Overview
The hybrid cloud management feature supports deploying WAF protection capabilities to your private environment (your own IDC or private cloud), and enables you to uniformly deliver configurations, view logs, and monitor protection status from the console.
Use Cases
If your business system is deployed in your own IDC, you can use WAF to protect the traffic in your private environment.
If you have purchased a Cloud-native WAF Enterprise edition or higher instance, you can extend its protection capabilities to your hybrid cloud/private cloud environment.
You can manage WAF protection configurations for both the public cloud and private cloud sides from a unified console.
Prerequisites
You have purchased a Cloud-native WAF Enterprise edition or higher instance (one hybrid cloud protection node is included by default upon purchase).
You have applied to purchase additional hybrid cloud protection nodes via a ticket, making the total number of nodes greater than or equal to 2 (one is included by default + at least one additional purchased node). Server resources for deploying hybrid cloud detection nodes are ready in your private environment (supporting Docker Swarm or K8s as the deployment base).
Network connectivity is established between your private environment and Tencent Cloud's public cloud (for configuration pull and log reporting).
Operation Step
Step 1: Deploying Hybrid Cloud Protection Nodes
After purchasing nodes, you need to deploy the hybrid cloud detection nodes in your private environment.
1. Log in to the WAF console. At the top of the left sidebar, switch the console to the region where your instance resides (Chinese mainland/Non-Chinese mainland). 2. In the left sidebar, choose Service Settings > Hybrid Cloud Management.
3. On the Hybrid Cloud Management page, view the purchased node quotas and node list.
4. Click Local Deployment Material Download to obtain the deployment configuration file (Docker Compose file or Helm Chart) for the corresponding node.
5. Log in to the server in your private environment, go to the directory where the deployment configuration file is located, and run the deployment command.
Docker Swarm Deployment Example
docker stack deploy -c waf-hybrid-compose.yml waf_hybrid
K8s Deployment Example
helm install waf-hybrid waf-hybrid-chart/ -f values.yaml
6. After the deployment is complete, perform a health check in your private environment to confirm that all services are running normally.
docker service ls
kubectl get pods -n waf-hybrid
7. Return to the Hybrid Cloud Management page in the WAF console and confirm that the node status is displayed as Normal.
Note:
If you encounter any issues during the deployment, check the network connectivity between your private environment and the public cloud, and confirm that the resource specifications of the deployment node meet the minimum requirements.
Step 2: Connecting Protection Objects
After the hybrid cloud node is deployed, you need to connect the domain name protected by SaaS WAF to the hybrid cloud node. For detailed steps, see Hybrid Cloud Gateway Connection. Step 3: Configuring Protection Policies
After the protected object is connected, you need to configure a protection policy.
1. In the left sidebar, select Basic Security.
2. At the top of the Basic Security page, select the target hybrid cloud instance and domain name that have been connected.
3. Configure various protection rules, including:
Web Protection Rules: Protection against attacks such as SQL injection, XSS, and command injection. For detailed steps, see Rule Engine (New). CC Protection Rules: Frequency limits based on dimensions such as IP address, Session, and Header. For detailed steps, see Setting CC Protection Rule. Custom Rules: Customize matching conditions and handling actions based on your business requirements. For detailed steps, see Custom Policy. 4. After the configuration is complete, the policy will be delivered to the hybrid cloud nodes.
Note:
Configuration delivery to hybrid cloud nodes uses a long-polling mechanism. Policy changes typically take effect within 1 to 2 minutes.
Step 4: Viewing Protection Logs
Protection logs from hybrid cloud nodes are sent to Tencent Cloud's public cloud. You can view them in the console.
1. In the left sidebar, select Attack Logs.
2. At the top of the Attack Logs page, select the target hybrid cloud instance and domain name that have been connected.
3. View attack logs generated by hybrid cloud nodes. You can filter them by criteria such as time, domain name, and attack type. For detailed steps, see Attack Log. 4. To ship logs to a specified log system (CLS or CKafka), configure the shipping destination on the Log Shipping page. For detailed steps, see Log Shipping.