https://ccn.ai/assets/DocsExternalWaf-D7QbHa0f.js

1import{j as e,V as o,U as l,v as c,C as r,w as i,x as n,F as h,y as s,B as m}from"./index-DIQGAGvx.js";import{S as u}from"./shield-check-CAPfXxD6.js";import{E as p}from"./external-link-C0nLrE-a.js";const g=[{provider:"Cloudflare",docs:"https://developers.cloudflare.com/waf/",steps:["In Cloudflare Dashboard → DNS, point the customer hostname (e.g. app.customer.com) at the CyberCloud gateway hostname provided in the External WAF tab.","Enable the orange-cloud proxy so traffic flows through Cloudflare.","Security → WAF → Managed rules: enable the OWASP Core Ruleset (paranoia level 2+) and Cloudflare Managed Ruleset.","Security → Bots: enable Bot Fight Mode (Pro+) or Super Bot Fight Mode (Business+).","Rules → Transform Rules → Modify Response Header: forward the verdict header (e.g. cf-mitigated, x-waf-action) so the gateway can read it.","Rules → Origin Rules: add a custom request header X-Gateway-Secret=<shared secret> using the value configured in the gateway.","Add Cloudflare's IPv4/IPv6 ranges (https://www.cloudflare.com/ips/) to Trusted Proxy CIDRs in the gateway.","Set Client IP Header to CF-Connecting-IP.","Map verdict headers: cf-mitigated=challenge → block, cf-mitigated=block → block.","Click Run verification to confirm Cloudflare blocks SQLi/XSS probes before they reach the gateway."]},{provider:"AWS WAF + CloudFront",docs:"https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html",steps:["Create a CloudFront distribution with the gateway hostname as the origin.","Attach an AWS WAFv2 Web ACL: enable AWSManagedRulesCommonRuleSet, AWSManagedRulesKnownBadInputsRuleSet, AWSManagedRulesSQLiRuleSet, AWSManagedRulesAmazonIpReputationList.","Add a rate-based rule (e.g. 2000 req/5min per IP).","CloudFront → Behaviors → Origin custom headers: add X-Gateway-Secret with the shared secret.","CloudFront → Behaviors: forward X-Forwarded-For and use it as Client IP Header.","Add CloudFront prefix list (com.amazonaws.global.cloudfront.origin-facing) to Trusted Proxy CIDRs.","Optional: enable AWS Shield Advanced for DDoS protection.","Map verdict header x-amzn-waf-action=BLOCK → block."]},{provider:"Akamai App & API Protector",docs:"https://techdocs.akamai.com/app-api-protector/docs",steps:["Onboard the hostname in Akamai Control Center and point DNS to the Akamai edge.","Enable Adaptive Security Engine in automatic mode with KRS rules at moderate/aggressive sensitivity.","Enable Bot Manager (Standard or Premier) and rate controls (per-IP and per-client).","Add origin custom header X-Gateway-Secret in the property configuration.","Add Akamai edge IP ranges to Trusted Proxy CIDRs and set Client IP Header to True-Client-IP.","Forward Akamai-AKS-Action / AkamaiGHost custom verdict header to the gateway and map values."]},{provider:"Fastly Next-Gen WAF (Signal Sciences)",docs:"https://docs.fastly.com/en/ngwaf",steps:["Create a Fastly service in front of the gateway origin.","Attach the Next-Gen WAF and enable Blocking mode after a 24h tuning window.","Enable templated rules for SQLi, XSS, command injection, traversal, and bot signals.","Add origin request header X-Gateway-Secret with the shared value.","Add Fastly IP ranges (https://api.fastly.com/public-ip-list) to Trusted Proxy CIDRs and set Client IP Header to Fastly-Client-IP.","Surface the signal header (e.g. x-sigsci-tags) and map verdicts to block."]}],x=["All external WAF providers must place the gateway as the origin and forward traffic over HTTPS.","The shared secret (X-Gateway-Secret) ensures the gateway only accepts traffic that came through the WAF — never expose the gateway origin publicly without it.","If you remove the external WAF, switch the tier back to embedded so the gateway's own OWASP rule pack takes over.","File scanning, DLP, and CDR always run in the gateway regardless of WAF tier."];function v(){return e.jsx("div",{className:"min-h-screen bg-background py-10",children:e.jsxs("div",{className:"max-w-4xl mx-auto px-4 space-y-6",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsxs(o,{to:"/customer-portal",className:"text-sm text-muted-foreground inline-flex items-center gap-1 hover:text-foreground",children:[e.jsx(l,{className:"h-4 w-4"})," Back"]}

1),e.jsx(c,{variant:"outline",children:"Reverse Gateway · External WAF / DDoS"})]}),e.jsxs("header",{className:"space-y-2",children:[e.jsxs("h1",{className:"text-3xl font-bold flex items-center gap-2",children:[e.jsx(u,{className:"h-7 w-7 text-primary"})," External WAF & DDoS Integration"]}),e.jsx("p",{className:"text-muted-foreground",children:"Use a third-party WAF/DDoS provider in front of the Reverse Gateway for OWASP-max coverage, bot mitigation, and L3/L4/L7 DDoS protection. File scanning, DLP, and CDR continue to run inside the gateway."})]}),e.jsxs(r,{children:[e.jsxs(i,{children:[e.jsx(n,{className:"text-base",children:"Common requirements"}),e.jsx(h,{children:"Apply to every external provider."})]}),e.jsx(s,{children:e.jsx("ul",{className:"text-sm space-y-2 list-disc pl-5 text-muted-foreground",children:x.map((a,t)=>e.jsx("li",{children:a},t))})})]}),g.map(a=>e.jsxs(r,{children:[e.jsx(i,{children:e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsx(n,{className:"text-base",children:a.provider}),e.jsx(m,{asChild:!0,size:"sm",variant:"outline",children:e.jsxs("a",{href:a.docs,target:"_blank",rel:"noreferrer",children:["Provider docs ",e.jsx(p,{className:"h-3 w-3 ml-1"})]})})]})}),e.jsx(s,{children:e.jsx("ol",{className:"text-sm space-y-2 list-decimal pl-5 text-muted-foreground",children:a.steps.map((t,d)=>e.jsx("li",{children:t},d))})})]},a.provider)),e.jsx(r,{className:"border-primary/30 bg-primary/5",children:e.jsxs(s,{className:"p-4 text-sm",children:["Looking for a vendor? Browse the"," ",e.jsx(o,{to:"/customer/marketplace?category=waf-ddos-protection",className:"text-primary underline",children:"WAF & DDoS Protection category"})," ","in the CyberCloud Marketplace to find pre-integrated providers."]})})]})})}export{v as default};