Web Application Firewall (WAF) 3.0 supports the subscription and pay-as-you-go billing methods. The features and billing methods that are supported by WAF instances vary based on the edition. You can select an edition based on your business requirements and deployment method. If you use a subscription WAF instance, you can upgrade the edition of the WAF instance. WAF 3.0 supports the following editions: Basic, Pro, Enterprise, and Ultimate. The editions are listed in ascending order based on the protection capabilities.
Overview
For more information about the billing rules and purchase methods of subscription and pay-as-you-go WAF 3.0 instances, see the following topics:
Subscription: Billing overview and Purchase a subscription WAF 3.0 instance.
Pay-as-you-go: Billing overview, Purchase a pay-as-you-go WAF 3.0 instance, and View bills.
In WAF 3.0, traffic is measured only in queries per second (QPS). You do not need to pay attention to bandwidth limits in different editions. When you use WAF 3.0 to protect your web services, the service traffic is not affected by bandwidth limits.
Features
Feature | Description | Subscription Basic | Subscription Pro | Subscription Enterprise | Subscription Ultimate | Pay-as-you-go |
Business scale | ||||||
Website scale | The size of the website based on which you can select a WAF 3.0 edition. | Small-sized and personal websites that do not have special security requirements. | Small- and medium-sized websites that do not have special security requirements. | Medium-sized enterprise-grade websites that can be accessed by the public and have high data security requirements. | Medium- and large-sized enterprise-grade websites that have special security requirements. Note If you want to configure custom specifications for your WAF instance, contact your account manager or solution architect. | Websites whose workloads frequently fluctuate. |
QPS | The number of HTTP or HTTPS requests per second.
|
|
|
|
| Maximum QPS:
|
Domain name quota | The number of domain names that you can add to WAF. The domain names include second-level domain names, subdomains, and wildcard domain names. For more information about how to increase the domain name quota, see Upgrade a WAF instance. |
|
|
|
| Up to 1,000 domain names can be added to a pay-as-you-go WAF 3.0 instance. |
The number of hybrid cloud protection nodes that you can deploy. For more information about how to purchase additional quota for hybrid cloud protection nodes, see Upgrade a WAF instance. | Not supported. | Not supported. |
|
| Not supported. | |
The number of protected objects that you can add to WAF, such as cloud service instances and domain names. | You can add up to 300 protected objects. | You can add up to 600 protected objects. | You can add up to 2,500 protected objects. | You can add up to 10,000 protected objects. | You can add up to 10,000 protected objects. | |
The feature that allows you to add cloud resources within other Alibaba Cloud accounts to WAF. | Not supported. | Not supported. | Up to 5 members are supported. | Up to 20 members are supported. | Not supported. | |
Security features Important Rule groups are no longer supported in the new version of the basic protection rule module. For more information, see Announcement of upgrading the basic protection rule module in WAF 3.0. | ||||||
The feature that allows you to manage assets. | Not supported. | Supported. | Supported. | Supported. | Supported. | |
Default rule groups of the basic protection rule module. | Supported. | Supported. | Supported. | Supported. | Supported. | |
Custom rule groups of the basic protection rule module. | Not supported. | Not supported. | You can configure up to 10 custom rule groups. | You can configure up to 30 custom rule groups. | You can configure up to 30 custom rule groups. | |
Custom protection templates of the basic protection rule module. | You can configure up to 3 custom templates. | You can configure up to 10 custom templates. | You can configure up to 20 custom templates. | You can configure up to 50 custom templates. | You can configure up to 20 custom templates. | |
The module that you can configure to allow requests with specific characteristics. |
|
|
|
|
| |
The module that you can configure to block requests from specific IP addresses. | Not supported. |
|
|
|
| |
The that you can configure to monitor, block, or verify requests. The requests match custom rules. | Not supported. |
|
|
|
| |
The module that you can configure to protect services against common HTTP flood attacks in Prevention mode or Prevention-emergency mode. | Not supported. | You can configure up to 5 templates. | You can configure up to 10 templates. | You can configure up to 20 templates. | You can configure up to 20 templates. | |
The module that supports high-frequency scanning blocking, directory traversal blocking, and scanner blocking. | Not supported. | You can configure up to 5 templates. | You can configure up to 10 templates. | You can configure up to 20 templates. | You can configure up to 20 templates. | |
The module that allows you to configure source regions, effective modes, and custom rules. | Not supported. | Supported with fees charged. You can configure up to 5 templates. | Supported with fees charged. You can configure up to 5 templates. | Supported with fees charged. You can configure up to 5 templates. | Not supported. | |
The module that you can configure to lock web pages to prevent content tampering. | Not supported. |
|
|
|
| |
The module that you can configure to block requests from specific regions. | Not supported. | Not supported. | You can configure up to 10 templates. | You can configure up to 20 templates. | You can configure up to 20 templates. | |
