Server Load Balancer：Activate and manage WAF-enabled ALB instances

Benefits of WAF-enabled ALB instances

• All-in-one protection

  ALB is deeply integrated with WAF 3.0, which provides all-in-one security services that can detect malicious requests. WAF-enabled ALB instances are resistant to intrusions, provide more stable performance, and support high security for services and data.

• High compatibility

  ALB is integrated with WAF 3.0 at the service level. WAF provides only security services and is decoupled from forwarding services. Listening and forwarding are performed by ALB so that request forwarding services and security services are decoupled from each other. This design improves compatibility and service performance.

• Various features

  Compared with standard ALB instances, WAF-enabled ALB instances are under enhanced protection. For more information about the differences between ALB editions, see Functions and features.

• Support for all network types and protocols

  WAF-enabled ALB instances support all network types and protocols. WAF-enabled ALB instances can be Internet-facing or internal-facing. WAF-enabled ALB instances support both IPv4 and dual stack.

• Sufficient quotas

  WAF-enabled ALB instances provide the same quotas as standard ALB instances, and provide higher quotas than basic ALB instances. For more information about resource quotas supported by different ALB editions, see ALB quotas.

• On-demand protection

  WAF-enabled ALB instances require only simple configurations. You can enable or disable WAF protection for your ALB instance with one click. You can purchase WAF-enabled ALB instances in the ALB console, or upgrade existing basic and standard ALB instances to WAF-enabled ALB instances.

Limits on WAF-enabled ALB instances

• Before you can purchase WAF-enabled ALB instances, you must complete real-name verification.

• The following table describes the regions in which WAF-enabled ALB instances are available for purchase.

  Area	Region
  China	China (Chengdu), China (Qingdao), China (Beijing), China (Guangzhou), China (Hangzhou), China (Ulanqab), China (Shanghai), China (Shenzhen), China (Zhangjiakou), and China (Hong Kong)
  Asia Pacific	Philippines (Manila), Indonesia (Jakarta), Japan (Tokyo), Malaysia (Kuala Lumpur), Singapore, and Thailand (Bangkok)
  Europe and Americas	Germany (Frankfurt), US (Silicon Valley), and US (Virginia)
  Middle East	SAU (Riyadh - Partner Region)

• You can upgrade only basic and standard ALB instances that are in the Running state to WAF-enabled ALB instances.

• Make sure that WAF is not activated in your Alibaba Cloud account, or WAF 3.0 is activated in your Alibaba Cloud account.

  • If WAF is not activated in your Alibaba Cloud account, a pay-as-you-go WAF 3.0 instance is created after you create a WAF-enabled ALB instance.

  • If a subscription WAF 3.0 instance exists in your Alibaba Cloud account, you are not charged additional fees for WAF after you purchase a WAF-enabled ALB instance.

  • If a WAF 2.0 instance already exists in your Alibaba Cloud account, release the WAF 2.0 instance or migrate data from the WAF 2.0 instance to a WAF 3.0 instance.

    • For more information about how to release a WAF 2.0 instance, see Terminate the WAF service.

    • For more information about how to migrate to WAF 3.0, see Migrate a WAF 2.0 instance to WAF 3.0.

Billing

After you create a WAF-enabled ALB instance or upgrade an existing ALB instance to the WAF-enabled edition, you are charged for using WAF 3.0. The following table describes the billable items of WAF-enabled ALB instances.

Enable WAF protection for an ALB instance

Purchase a WAF-enabled ALB instance

1. Log on to the ALB console.

2. In the top navigation bar, select the region in which the ALB instance is deployed.

3. On the Instances page, click Create ALB.

4. On the Application Load Balancer page, configure the parameters, click Buy Now, and then complete the payment.

   This example describes only some of the parameters. For more information, see Create an ALB instance.

   Edition: Select WAF Enabled.

Enable WAF protection for an existing ALB instance

You can enable WAF protection for an existing basic or standard ALB instance.

Enable WAF protection on the ALB console

1. Log on to the ALB console.

2. In the top navigation bar, select the region in which the ALB instance is deployed.

3. On the Instances page, find the ALB instance that you want to manage and use one of the following methods to enable WAF protection:

   • Method 1:

     1. Click the ID of the ALB instance and then click the Integrated Services tab. In the Web Application Firewall section, click Enable Protection.

     2. In the Enable Protection dialog box, click OK and complete the payment.

   • Method 2:

     1. Move the pointer over the icon next to the instance name and click Enable Protection in the WAF Protection section.

     2. In the Enable Protection dialog box, click OK and complete the payment.

   • Method 3:

     1. Click the ID of the ALB instance. On the Instance Details tab, find WAF Protection in the Basic Information section and click Enable Protection.

