Connecting SolidWall WAF to a web application

SolidWall WAF analyzes traffic and detects attacks. Service analysts configure protection for applications with complex business logic and sensitive data to reduce the risk of false positives.

You will connect a running application to SolidWall WAF and test traffic analysis in monitoring mode, without blocking. The example uses an online store with domains shop.example.com and auth.shop.example.com for the main site and authentication. Replace them with your own; for an application with a single domain, follow the steps for that domain only.

StepsSteps

To connect an application:

1. Prepare resources and check access.
2. Create a SolidWall WAF profile.
3. Add the application.
4. Connect domains.
5. Test traffic handling.

If data does not appear, perform diagnostics. If you no longer need the resources you created for the test, delete them.

Required paid resourcesRequired paid resources

The cost includes:

• Fee for request processing and Smart Web Security proxy server resources.
• Fee for infrastructure your web application runs in.

Prepare resources and check accessPrepare resources and check access

1. Make sure your account has the following roles:

   • smart-web-security.editor for the folder with SolidWall WAF resources.
   • iam.serviceAccounts.admin for the folder to create a proxy server.
   • smart-web-security.admin for at least one cloud in the organization to accept the HTTP request data usage agreement. The agreement is accepted once per organization when creating the first SolidWall WAF profile. To revoke consent, contact support.

2. Select or create a proxy server. Make sure its status is Active.

3. Add the shop.example.com and auth.shop.example.com domains to the proxy server.

4. Select or create a security profile with a Smart Protection rule.

5. Connect a security profile to the each domain.

6. Open the Domains tab on the proxy server page and check the settings for each domain:

   • A single target resource (IP address and port) is specified; the domains serve a single backend with shared business logic.
   • The connection to the target resource uses HTTP/1.1; HTTP/2 is not supported.
   • A security profile with a Smart Protection rule is connected.
   • The connection to the target resource is in the Healthy status.

   To change the domain settings, click and select Edit.

7. Configure the infrastructure: The A record of each domain must point to the proxy server IP address.

8. Verify resource availability and make sure the application opens in a browser via its domain name.

SolidWall WAF supports HTTP traffic and WebSocket (WSS).

Create a SolidWall WAF profileCreate a SolidWall WAF profile

When creating a profile, you will need to select a service plan:

• Basic: Up to 1,000 RPS, negative security model, single request analysis.
• Advanced: Positive and negative models, request, response, and session analysis tailored to business logic. We recommend selecting this plan to explore all available features.

Learn more about security models in this SolidWall WAF guide.

To create a SolidWall WAF profile:

Open the solidwall-demo profile and check the service plan and load. To view the SolidWall WAF settings, click Control panel.

Add the applicationAdd the application

Combine the store domains into an application named shop. For web applications with different business logic, create separate applications within the profile.

On the application page, you can see a support ticket with the application parameters, created automatically on your behalf. Use it to configure rules and analyze false positives.

Analysts configure the model based on real traffic: this usually takes two weeks, or up to a month for complex applications. Do not delete the application until configuration is complete to preserve statistics. Transactions become available after domains are connected and traffic appears.

Connect domainsConnect domains

Within a single profile, a domain can be connected to only one application.

Check the connection result:

1. On the shop application page, make sure that both domains are listed with the correct IP addresses, ports, proxy server, and security profiles.
2. On the solidwall-demo profile page, find the shop application in the Applications table. Both addresses must be displayed in the domains column.
3. Under Domain security, open the proxy server and its Domains tab. Each domain in the SolidWall WAF profile column must have the solidwall-demo profile specified.

Records of resource creation and domain connection are available on the [object Object] tabs of the profile and the application.

The Session binding column specifies the session binding to the SolidWall WAF server. By default, binding is set to By IP address; contact support to change it.

Test traffic handlingTest traffic handling

Send requests to the application and locate them in the SolidWall WAF console:

1. Open the main site via its domain name. Navigate through several pages, use the search feature and the login form. Make about 20-30 requests, including calls to both domains.

   Use domain names so that traffic passes through the proxy server. After changing the DNS, verify the IP address using the nslookup <domain> command: it must match the proxy server address.

2. In the Smart Web Security console, open the solidwall-demo profile and click Control panel.

3. In the new tab, under Overview, find the application and select the Hour period.

   In the SolidWall WAF console, the application name looks like webapp-<profile_id>-<application_id>. Match it with the IDs in the Smart Web Security console. Learn more about selecting applications and configuring the overview.

4. Check the application measures:

   Measure	Expected result
   Chart on the Statuses tab	There is data available for the verification period. Green represents 1xx, 2xx, and 3xx responses; yellow represents 4xx, and unanswered requests; red represents 5xx.
   Transactions counter	The value is greater than zero and increases with new requests.
   Status	Monitoring — WAF analyzes traffic and logs rule matches but does not block requests.

   Learn more about charts and measures and monitoring mode.

5. In the Applications section, open the required application and go to the Transactions tab. Select the verification period and, if required, filter requests by domain. Double-click a transaction to view the request, response, and analysis result. Learn more about viewing transactions.

6. Return to the Smart Web Security console and make sure that the shop application status has changed to Active. The Active status in the console does not mean that request blocking is enabled in SolidWall WAF.

Static requests might not appear on charts, and regular transactions are saved using sampling: their count may be less than the number of sent requests.

If anomalies are detected, security events will appear under Overview. Handle them by submitting a support ticket for the application.

Once traffic appears, check the Actual maximum number of requests measure on the profile page in the Smart Web Security console. If the actual load regularly exceeds the selected tier, review the RPS value in the profile.

ResultResult

Connection is complete if the following conditions are met:

• Both domains are connected to the shop application within the solidwall-demo profile.
• The application is active, and its transactions and charts are displayed in the SolidWall WAF console.
• The application is running in monitoring mode.
• A support ticket to configure protection is available on the application page.

Continue routing normal traffic through the WAF to calibrate the model. After verifying rules and analyzing false positives, coordinate enabling active protection via an application support ticket.

If data does not appearIf data does not appear

Issue	What to check
The domain opens, but there are no transactions	A records must point to the Smart Web Security proxy server. Make sure requests are not served from the cache or sent directly to the target resource.
DNS is configured correctly, but there are no transactions	Check the domain connection to the application and ensure a Smart Protection rule exists in the security profile.
The application is not displayed in the SolidWall WAF console	Wait a few minutes after creation and refresh the page. Match the technical name with the application ID in the Smart Web Security console.
Charts are empty	Check the selected application and period. Try selecting the Day period. Make requests to the dynamic pages of the application.
The charts show 5xx responses	Verify target resource availability, its IP address, and its port. Ensure the server accepts traffic from the Smart Web Security proxy server.

Learn more about reasons for missing data on charts and searching for transactions.

How to delete the resources you createdHow to delete the resources you created

If you no longer need the solidwall-demo profile, delete it. If the service analysts are still working with the application, wait for the configuration to complete or contact support.

Delete the resources in the following order:

1. Disconnect domains and delete the shop application. Repeat for other applications if they exist in the profile.
2. Delete the solidwall-demo profile.

Domains, their security profiles, and the web application infrastructure will be preserved and will continue to run and be billed according to their terms.

Useful linksUseful links

• Creating a SolidWall WAF profile
• Creating a SolidWall WAF application and connecting a domain to it
• Deleting a SolidWall WAF profile
• SolidWall WAF
• SolidWall WAF guides