Step 2: Configure a Load Balancer for WAF

• You have added a website to a dedicated WAF instance.
• You have created a load balancer.
• Related ports have been enabled in the security group to which the dedicated WAF instance belongs.

  You can configure your security group as follows:

  • Inbound rules

    Add an inbound rule to allow incoming network traffic to pass through over a specified port based on your service requirements. For example, if you want to allow access from port 80, add a rule that allows TCP and port 80.

  • Outbound rules

    Retain the default settings. All outgoing network traffic is allowed by default.

• If Health Check is configured, the health check result of the dedicated instance must be Healthy, or the website requests cannot be pointed to WAF.
• The Backend Port for the backend server must be the same as the service port protected by the dedicated WAF instance. The service port is the protected port set in Step 1: Add Your Website to WAF (Dedicated Mode).
• WAF works as a layer-7 proxy. When configuring a listener, you can only select HTTP or HTTPS as the frontend protocol.

If you select Weighted round robin for Load Balancing Algorithm, disable Sticky Session. If you enable Sticky Session, the same requests will be forwarded to the same dedicated WAF instance. If this instance becomes faulty, an error will occur when the requests come to it next time.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Elastic Load Balance under Network to go to the Load Balancers page.
4. Click the name of the load balancer in the Name column to go to the Basic Information page.
5. Locate the IP as a Backend row, enable the function. In the displayed dialog box, click OK.
6. Click the Listeners tab, click Add Listener, and configure the listener name, frontend protocol, and port.
7. Click Next: Configure Request Routing Policy.
   Notice

   If you select Weighted round robin for Load Balancing Algorithm, disable Sticky Session. If you enable Sticky Session, the same requests will be forwarded to the same dedicated WAF instance. If this instance becomes faulty, an error will occur when the requests come to it next time.

8. Click Next: Add Backend Server. Then, select the IP as Backend Servers tab.
   Notice

   In the health check configuration, Protocol can only be set to TCP, or the health check will fail and ELB will not forward traffic to the backend WAF.

9. Click Add IP as Backend Server. In the displayed dialog box, configure IP Address and Backend Port.
   • IP Address: Enter the IP address of the dedicated WAF engine, which you can obtain from the dedicated engine list.
   • Backend Port: Use the same one you configured in Step 1: Add Your Website to WAF (Dedicated Mode). If you configure a standard port for the website, set the HTTP listening port to 80 and HTTPS listening port to 443.

10. Click OK.
11. Click Next: Confirm, confirm the information, and click Submit.

If the Health Check Result is Healthy, the load balancer is configured.