> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/web-application-and-api-security-waas/deploy-waas/deployment-vpc-mirroring.md).
# Deploy WAAS Agentless
WAAS agentless rules inspect HTTP requests and responses through a mirror of the traffic to provide WAAS detections. To optimize the CPU utlization while using WAAS, Prisma Cloud scanner samples only a subset of the mirrored data to discover just the APIs and the scanner does not inspect the request body field, the sensitive request, and the response data.
WAAS can observe a mirror of HTTP traffic flowing to and from CSP (AWS) instances, even if they are not protected by a Prisma Cloud Compute Defender.
VPC Observer is an EC2 instance running a Host defender for VPC Traffic Mirroring. The target instance is configured on a separate instance within the same VPC to receive Out-Of-Band traffic from the unprotected applications on the source instance. These Observers on the target instance inspect Out-Of-Band traffic and send audits of any events they identify to Prisma Cloud console.
To set up WAAS agentless with VPC traffic mirroring, specify the EC2 instances to mirror (exact names or using wildcards or tags) in a VPC, the ports to mirror, and other AWS parameters in a VPC traffic mirroring rule. For each VPC traffic mirroring rule, a VPC Observer will be created in a VPC machine to receive the mirrored traffic (the VPC Observer is an EC2 instance running a host Defender).
Monitoring applications with WAAS agentless through VPC traffic mirroring is subject to limitations, quotas, and checksum offloading as defined in the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-limits.html).
## Prerequisites
* To configure WAAS agentless with AWS VPC traffic mirroring, apply the permission template ending in [agentless\_app\_firewall\_permissions\_template.yaml](https://redlock-public.s3.amazonaws.com/waas/aws/agentless_app_firewall_permissions_template.yaml) to AWS CloudFormation console for your account. For detailed instructions on how to apply cloud formation templates, refer to the [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html).
Amazon EC2 Auto Scaling is integrated with this AWS CloudFormation permission template.
Edit the template and replace the "USER-agentless-app-firewall" value with the actual username that you want to grant these permissions.
WAAS agentless permissions policies created in AWS:
WAAS agentless resources stack deployed in AWS:
Optionally, if you onboard your AWS accounts using Prisma Cloud, you can add the necessary WAAS agentless permissions to the same role used by Prisma Cloud. During the setup, provide the Prisma Cloud role as a parameter in the [agentless\_attach\_to\_role\_cft.template](https://redlock-public.s3.amazonaws.com/waas/aws/agentless_attach_to_role_cft.template).
* Create an AWS Cloud account under **Compute > Manage > Cloud accounts** using the `Access key` from your AWS account.
Cloud accounts require **Cloud discovery** to be enabled to discover the EC2 instances to mirror.
## Create a WAAS Agentless Rule for VPC Traffic Mirroring
To deploy WAAS agentless with VPC traffic mirroring, create a new rule, configure VPC, define application endpoints, and select protections.
1. Create a WAAS rule under **Defend > WAAS > Agentless > Add rule**.
2. Enter a **Rule Name** and **Notes** (Optional) for describing the rule.
3. Add **VPC Configuration** to allow the mirrored traffic to flow from the source instance to the Prisma Cloud Observer deployed on the target instance.
1. Select **Console address** as the hostname of the Console to connect to.
2. Select the credentials for the AWS **Cloud account** that you configured under **Manage > Cloud accounts**.
3. Choose the AWS **Region** where the mirrored VMs are located in.
4. Enter the **VPC ID** to look for instances to mirror and to deploy the Observer in.
5. Enter the **VPC Subnet ID** to look for instances to be mirrored only in the selected Subnet ID, and to deploy the Observer in.
6. Specify the **Tags** or wildcards identifying the EC2 instances to mirror in any of the following format:
1. `` = Match tags by key and value pair.
2. `` = Match tags with key and empty value (for example, AWS tags allow just a key, with no value (empty string)).
3. `*` = Match all tags.
7. Enter **Instance names** or wildcards to identify the EC2 instances to mirror.
The instance to mirror is mapped by machine tags:instance names.
8. Enter the **Ports** to mirror.
You can enter a maximum of 5 ports. Port ranges are not supported.
9. Select the **Observer Instance type** to use for the VPC Observer instance.
10. Enable **Auto scaling** to automatically scale WAAS Observers to handle a large amount of traffic volume or sudden decrease in traffic volume. You can set a limit of maximum instances between 1 and 10.
11. Select **Add**.
The Deployment will be done using a dynamically constructed AWS CloudFormation template, programmatically with CloudFormation API. The WAAS rule is not immediately applied, there will be stages of the rules as the VPC configuration is being deployed in AWS. You can track the status of the deployment in the AWS CloudFormation stack, and also on Prisma Cloud Console.
4. (Optional) Toggle to enable **API endpoint discovery**.
When enabled, the Observer inspects the mirrored traffic to and from the remote applications. The Observer reports a list of the endpoints and their resource path in **Compute > Monitor > WAAS > API discovery**.