     2. In the Enable Protection dialog box, click OK and complete the payment.

   • Method 4:

     1. Choose > Change Specification in the Actions column.

     2. On the Application Load Balancer | Upgrade/Downgrade page, set Edition to WAF Enabled, select the Terms of Service, click Buy Now, and then complete the payment.

Enable WAF protection on the SLB Overview page

1. Log on to the SLB console.

2. In the Security Overview section, click Enable Protection.

3. In the Enable WAF Protection dialog box, set Instance Type to ALB, select the region in which the ALB instance is deployed from the Region drop-down list, find the ALB instance, and then click Enable Protection in the Actions column.

4. In the Enable Protection dialog box, click OK and complete the payment.

Manage WAF protection

Manage WAF protection in the ALB console

1. Log on to the ALB console.

2. In the top navigation bar, select the region in which the ALB instance is deployed.

3. Manage WAF protection.

   Operation	Procedure
   Check whether WAF protection is enabled for an ALB instance	Use one of the following methods to check whether WAF protection is enabled for an instance: Protection Enabled indicates that WAF protection is enabled for the ALB instance. Method 1: On the Instances page, click the ID of the ALB instance that you want to manage. Click the Integrated Services tab and view the status of WAF protection in the Web Application Firewall section. Method 2: On the Instances page, find the ALB instance that you want to manage and move the pointer over the icon to the right of the instance name. In the hoverbox that appears, view the protection status in the WAF Protection section. Method 3: On the Instances page, click the ID of the ALB instance that you want to manage. On the Instance Details tab, check whether WAF protection is enabled in the Basic Information section.
   View WAF security reports	To view WAF security reports, make sure that WAF protection is enabled for your ALB instance. Method 1: On the Instances page, click the ID of the ALB instance that you want to manage. Click the Integrated Services tab. In the Web Application Firewall section, click View WAF Security Report to go to the Security Reports page in the WAF 3.0 console. Method 2: On the Instances page, find the ALB instance that you want to manage and move the pointer over the icon. In the hoverbox that appears, click View WAF Security Report in the WAF Protection section to go to the Security Reports page in the WAF 3.0 console. Method 3: On the Instances page, click the ID of the ALB instance that you want to manage. On the Instance Details tab, click View WAF Security Report on the right side of Security Protection in the Basic Information section to go to the Security Reports page in the WAF 3.0 console. For more information, see Security reports.
   Disable WAF protection	After you disable WAF protection for an ALB instance, the ALB instance is no longer protected by WAF, and the WAF security reports no longer include the protection details about the ALB instance. Important After WAF protection is disabled for an ALB instance, WAF no longer charges request processing fees. However, existing protection rules still incur fees. We recommend that you delete protection rules before you remove an MSE instance from WAF. For more information, see the "Billable items" section in the Billing overview topic and the "Protection module overview" section in the Protection configuration overview topic. Method 1: On the Instances page, click the ID of the ALB instance that you want to manage. Click the Integrated Service tab. In the Web Application Firewall section, click Disable WAF. In the Disable Protection dialog box, click OK. Method 2: On the Instances page, find the ALB instance that you want to manage and move the pointer over the icon to the right of the instance ID. In the hoverbox that appears, click Disable WAF in the WAF Protection section. In the Disable Protection dialog box, click OK. Method 3: On the Instances page, click the ID of the ALB instance that you want to manage. On the Instance Details tab, click Disable WAF next to WAF Protection in the Basic Information section. In the Disable Protection dialog box, click OK. Method 4: On the Instances page, find the ALB instance that you want to manage, and choose > Change Specification in the Actions column. On the Application Load Balancer | Upgrade/Downgrade page, set Edition to Standard, click Buy Now, and then complete the payment.

Manage WAF protection in the WAF console.

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, click Website Configuration.

3. Manage WAF protection.

   • View ALB instances that are protected by WAF

     On the Cloud Native tab, click ALB in the left-side product list.

   • Add protected objects and protection rules

     Click the ID of the ALB instance to go to the Protected Objects page. On this page, you can view the protected objects and the protection rules of the ALB instance. For more information, see Overview.

     Note

     The value of Asset Type of a cloud service instance that is added to WAF in cloud native mode is the abbreviation of the cloud service name. For example, the value of Asset Type for an ALB instance is alb, and the value of Domain Name is empty.

   • Disable WAF protection for an ALB instance

     After you disable WAF protection for an ALB instance, the ALB instance is no longer protected by WAF, and WAF security reports no longer include the protection details about the ALB instance.

