In Gcore WAAP, you can use two modes: monitor and protect.
Each mode defines how the system will manage incoming traffic to your domain: log information about every request without taking action or challenge and block all malicious requests.
L7 DDoS protection is always active even when WAAP is in monitor mode.
In monitor mode, WAAP analyzes incoming traffic and logs any security violations or suspicious activity without blocking or modifying requests. Basically, WAAP works exactly like in protection mode, but it doesn't enforce any actions on requests.
Monitor mode is useful for observing, fine-tuning, and assessing your WAAP’s configuration before you switch to the protect mode. While the system only monitors incoming requests, you can observe WAAP’s behavior, understand traffic patterns, and check for any false positives, optimizing your security settings accordingly.
This gives you confidence that WAAP will work correctly and efficiently in the protect mode.
We recommend using monitor mode before switching to protect to verify that WAAP is set correctly and doesn't block legitimate traffic. When you first add your domain to WAAP, it’s best to use the monitor mode for several days to make sure that all security settings work as expected.
In this mode, WAAP actively enforces all security settings, including WAAP policies and rules. It challenges or blocks incoming requests that violate these rules or pose a security risk.
Protect mode ensures real-time defense against web-based attacks like SQL injection, cross-site scripting (XSS), and other common vulnerabilities.
To demonstrate the difference between the monitor and protect modes, let’s consider an example of a cURL request with no header modification flags, which triggers the Invalid user agent policy.
If WAAP is in monitor mode, then the request will receive the “200 OK” status code:
curl -I https://c8k3p3x4.cdn.gcore.com
HTTP/2 200
date: Mon, 25 Mar 2019 20:40:37 GMT
If WAAP is in protect mode, the request will receive the “403 Forbidden” status code:
curl -I https://c8k3p3x4.cdn.gcore.com
HTTP/2 403
date: Mon, 25 Mar 2019 20:38:48 GMT
You can also see the difference on the Analytics page in the Requests table:
In monitor mode, the cURL request will be marked as Suppressed. All requests with this result would have been blocked in protect mode.
In protect mode, the cURL request will be marked as Blocked.
You can switch between monitor and protect modes depending on your security requirements and the level of risk tolerance for your web applications.
If your domain is in monitor mode, all traffic is allowed to your domain, regardless of configured security rules and policy groups. This mode is only recommended for testing WAAP settings.
Here’s an example of how to enable protect mode for your domain:
1. In the Gcore Customer Portal, navigate to WAAP > Domains.
2. Find the domain for which you want to enable a WAAP mode and click the domain name to open it. You'll be directed to the Policies page.
3. In the upper-right corner of the screen, next to the WAAP mode, select Protect from the dropdown.
Was this article helpful?