The module that you can configure to prevent leaks of sensitive data, such as ID card numbers, mobile phone numbers, and bank card numbers. | Not supported. |
|
|
|
| |
The module that allows you to configure custom block pages that you want to return to clients when the requests of the clients are blocked. You can specify a custom status code, response header, and response body. | Not supported. | Not supported. | You can configure up to 20 templates. | You can configure up to 50 templates. | You can configure up to 50 templates. | |
The module that allows you to configure anti-crawler rules for websites and applications. | Not supported. | Supported with fees charged. | Supported with fees charged. | Supported with fees charged. | Supported. | |
The feature that supports threat intelligence for major event protection, rule groups for major event protection, IP address blacklist for major event protection, and Shiro deserialization vulnerability prevention. | Not supported. | Supported with fees charged. You can use temporary upgrade to enable the feature. | Supported with fees charged. You can use temporary upgrade to enable the feature. | Supported. | Supported with fees charged. You can use temporary upgrade to enable the feature. | |
The module that protects the available API assets of services added to WAF and detects API vulnerabilities. | Not supported. | Supported with fees charged. | Supported with fees charged. | Supported with fees charged. | Supported. | |
The DDoS attack mitigation capabilities provided by Anti-DDoS Origin Basic free of charge. For more information, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic. | Supported. | Supported. | Supported. | Supported | Supported | |
Note A custom rule can block up to 20,000 IP addresses. If you enter more than 20,000 IP addresses, the custom rule may not take effect. | ||||||
Access modes Note For more information about the protection features that are supported by different access modes, see Access modes and protection features. | ||||||
Cloud native mode | Supported. | Supported. | Supported. | Supported. | Supported. | |
Supported. Up to 300 protected objects can be added to WAF. The number of traffic redirection ports that can be specified is the same as the number of protected objects that can be added to WAF. | Supported. Up to 600 protected objects can be added to WAF. The number of traffic redirection ports that can be specified is the same as the number of protected objects that can be added to WAF. | Supported. Up to 2,500 protected objects can be added to WAF. The number of traffic redirection ports that can be specified is the same as the number of protected objects that can be added to WAF. | Supported. Up to 10,000 protected objects can be added to WAF. The number of traffic redirection ports that can be specified is the same as the number of protected objects that can be added to WAF. | Supported. Up to 10,000 protected objects can be added to WAF. The number of traffic redirection ports that can be specified is the same as the number of protected objects that can be added to WAF. | ||
The CNAME record mode. You can add websites to WAF. | Supported. | Supported. | Supported. | Supported. | Supported. | |
The hybrid cloud mode. You can add web services that are deployed across third-party clouds or data centers to WAF to manage web services in a centralized manner. | Not supported. | Not supported. | Supported. | Supported. | Not supported. | |
Other features | ||||||
The feature that allows you to use CloudMonitor and Simple Log Service to configure monitoring and alerting for WAF events and metrics. | Supported. | Supported. | Supported. | Supported. | Supported. | |
The non-standard ports that are supported by WAF in CNAME record mode. The standard ports include ports 80, 8080, 443, and 8443. | Not supported. | Not supported. | Supported. | Supported. | Supported. | |
The feature that monitors and protects IPv6 traffic. | Not supported. | Not supported. |
|
|
| |
The feature that allows you to use exclusive IP addresses to protect domain names. For more information about how to purchase additional exclusive IP addresses, see Upgrade a WAF instance. | Not supported. | Supported with fees charged. | Supported with fees charged. | Supported with fees charged. | Supported. | |
The feature that allows you to deploy the origin server on multiple nodes and implement automatic disaster recovery and optimal routing. | Not supported. | Supported with fees charged. | Supported with fees charged. | Supported with fees charged. | Supported. | |
The feature that collects and stores all logs in Logstores, allows near-real-time query and analysis, and provides online reports. | Not supported. | Supported with fees charged. | Supported with fees charged. | Supported with fees charged. | Supported. | |
The feature that allows you to create custom rules of the basic protection rule module for hybrid cloud protected objects. | Not supported. | Not supported. | Supported. | Supported. | Not supported. | |
Access modes and protection features
Feature | CNAME record mode | Cloud native mode (NLB, CLB and ECS) | Cloud native mode (ALB, MSE, and Function Compute) | Hybrid cloud - reverse proxy mode | Hybrid cloud - SDK integration mode |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported |
| Not supported | Not supported | |
Supported | Supported | Not supported | Supported | Not supported | |
Supported | Supported | Supported | Supported | Supported | |
Supported | Supported | Not supported | Supported | Not supported | |
Supported | Supported | Not supported | Not supported | Not supported | |
Supported | Supported |
| Supported | Supported | |
Supported | Supported | Not supported | Not supported | Not supported |