     Important

     After WAF protection is disabled for an ALB instance, WAF no longer charges request processing fees. However, existing protection rules still incur fees. We recommend that you delete protection rules before you remove an MSE instance from WAF. For more information, see the "Billable items" section in the Billing overview topic and the "Protection module overview" section in the Protection configuration overview topic.

     1. On the Cloud Native tab, find the instance that you want to manage, and click Remove in the Actions column.

     2. In the message that appears, view the information and click Remove.

     3. In the Remove panel, set Edition to Standard, click Buy Now, and then complete the payment.

FAQ

1. What are the differences between the transparent proxy mode of WAF 2.0 and the service integration mode of WAF 3.0?

   The following section describes the differences between the transparent proxy mode of WAF 2.0 and the service integration mode of WAF 3.0:

   • Transparent proxy mode of WAF 2.0: Requests are filtered by WAF before the requests are forwarded to ALB or CLB. In transparent proxy mode, requests pass through two gateways. You must configure the timeout period and the certificates for WAF and Server Load Balancer (SLB).

   • Service integration mode of WAF 3.0: WAF is deployed in bypass mode and requests are directly forwarded to ALB. Before the requests are forwarded to backend servers, ALB extracts and sends the request content to WAF for filtering. In service integration mode, requests pass through one gateway. This eliminates the need to synchronize certificates and settings between gateways, and prevents synchronization issues.

   For more information, see Compare WAF 3.0 and WAF 2.0.

2. How do I enable WAF for ALB?

   ALB is integrated with WAF 3.0. If you want your ALB instances to be protected by WAF, purchase a WAF-enabled ALB instance. When you purchase WAF-enabled ALB instances, take note of the following information:

   • If your Alibaba Cloud account does not have a WAF 2.0 instance or has not activated WAF, you can enable WAF 3.0 for Internet-facing and internal-facing ALB instances by purchasing WAF-enabled ALB instances. This way, ALB is integrated with WAF on the service level. For more information about the regions that support WAF-enabled ALB instances, see Limits on WAF-enabled ALB instances.

   • If your Alibaba Cloud account already has a WAF 2.0 instance: You can enable WAF 2.0 for basic Internet-facing ALB instance and standard Internet-facing ALB instances in transparent proxy mode. Internal-facing ALB instances do not support WAF 2.0.

     Only ALB instances in the following regions can be interfaced with WAF 2.0 in transparent proxy mode: China (Hangzhou), China (Shanghai), China (Shenzhen), China (Chengdu), China (Beijing), and China (Zhangjiakou).

     Note

     If you want to enable WAF 3.0 for your ALB instance, release the WAF 2.0 instance first or migrate to WAF 3.0.

     • After you release the WAF 2.0 instance, service errors may arise because the X-Forwarded-Proto header is disabled for ALB by default. You must enable the X-Forwarded-Proto header for the listeners of the ALB instance to prevent errors. For more information, see Manage listeners.

     • For more information about how to release a WAF 2.0 instance, see Terminate the WAF service.

     • For more information about how to migrate to WAF 3.0, see Migrate a WAF 2.0 instance to WAF 3.0.

3. Do CLB and ALB support the transparent proxy mode of WAF 2.0 and the service integration mode of WAF 3.0?

   Service	WAF 2.0 (transparent proxy mode)	WAF 3.0 (service integration mode)
   CLB	Supported. For more information about how to connect WAF 2.0 to CLB in transparent proxy mode, see the following topics: Tutorial Transparent proxy mode Configure a traffic redirection port for a Layer 7 SLB instance Configure a traffic redirection port for a Layer 4 SLB instance	Not supported.
   ALB	If your Alibaba Cloud account has a WAF 2.0 instance, you can connect the WAF 2.0 instance to ALB in transparent proxy mode. For more information, see the Configure a traffic redirection pot for an ALB instance section of the "Configure traffic redirection ports". If your Alibaba Cloud account does not have a WAF 2.0 instance or has not activated WAF, you can connect only WAF 3.0 to ALB. In this case, you must purchase a WAF-enabled ALB instance.	Supported. For more information about the supported regions and related operations, see Activate and manage WAF-enabled ALB instances.

4. After I enable WAF 2.0 for CLB or ALB in transparent proxy mode, why are the timeout period and certificates not synchronized?

   After you integrate WAF 2.0 with ALB or CLB, client requests are filtered by WAF before they are forwarded to ALB or CLB. The requests pass through two gateways, and you must synchronize the settings between WAF and ALB or CLB. If you change the timeout period or certificates, synchronization issues may occur due to latency.

   If certificates are not updated or the changes of the timeout period do not take effect, join the DingTalk group 21715946 for consultation.

References