Deploy WAAS Out-Of-Band for Containers

Create a new rule to deploy WAAS Out-Of-Band for Containers.

Prerequisites

  • You have installed a Container Defender in your workload environment.
  • The minimum version of Console and Defender is 22.12.
  • A TLS certificate in PEM format.

Create a WAAS rule for Out-Of-Band network traffic

To deploy WAAS for Out-Of-Band network traffic, create a new rule, define application endpoints, and select protections.
  1. Open Console, and go to
    Defend > WAAS > {Container|Host} > Out-of-Band
    .
  2. Click
    Add rule
    .
    1. Enter a
      Rule Name
    2. Enter
      Notes
      (Optional) for describing the rule.
  3. Choose the rule
    Scope
    by specifying the resource collection(s) to which it applies.
    Collections define a combination of image names and one or more elements to which WAAS should attach itself to protect the web application:
    Applying a rule to all images using a wild card (*) is invalid - instead, only specify your web application images.
  4. (Optional) Enable
    API endpoint discovery
    When enabled, the Defender inspects the API traffic to and from the protected API. Defender reports a list of the endpoints and their resource path in
    Compute > Monitor > WAAS > API discovery
    .
  5. (Optional) Enable
    Automatically detect ports
    for an endpoint to deploy the WAAS’s protection on ports identified in the unprotected web apps report in
    Monitor > WAAS > Unprotected web apps
    for each of the workloads in the rule scope.
    As an additional measure, you can specify additional ports by specifying them in the protected HTTP endpoints within each app to also include the ports that may not have been detected automatically.
    By enabling both
    Automatically detect ports
    and
    API endpoint discovery
    , you can monitor your API endpoints and ports without having to add an application and without configuring any policies.
  6. Save
    the rule.

Add an App (policy) to the rule

  1. Select a WAAS rule to add an App in.
  2. Click
    Add app
    .
  3. In the
    App Definition
    tab, enter an
    App ID
    .
    The combination of
    Rule name
    and
    App ID
    must be unique across In-Line and Out-Of-Band WAAS policies for Containers, Hosts, and App-Embedded.
    If you have a Swagger or OpenAPI file, click
    Import
    , and select the file to load.
    If you do not have a Swagger or OpenAPI file, manually define each endpoint by specifying the host, port, and path.
    1. In
      Endpoint Setup
      , click
      Add Endpoint
      .
    2. Specify endpoint in your web application that should be protected. Each defined application can have multiple protected endpoints.
    3. Enter
      HTTP host
      (optional, wildcards supported).
      HTTP hostnames are specified in the form of [hostname]:[external port].
      The external port is defined as the TCP port on the host, listening for inbound HTTP traffic. If the value of the external port is "80" for non-TLS endpoints or "443" for TLS endpoints it can be omitted. Examples: "*.example.site", "docs.example.site", "www.example.site:8080", etc.
    4. Enter
      App ports
      as the internal port your app listens on (optional, if you selected
      Automatically detect ports
      while creating the rule).
      When
      Automatically detect ports
      is selected, any ports specified in a protected endpoint definition will be appended to the list of protected ports.
      Specify the TCP port listening for inbound HTTP traffic.
      If your application uses
      TLS
      or
      gRPC
      , you must specify a port number.
    5. Enter
      Base path
      (optional, wildcards supported):
      Base path for WAAS to match when applying protections.
      Examples: "/admin", "/" (root path only), "/*", /v2/api", etc.
    6. If your application uses TLS, set
      TLS
      to
      On
      .
      You can select the TLS protocol (1.0, 1.1, 1.2, and 1.3 for WAAS In-Line, and 1.0, 1.1, and 1.2 for WAAS Out-Of-Band) to protect the API endpoint and enter the TLS certificate in PEM format.
      Limitations
      1. TLS connections using extended_master_secret(23) in the negotiation are not supported as part of this feature.
      2. DHKE is not supported due to a lack of information required to generate the encryption key.
      3. Out-of-Band does not support HTTP/2 protocol.
      4. TLS inspection for Out-of-Band WAAS is not supported on earlier versions of Console and Defender.
        • If your application uses HTTP/2, set
          HTTP/2
          to
          On
          .
          WAAS must be able to decrypt and inspect HTTPS traffic to function properly.
        • If your application uses gRPC, set
          gRPC
          to
          On
          .
    7. Select
      Create response header
      .
    8. To facilitate inspection, after creating all endpoints, click
      View TLS settings
      in the endpoint setup menu.
      WAAS TLS settings:
    9. If you application requires API protection, for each path define the allowed methods and the parameters.
  4. Continue to
    App Firewall
    settings, select the protections to enable and assign them with WAAS Actions.
  5. Configure the DoS protection thresholds.
  6. Continue to
    Access Control
    tab and select access controls to enable.
  7. Select the