WAAP modes

Gcore WAAP has four modes: monitor, protect, inactive, and stopped. Each mode defines how the system will manage incoming traffic to your domain.

Monitor mode

In monitor mode, WAAP analyzes incoming traffic and logs any security violations or suspicious activity without blocking or modifying requests. Basically, WAAP works exactly like in protection mode, but it doesn't enforce any actions on requests.

Monitor mode is useful for observing, fine-tuning, and assessing your WAAP’s configuration before you switch to the protect mode. While the system only monitors incoming requests, you can observe WAAP’s behavior, understand traffic patterns, and check for any false positives, optimizing your security settings accordingly.

This gives you confidence that WAAP will work correctly and efficiently in the protect mode.

Protect mode

In this mode, WAAP actively enforces all security settings, including WAAP policies and rules. It challenges or blocks incoming requests that violate these rules or pose a security risk.

Protect mode ensures real-time defense against web-based attacks like SQL injection, cross-site scripting (XSS), and other common vulnerabilities.

Inactive mode

In inactive mode, WAAP protection for the domain is disabled, and traffic is not inspected as in monitor mode. All web requests bypass CDN and WAAP, going directly to the origin. However, you can still update the domain configuration and security settings.

If you want to delete a domain, it has to be inactive. To change WAAP mode to inactive, disable WAAP protection for a relevant CDN resource. You can always enable WAAP again in the resource settings.

Stopped mode

In this mode, traffic is not inspected and WAAP protection for the domain is disabled. Domains in stopped mode aren’t billable.

WAAP mode can change to Stopped for the following reasons:

• The trial period has ended.

• Payment for the product was unsuccessful. In this case, you cannot activate any other WAAP mode until payment is completed.

When the product is in the stopped mode, you can’t create, modify, or edit any WAAP settings.

How requests are processed in monitor and protect modes

To demonstrate the difference between the monitor and protect modes, let’s consider an example of a cURL request with no header modification flags, which triggers the Invalid user agent policy.

If WAAP is in monitor mode, then the request will receive the “200 OK” status code:

      Copy
      
    
curl -I https://c8k3p3x4.cdn.gcore.com 

 HTTP/2 200 

 date: Mon, 25 Mar 2019 20:40:37 GMT 

If WAAP is in protect mode, the request will receive the “403 Forbidden” status code:

      Copy
      
    curl -I https://c8k3p3x4.cdn.gcore.com 

 HTTP/2 403  

 date: Mon, 25 Mar 2019 20:38:48 GMT 

You can also see the difference on the Analytics page in the Requests table:

• In monitor mode, the cURL request will be marked as Suppressed. All requests with this result would have been blocked in protect mode.

• In protect mode, the cURL request will be marked as Blocked.

Enable monitor and protect modes for your domain

You can switch between monitor and protect modes depending on your security requirements and the level of risk tolerance for your web applications.

Here’s an example of how to enable protect mode for your domain:

1. In the Gcore Customer Portal, navigate to WAAP > Domains.

2. Find the domain for which you want to enable a WAAP mode and click the domain name to open it. You'll be directed to the Policies page.

3. In the upper-right corner of the screen, next to the WAAP mode, select Protect from the dropdown.