Web Application Firewall:Create an exclusive cluster

Create an exclusive cluster

After you purchase a WAF instance that runs Exclusive Edition or upgrade your WAF instance to Exclusive Edition, you can use an exclusive cluster or a shared cluster to protect your website. Before you can use the features of an exclusive cluster, you must create an exclusive cluster based on your business requirements.

1. Log on to the WAF console. In the top navigation bar, select the resource group and the region in which the WAF instance is deployed. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose System Management > Exclusive Settings.

3. On the Exclusive Settings page, configure the following parameters:

   • Select a region for Region.

     Note

     After you create an exclusive cluster, you cannot change the value of Region.

   • Configure Destination Server Port. Select a protocol and click Customize. Enter the ports that you want to protect and click Save. If you add a domain name to the exclusive cluster, you can select a server port that is specified for this cluster.

   • Configure URL of Blocking Response Page. Enter the static URL that is uploaded to Alibaba Cloud CDN. If a request is blocked, the page that is specified by the URL is displayed.

   • Enter the content of Certificate file and Private key file to allow clients that do not support the SNI protocol to access your website.

   • Configure HTTPS settings.

     • TLS Version: The default value is Support TLS 1.0 and Later (High Compatibility and Low Security). You can select Support TLS 1.1 and Later (Moderate Compatibility and Moderate Security) or Support TLS 1.2 and Later (Moderate Compatibility and High Security) based on your business requirements.

     • Cipher Suite:

       • If you select Select cipher suites based on the protocol version. Proceed with caution, you can customize the TLS versions and cipher suites by domain name. For example, you can separately customize the TLS version. You can also customize a combination of strong encryption algorithms, weak encryption algorithms, or both.

       • If you select Strong Cipher Suites (Low Compatibility and High Security), the following strong cipher suites are supported:

         • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

         • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

         • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

         • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

         • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

         • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

         • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

         • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

         • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

         • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

       • If you select All Cipher Suites (High Compatibility and Low Security), all the preceding strong cipher suites and the following weak cipher suites are supported:

         • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

         • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

         • TLS_RSA_WITH_AES_128_GCM_SHA256

         • TLS_RSA_WITH_AES_256_GCM_SHA384

         • TLS_RSA_WITH_AES_128_CBC_SHA256

         • TLS_RSA_WITH_AES_256_CBC_SHA256

         • TLS_RSA_WITH_AES_128_CBC_SHA

         • TLS_RSA_WITH_AES_256_CBC_SHA

         • SSL_RSA_WITH_3DES_EDE_CBC_SHA

   • Specify the persistent connection timeout.

     • Connection Timeout: Set the connection timeout period to a value between 5 and 3,600 seconds.

     • Read Timeout: Set the read timeout period to a value between 120 and 3,600 seconds.

     • Write Timeout: Set the write timeout period to a value between 120 and 3,600 seconds.

4. Click Create.

   After you perform operations, WAF creates an exclusive cluster. The exclusive cluster is created in about 20 minutes. You can view and modify the settings of the exclusive cluster that you created on the Exclusive Settings page.