Quick Start for Edge WAF

Enable Edge WAF

(Optional) Step 1: Configure a default mitigation policy

Edge WAF includes a built-in default mitigation policy that protects your web services from common attacks, such as SQL injection, cross-site scripting (XSS), code execution, webshell uploads, and command injection. If this policy does not meet your needs, you can configure a custom default mitigation policy to apply different prevention modes to different protected objects. For more information, see Default mitigation policy.

Step 2: Add a domain name for protection

1. Log on to the DCDN console.

2. In the navigation pane on the left, choose WAF > Protected Domain Names.

3. On the Protected Domain Names page, click Add Domain Name.

4. In the Add Domain Name dialog box, select the domain names that you want to protect and configure a method to obtain client IP addresses.

   

   Parameter	Description
   Add Domain Name	Select the domain names that you want to protect. Note You can add up to 50 domain names at a time.
   Client IP	You can use the Client Connection IP or Custom Header method. By default, Client Connection IP is selected. If a gateway product such as DDoS or ER is deployed before WAF, the request IP addresses that WAF receives are the gateway server IP addresses. In this case, change the IP address source to another header, such as X-Forwarded-For (XFF), to prevent WAF from incorrectly blocking requests from the gateway servers.
   Custom Headers	This parameter is available only when Client IP is set to Custom Header. Example of a custom header: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apgn,*/*;q=0.8 Note Separate multiple headers with commas. You can enter up to five headers.

   Note

   WAF mitigation policies are executed immediately when requests reach DCDN points of presence (POPs). This means that WAF protection has a higher execution priority than other configurations, such as caching and authentication.

5. Click OK.

   After you add the protected domain name, a default mitigation policy is automatically configured, and billing starts based on the Billing of Edge WAF.

   Note

   If you did not configure another default policy in (Optional) Step 1: Configure a default mitigation policy, only the system-provided basic web protection default policy is configured after you add the domain name. You are then billed based on the number of processed requests.

(Optional) Step 3: Add or modify protection rules

To modify the status or action of a protection rule, such as changing the action from Block to Monitor, edit the mitigation policy in the mitigation policy overview section. For more information, see Configure an Edge WAF mitigation policy.