiation are not supported as part of this feature.
      2. DHKE is not supported due to a lack of information required to generate the encryption key.
      3. Out-of-Band does not support HTTP/2 protocol.
      4. TLS inspection for Out-of-Band WAAS is not supported on earlier versions of Console and Defender.

         • If your application uses HTTP/2, set HTTP/2 to On.

           WAAS must be able to decrypt and inspect HTTPS traffic to function properly.
         • If your application uses gRPC, set gRPC to On.
   6. Select Create response header.
   7. To facilitate inspection, after creating all endpoints, click View TLS settings in the endpoint setup menu.

      WAAS TLS settings:

      

      • Certificate - Copy and paste your server’s certificate and private key into the certificate input box (e.g., cat server-cert.pem server-key > certs.pem).
   8. If you application requires API protection, for each path define the allowed methods and the parameters.
4. Continue to App Firewall settings, select the protections to enable and assign them with actions.
5. Configure the DoS protection thresholds.
6. Continue to Access Control tab and select access controls to enable.
7. Select the bot protections you want to enable.
8. Select the required Custom rules.
9. Proceed to Advanced settings for more WAAS controls.
10. Select Save.
11. The Rule Overview page shows all the WAAS rules created.

    Select a rule to display the Rule Resources, and for each application a list of protected endpoints and the protections enabled for each endpoint are displayed.
12. Test protected endpoint using the following sanity tests.
13. Go to Monitor > Events, click on WAAS for containers/hosts/App-Embedded, and observe the events generated.

    For more information, see the WAAS analytics help page.

WAAS Actions for Out-Of-Band traffic

• Alert - An audit is generated for visibility.
• Disable - The WAAS action is disabled.

Troubleshooting