General settings

You can configure slow HTTP protection, TLS versions, session management, and worker settings. These general settings apply to all your protected web servers.

Slow HTTP protection settings

Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests in pieces slowly, one at a time, to a web server. If an HTTP request isn't complete or the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. When the server’s concurrent connection pool reaches its maximum, this creates a DoS.

Slow HTTP protection helps to protect against Slow HTTP attacks by setting a time-out for request headers.

• Soft limit: Minimum amount of time to receive a request header.

• Hard limit: Maximum amount of time to receive the request header.

• Extension rate: Amount of data, in bytes, to extend the time-out set by the soft limit. Every time the rate is exceeded, the soft limit is increased by one second.

• Skipped networks/hosts: Networks or hosts that should not be affected by Slow HTTP protection.

TLS version settings

Select the minimum TLS version that is allowed to connect to the WAF.

Select one of the following versions:

• TLS v1 or later: Includes all protocols except SSLv3. Use this for legacy systems.
• TLS v1.1 or later: Includes all protocols except SSLv3 and TLSv1.
• TLS v1.2 (wide compatibility): Includes only the TLSv1.2 protocol. It also includes ciphers that aren't recommended for use but you might need them on legacy systems.
• TLS v1.2 (strict): Includes only the recommended TLSv1.2 protocol ciphers.
• TLS v1.3: Includes only the TLSv1.3 protocol ciphers.

• Custom TLS: Manually enter the following details using the OpenSSL syntax:

  • Protocols: Enter the protocols.
  • Cipher suite: Enter the ciphers of your specified protocols. Don't enter the TLS v1.3 ciphers here.
  • TLS v1.3 cipher suite only: Enter only the TLS v1.3 ciphers if you're using the TLS v1.3 protocol.

  Warning

  If you enter invalid protocols or cipher suites, the Apache service doesn't start, and WAF may not function correctly.

  For more information about the syntax and ciphers, see the following links:

  • Apache syntax
  • OpenSSL ciphers

Session management settings

You can configure user session settings for your protected web servers.

Maximum sessions: The maximum number of concurrent user sessions allowed for all WAF rules using form-based reverse-proxy authentication. When the firewall reaches this limit, it closes old or expired sessions to allow new ones across all your protected web servers.

Default: 25,000

Range: 100 to 100,000

Worker customization

The firewall calculates WAF capacity to handle concurrent HTTP requests based on the available CPU and RAM resources. The values shown under Worker customization are based on this calculation.

You can customize these values if the calculated settings don't meet your performance requirements.

To customize the values, turn on Use custom worker profile, then configure the following settings:

• Start servers: Number of worker processes started when the web server starts.
• Server limit: Maximum number of worker processes the web server can run.
• Minimum spare threads: Minimum number of idle worker threads kept available to handle new requests.
• Maximum spare threads: Maximum number of idle worker threads kept available before excess threads are removed.
• Threads per child: Maximum number of worker threads available in each worker process.
• Asynchronous request worker factor: Controls how the web server scales worker processes to handle asynchronous connections and requests.

For more information about worker processes and threads, see Apache MPM event.