Docs

Web Application Firewall

Quick Start

Associate with through Load Balancing Listener

The Web Application Firewall supports access through load balancer methods, protecting services that have connected to Load Balancer instances, including Application Load Balancer (ALB) and Load Balancer (CLB Layer 7). This article takes Application Load Balancer (ALB) as an example to introduce how to connect and implement protection. After connection, the WAF instance will perform bypass detection analysis on traffic through load balancer, cleaning attack traffic and separating business forwarding from security protection.

Instructions

When the domain name associated with the ALB instance connects to the WAF service, the WAF will automatically enable the protection function for this ALB instance, monitoring all traffic passing through that instance. The WAF will create two types of protection sites based on the domain name's access status:

Individually connected domain names: The WAF will create an independent protection site for it and protect it based on the domain name dimension. If multiple domain names are accessed, multiple sites will be generated. The protection configurations between each domain name are mutually independent.

Unconnected domain names: The WAF will automatically create a protection site named after the ALB ID (for example, alb-3u64ifon9l34858p9oqi****). The site is responsible for monitoring and protecting all other traffic that goes through the ALB instance, and this traffic will be processed uniformly according to the policies configured for this protection site.

Requirements

You have already created a Cloud WAF instance. For more details about creating a Cloud WAF instance, see create WAF instance.

The domain has not been added to the WAF instance yet. For details on the filing process, please refer to filing process.

You have connected the protected domain to the ALB and set up HTTP or HTTPS listeners and forwarding rules. For configuration related to forwarding rules, please refer to create forwarding rules.

Step 1: Add a domain name

In the top menu bar, select the region of your instance.

On the left-side navigation pane, select Website settings, and then click Create New Site.

Select the access method as Application Load Balancer (ALB).

Fill in the basic information of the website to be accessed by WAF.

Click OK.

Step 2: Set Up Protection Policies

After the domain name is accessed, you can quickly configure CC protection, vulnerability protection, API protection, and Bot management corresponding protection policies on the return page, or go directly to the protection policy page to configure custom policy content. For more details on setting protection policies, please refer to Protection policy types.

tip

The strategy configuration for your most recently accessed domain name is displayed by default.

What to do next

For viewing protection data, you can refer to view security overview information.

For information on logs, see Viewing and analyzing logs.

Last updated: 2025.06.30 16:20:52