5. **Save** the rule.
A scheduled scan runs every hour to check for new and deleted EC2 instances based on the VPC configurations instance names and tags. If a change is found in the list of EC2 instances to mirror, the AWS VPC traffic mirroring setup will be updated.
To force a scan, you can click **Update**.
## Add an App (policy) to the Rule
1. Select a WAAS rule to add an App in.
2. Select **Add app**.
3. In the **App Definition** tab, enter an **App ID**.
The combination of **Rule name** and **App ID** must be unique across In-Line and Out-Of-Band WAAS policies for Containers, Hosts, and App-Embedded.
If you have a Swagger or OpenAPI file, click **Import**, and select the file to load.
If you do not have a Swagger or OpenAPI file, manually define each endpoint by specifying the host, port, and path.
1. In **Endpoint Setup**, select **Add endpoint**.
2. Specify an endpoint in your web application that should be protected. Each defined application can have multiple protected endpoints.
3. Enter **HTTP host** (optional, wildcards supported).
HTTP hostnames are specified in the form of \[hostname]:\[external port].
The external port is defined as the TCP port on the host, listening for inbound HTTP traffic. If the value of the external port is "80" for non-TLS endpoints or "443" for TLS endpoints, it can be omitted. Examples: "\*.example.site", "docs.example.site", "[www.example.site:8080](http://www.example.site:8080)", etc.
4. Enter **Base path** (optional, wildcards supported) for WAAS to match.
Examples: "/admin", "/" (root path only), "/\*", /v2/api", etc.
5. Enable **TLS** if your application uses the TLS protocol.
6. Select **Create**.
7. To facilitate inspection, after creating all endpoints, select **View TLS settings** in the endpoint setup menu.
WAAS TLS settings:
* **Certificate** - Copy and paste your server’s certificate and private key into the certificate input box (e.g., `cat server-cert.pem server-key > certs.pem`).
8. If your application requires [API protection](/admin-guide/web-application-and-api-security-waas/waas-api-protection.md), select the "API Protection" tab and define for each path the allowed methods, parameters, types, etc. See detailed definition instructions in the [API protection](/admin-guide/web-application-and-api-security-waas/waas-api-protection.md) help page.
4. Continue to **App Firewall** tab, and select the protections as shown in the screenshot below:
For more information, see [App Firewall settings](/admin-guide/web-application-and-api-security-waas/waas-app-firewall.md).
5. Continue to **DoS protection** tab and select [DoS protection](/admin-guide/web-application-and-api-security-waas/waas-dos-protection.md) to enable.
6. Continue to **Access Control** tab and select [access controls](/admin-guide/web-application-and-api-security-waas/waas-access-control.md) to enable.
7. Continue to **Bot protection** tab, and select the protections as shown in the screenshot below:
For more information, see [Bot protections](/admin-guide/web-application-and-api-security-waas/waas-bot-protection.md).
8. Continue to **Custom rules** tab and select [Custom rules](/admin-guide/web-application-and-api-security-waas/waas-custom-rules.md) to enable.
9. Continue to **Advanced settings** tab, and set the options shown in the screenshot below:
For more information, see [Advanced settings](/admin-guide/web-application-and-api-security-waas/waas-advanced-settings.md).
10. Select **Save**.
11. You should be redirected to the **Rule Overview** page.
Select the created new rule to display **Rule Resources** and for each application a list of **protected endpoints** and **enabled protections**.
12. Test protected endpoint using the following [sanity tests](/admin-guide/web-application-and-api-security-waas/waas-app-firewall.md#sanity-tests).
13. Go to **Monitor > Events > WAAS for Agentless** to observe the events generated.
For more information, see the [WAAS analytics help page](/admin-guide/web-application-and-api-security-waas/waas-analytics.md)
## VPC Configuration Status
Once the VPC configuration is saved, a CloudFormation template will be created and deployed in the selected region. You can track the stack deployment stages through Prisma Console.
* **Deploying**: The WAAS rule is getting ready as the Observer is being deployed in the AWS instance and the session is being established between the Observer and the resources.
**Refresh** to view the updated deployment status.
* **Ready**: The WAAS rule is ready to be protecting the selected resources. The Observer will check for new instances (based on the selected tags or instance names) once every hour.
* **Error**: The rule is in error and the deployment failed. Fix the error, and click **Update** to reapply the configuration.
* **Deletion in progress**: The Observer deployment is being torn down, and the session is being terminated.
* **Deletion error**: Error in tearing down the Observer setup on AWS VPC.
Use **Refresh** to see the updated status of the rules on the UI.
When the VPC configuration is in **Error** status, an **Update** is allowed to reapply the configuration.
You can **Delete** an Agentless rule, that will tear down the entire VPC stack configuration and resources. Once the rule deletion is complete, the rule will disappear from the Console and the Observer will be uninstalled.
