A cluster is the set of agents that share one CID. The license key selects the CID. Settings saved in WMC and through the API apply to that CID and stay inside it.
Clustering synchronizes settings, the list of blocked IP addresses and the other parameters of the agents, including agents in remote data centers. The statement and the minimum server diagram are in Clustering and fault tolerance.
Behavioral models are stored for the cluster. API requests always read and change data inside the cluster of the key sent as key. That rule is in Authorization.
Each agent runs on its own server. The hardware for each server is in Clustering and fault tolerance.
| Server | What runs there |
|---|---|
| Filter | Request and response analysis, MLA, RabbitMQ for MLC. Two Filters are the minimum for fault tolerance |
| MLC | Behavioral models, brute-force, flood, DDoS |
| API | Events, settings and delivery of those settings to the agents |
| WMC | The web-console |
| PostgreSQL | Agent settings, attacks and behavioral models |
| Scanner | Vulnerability scans, when Scanner is installed |
One MLC can serve several Filters, including Filters in different clusters: Point-to-multipoint. Several MLC nodes can share the load. Models are built on the master node: Distributed mode.
An administrator adds a license key in WMC with Add product key. The key button in the header is the active CID. WAF settings and the Web server pages apply to the selected CID. Attacks can show events from every CID of the account. Users are created on the WMC server. The System section (Users, SMTP, LDAP, API, Backups, Reactions, Logs) is shown to an administrator. See Common elements.
A standby PostgreSQL keeps a copy of the API database. While the primary API is unavailable, the standby API serves read requests: settings and behavioral models remain available and the API rejects changes. The procedure is Fault-tolerant operation of API.
Two Filters behind a load balancer are a placement of the request path, not a second copy of the API. That placement is Load balancer. One license key belongs to one Filter.
Installing an agent on a newer operating system, without using one Filter key on two servers, is Moving an agent to a new server.
The order for the OS, the agents and the pip dependencies is Install Mikiri WAF Updates. A backup of the main configuration files is the first step on that page.
Agent availability after a change is read from Agent monitoring. The license check that must succeed before the agents apply settings is in License verification.