How to create an exclusive cluster-Web Application Firewall(WAF)-阿里云帮助中心

To better support customized application protection requirements, Web Application Firewall (WAF) offers an Exclusive Edition. This edition uses virtual exclusive clusters to provide customized access and protection capabilities tailored to your business needs.

Background

Your web applications may use unconventional designs to meet specific business needs. An exclusive cluster allows you to add these applications to WAF for comprehensive, application-layer protection.

After you purchase the WAF Exclusive Edition, you can customize the following settings for an exclusive cluster:

Region: You can select the region for the cluster.
Cluster port settings: You can protect a wider range of non-standard ports. You can also configure custom back-to-origin ports for HTTP, HTTPS, and HTTP 2.0 traffic.
Note
The following system ports are not supported: 22, 53, 9100, 4431, 4646, 8301, 6060, 8600, 56688, 15001, 4985, 4986, and 4987.
SNI: You can upload a default SNI certificate to allow client devices that do not support SNI to access your website.
Blocking response page: You can configure a static page URL hosted on Alibaba Cloud CDN to serve as the blocking response page, which improves the user experience when WAF denies requests.
TLS security policy: You can select the TLS version and cipher suite.
Persistent connection timeout: You can customize the timeout periods for establishing connections, sending requests, and receiving responses.

Create an exclusive cluster

After you purchase or upgrade to the WAF Exclusive Edition, you can choose to protect your website with either a virtual exclusive cluster or a shared cluster. Before you can use an exclusive cluster, you must first create one.

Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.
In the left navigation pane, choose Systems > Dedicated Settings.
On the Exclusive Cluster Configurations page, configure the cluster settings.
- Select a Region.
  Note
  After the exclusive cluster is created, the Region cannot be changed.
- Configure the Destination Server Port range: Select a protocol, enter a port range, and click Save. When you add a domain name to the exclusive cluster, you can quickly select a port from the configured range.
- Configure the Response Page: Enter the URL of a static page hosted on Alibaba Cloud CDN. This page serves as the blocking response page for all websites protected by the exclusive cluster.
- Enter the content for the default SNI Certificate File and Private Key.
- Configure HTTPS encryption settings.
  - TLS Version: By default, TLS 1.0 and Later (Best Compatibility and Low Security) is selected. You can select a higher TLS version, such as TLS 1.1 or TLS 1.2 and later, based on your security requirements.
  - Cipher Suite:
    - Select Custom Cipher Suite (Select It Based on Protocol Version. Proceed with Caution.). This allows you to customize the TLS version and select individual cipher suites for each domain.
    - If you select Strong Cipher Suites (Low Compatibility and High Security), only the following strong cipher suites are supported:
      - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
      - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
      - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    - If you select All Cipher Suites (High Compatibility and Low Security), both the strong cipher suites listed above and the following weak cipher suites are supported:
      - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
      - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
      - TLS_RSA_WITH_AES_128_GCM_SHA256
      - TLS_RSA_WITH_AES_256_GCM_SHA384
      - TLS_RSA_WITH_AES_128_CBC_SHA256
      - TLS_RSA_WITH_AES_256_CBC_SHA256
      - TLS_RSA_WITH_AES_128_CBC_SHA
      - TLS_RSA_WITH_AES_256_CBC_SHA
      - SSL_RSA_WITH_3DES_EDE_CBC_SHA
Click Create Now.
The system creates the exclusive cluster. This process takes about 20 minutes. After the cluster is created, you can view and modify its settings on the Exclusive Cluster Configurations page.

Next steps

After the exclusive cluster is created, you can add your applications with custom requirements to the cluster for protection. You have the following options:

You can add a new domain name and direct its traffic to the exclusive cluster. For more information, see Add a domain name.
Important
The IP address generated for the exclusive cluster is dynamic and used only to listen for requests to services within that cluster. To ensure service stability, strictly follow the steps in Add a domain name to update your DNS records.
For a domain name already in WAF, you can switch its protection to the exclusive cluster. On the Website Access page, change its Protection Resource to Exclusive Cluster.
You can also use this method to switch a domain name from an exclusive cluster back to a shared cluster.
Important
Exclusive clusters and shared clusters support different custom port ranges. Before you switch the cluster type, ensure that the new cluster is compatible with your domain name's custom port configuration.