The VPC Observer is installed under **Manage > Defenders > Defenders: Deployed**. A VPC observer can only be deleted if you delete the rule from the Console.
## Update VPC Configurations
You can edit the VPC configurations only to update the Tags, Instance names, Ports, and Observer instance type. This will update the AWS CloudFormation template, and AWS will create/destroy only the updated AWS resources.
If you update the instance type of the VPC Observer, then AWS will recreate the EC2 instance and there will be a downtime.
Edit the fields and **Save** to reapply the configurations.
## WAAS Actions for Out-Of-Band Traffic
The following actions are applicable for the HTTP requests or responses related to the **Out-Of-Band traffic**:
* **Alert** - An audit is generated for visibility.
* **Disable** - The WAAS action is disabled.
## Limitations
**Limitations for setting traffic mirroring imposed by AWS**
* Not all AWS instance types support traffic mirroring, for example, T2 is not supported (relevant for both source and target EC2 instances).
* Some regions don’t currently support the 'm5n.2xlarge' and 'm5n.4xlarge' instance types, so these types cannot be used for VPC Observer (For example, Paris).
**TLS Limitations**
* TLS settings for agentless support TLS 1.0, 1.1, and 1.2.
* Only the following RSA Key Exchange cipher suites are supported:
* TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256
* TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA
* TLS\_RSA\_WITH\_RC4\_128\_SHA
* TLS connections using extended\_master\_secret(23) in the negotiation are not supported as part of this feature.
* Out-Of-Band does not support HTTP/2 protocol.
* DHKE is not supported due to a lack of information required to generate the encryption key.
* The full handshake process must be captured. Partial transmission or session resumption process inspection won’t be decrypted.
* Same VPC configuration cannot be used to inspect both HTTP and HTTPS traffic, you must create two different Agentless rules, one for each HTTP and HTTPS traffic monitoring.
You must upgrade the VPC Observer through **Manage > Defenders**.
**WAAS Agentless Limitations**
* An EC2 instance can only be attached to one agentless rule.
* An agentless rule can only inspect machines from one VPC and Subnet combination.
* Each agentless rule can only have a maximum of 5 ports in the VPC configuration.
* Changing the VPC observer instance types involves downtime.
* Once the AWS setup is created/updated in the agentless rule, the Observer status is only available on **Manage > Defenders > Defenders: Deployed** page.
## Troubleshoot VPC Traffic Mirroring Errors
`Failed to set up VPC traffic mirroring: failed creating AWS stack, status ROLLBACK_COMPLETE`.
When the configuration status shows the following error, as shown in the screenshot below, check the AWS CloudFormation stack events for the error.
Some scenarios in the AWS CloudFormation that may lead to the above error are as follows:
### You are not authorized to perform this operation
This is because the selected AWS cloud account doesn’t have enough permissions for deployment.
1. Modify the account with the correct permissions as mentioned in the [agentless\_app\_firewall\_permissions\_template.json](https://redlock-public.s3.amazonaws.com/waas/aws/agentless_app_firewall_permissions_template.json) file, and select **Update** to retry the deployment.
2. Delete the rule in error and create a new rule in the AWS Cloud account with the permissions as mentioned in the [agentless\_app\_firewall\_permissions\_template.json](https://redlock-public.s3.amazonaws.com/waas/aws/agentless_app_firewall_permissions_template.json) file to AWS CloudFormation console for your account.
### SessionNumber 1 already in use for eni-\*
Trying to mirror an already mirrored EC2 instance (either by WAAS or another product).
1. Edit the VPC configuration and remove the instance from the tags or instance names list, and click **Update** to retry the deployment.
2. Remove the mirroring from the machine from the other rule/other product, and click **Update** to retry the deployment.
### WaitCondition received failed message: 'Defender deployment failed' for uniqueid: i-xxxx.
AWS CloudFormation stack failed to deploy the WAAS agentless resources because Prisma Console is not accessible from AWS.
1. Make sure that the IP address of Prisma Console in the VPC configuration is public.
2. Check if the Defender instance has a public IP address.
3. Check if [AWS account can connect with the Prisma Cloud Console](/admin-guide/agentless-scanning/onboard-accounts/onboard-aws.md) with Console URL that you selected in the VPC configuration.
1. If the Console is not reachable, delete the rule and create a new rule with a valid Prisma Cloud Console URL.
2. If the Console is not reachable due to a firewall rule or other blocking rules, fix the rule to allow the connectivity to the Console, and click **Update** to retry the deployment.
3. Ensure that the Console’s IP address and the ports are reachable by the Defender. Also, the firewall is open with the relevant port and source IPs.
### Failed to find VMs to mirror
The security token included in the request is invalid.
1. **Edit Configuration** to ensure that the AWS cloud account exists for the user, and also ensure that a correct secret key is used, **Save** the configuration.
2. Click **Update** to reapply the configuration.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/admin-guide/web-application-and-api-security-waas/deploy-waas/deployment-vpc-mirroring.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.