Recommendations for a safe WAF node update process¶
This document describes recommendations and associated risks for a safe update of Wallarm WAF node up to 2.18.
Carefully plan and monitor the WAF node update process. Estimated release dates for new versions of WAF nodes are published in the WAF node versioning policy.
If your infrastructure has multiple WAF nodes installed, update them gradually. After updating the first WAF node, monitor the WAF node modules operation within a day and gradually update other WAF nodes if the first WAF node operates correctly.
For the model with separated development and production environments, update the WAF node gradually. First, apply and test new version in non-production environments, then in production environments. Detailed recommendations are described in the instructions for configuring WAF nodes for separated environments.
Before updating the WAF node, set the WAF node filtering mode to
monitoring. If all modules work correctly and there is no abnormal number of new false positives in the
monitoringmode for a day, then put the WAF node in the
Update NGINX to the latest version available before applying WAF node updates. If your infrastructure needs to use a specific version of NGINX, please contact the Wallarm technical support to build a WAF module for a custom version of NGINX.
Below are the risks that may occur when updating the WAF node. To reduce the impact of the risks, please follow the appropriate guidelines when updating.
A new minor version of the WAF node may contain the following changes:
Support for new installation options
Dropped support for unclaimed installation options
New WAF node features
Optimization of work of the WAF node
The configuration of the previous version is automatically applied to the new version and does not require additional changes. When updating the cloud image, you should manually transfer the configuration files to the new version. Most of the new features are configured via the directives in configuration files.
Before upgrading, please check the set of changes and consider a possible configuration change when planning the upgrade.
Set of changes in WAF node 2.18
New WAF node features
- New variable
wallarm_attack_type_listin the extended WAF node logging format. Attack types detected in the request are saved in this variable in text format.
[More details on the variable
- New method for setting up the blocking page and error code returned in the response to the blocked request. Now, to return different responses to requests originated from different devices and applications, you can use the variable as the value of the directives
[Detailed instructions on setting up the response via the variable →]
- New WAF node statistics parameter
startid. This parameter stores the randomly-generated unique ID of the WAF node.
[The full list of available statistics parameters →]
- Support of new Wallarm Ingress controller annotation
nginx.ingress.kubernetes.io/wallarm-acl-block-page. This annotation is used to set up the response to the request originated from a blocked IP address.
[Example of response configuration via
- Decreased memory amount allocated for the postanalytics service in deployed WAF node cloud image by default.
In previous WAF node versions, the default memory amount allocated for Tarantool was 75% of the total instance memory. In the WAF node version 2.18, 40% of the total instance memory is allocated for Tarantool.
New false positives¶
We improve the traffic analysis with each new version of the WAF node. This means that the number of false positives decreases with each new version. However, each protected application has its own specificities, so we recommend analyzing the work of the new version of the WAF node in the
monitoring mode before enabling the blocking mode (
To analyze the number of new false positives after the update:
Deploy the new version of the WAF node in the
monitoringmode and send the traffic to the WAF node.
After some time, open the Wallarm Console → Events section and analyze the number of requests that are mistakenly recognized as attacks.
If you find abnormal growth in the number of false positives, please contact the Wallarm technical support.
Increased amount of used resources¶
Usage of some new WAF node features may cause changes in the amount of used resources. Information about changes in the amount of used resources is highlighted in the What is new section.
Also, it is recommended to monitor the WAF node operation: if you find significant differences in the actual amount of used resources and in the amount specified in the documentation, please contact the Wallarm technical support.
The WAF node update process depends on the platform and installation forms. Please select the installation form and follow the appropriate instructions: