Do this before Deploy the agents. The place of this page in the guide is Getting started.
For all Mikiri WAF agents to work correctly on each server where they are installed, you must provide access to external resources:
The Mikiri WAF agents can interact with each other therefore it is necessary to provide access to 127.0.0.1, as well as access in accordance with the information provided below.
Ports below are the ones used in these pages. A listen port you change replaces the example.
| Direction | Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|---|
| Inbound | Visitors, or the application server that sends a traffic copy | Filter | 80, 443, or the copy port |
TCP | Application traffic |
| Inbound | Operator | WMC | 8080 |
TCP | WMC. The package Nginx listens on 8080 and proxies to 127.0.0.1:8000 |
| Outbound | Filter, MLC, WMC, Scanner | API | 8080 |
TCP | Settings and events |
| Outbound | MLC | RabbitMQ on the Filter | 5673 (5672 inside a Docker network) |
TCP | Anomaly checks and blocked requests |
| Outbound | API, WMC | PostgreSQL | 5432 |
TCP | Records and settings |
| Inbound | Standby PostgreSQL | Primary PostgreSQL | 5432 |
TCP | Replication for the API standby |
| Outbound | Scanner | Protected application | the application port | TCP | Scans and recheck |
| Outbound | Each agent server | s.mikiri.ai |
443 |
TCP | Repository, license check, signature sets and threat analysis of detected events |
| Outbound | Each agent server | auth.s.mikiri.ai |
10443 |
TCP | License check |
On the Filter host, Mikiri WAF CAPTCHA listens on 127.0.0.1:8080 and stores challenge sessions in Memcached on 127.0.0.1:11211. Those connections stay on the host.
Incoming connections:
80 and 443, or the port chosen for the copy).Outgoing connections:
8080).Outgoing connections:
5673 from Deploy the agents; inside a Docker network the Filter container uses 5672);8080).Outgoing connections:
5432).Incoming connections:
80);8080).Outgoing connections:
5432);8080).Outgoing connections:
80);8080).Incoming connections:
5432).During operation, the Mikiri WAF agents check the license each time they are started, restarted, as well as during operation. Errors during license verification may occur for the following reasons:
You can verify the availability of the licensing server by sending a request with the following content:
curl 'https://s.mikiri.ai/mikiri-waf/auth/v1' -H 'content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
If the license is successfully verified, the response will have the code 201 and the following body:
{
"status": "success",
"cid": "%Cluster ID%",
"plan_id": %Plan ID%,
"ml_hosts_max": %Number of available ML hosts%,
"days_left": "%Number of days left until license expiration%",
"geo_token": "%Geo token to access IPG API%"
}
The body contains the license validity period, the tariff plan, the number of available behavioral models other information. If the license has expired, the server will return a response with the code 401.
If the agent cannot check the license status, it will continue trying with a short interval until success. During this period (except in cases when the license is checked during the agent's operation), the functionality of Mikiri WAF may be limited.
MLA on the Filter downloads the signature sets from s.mikiri.ai and writes the response body to disk. It repeats the request about every 30 seconds. When the hash in the body changes, MLA replaces the file and reloads Nginx. If the reload fails, the previous file is put back.
The request set is the rl array. Filter reads it from /etc/nginx/mikiri-waf/filter/global/db/crl.db. The id of a signature in this set is greater than 0 and less than 5000.
curl -sS 'https://s.mikiri.ai/mikiri-waf/rl/rs' -H 'content-type: application/json' --data '{"key": "%PRODUCT KEY%"}' -o rl.json
The response set is the rprl array. Filter reads it from /etc/nginx/mikiri-waf/filter/global/db/crprl.db when status is success. The id of a signature in this set is greater than or equal to 50000 and less than 100000. MLA requests this set on the Enterprise plan (plan_id greater than 1).
curl -sS 'https://s.mikiri.ai/mikiri-waf/rprl/rs' -H 'content-type: application/json' --data '{"key": "%PRODUCT KEY%"}' -o rprl.json
A usable body has "status": "success" and a hash. %PRODUCT KEY% is the license key of the Filter.
An event recorded by signature analysis (bt 1 or 2) carries the attack type of the matched signature in description, for example SQLi or Archive access. The list of attack types and the explanation of each is public. The request needs no key:
curl -sS 'https://s.mikiri.ai/mikiri-waf/rl/tags'
{
"status": "success",
"tags": {
"Archive access": "Attempts to access files with archives and backups.",
"SQLi": "An attack using SQL-injection involves the introduction of an SQL request into the application through input data from the user.",
"XSS": "Cross-Site Scripting attacks occur when data enters a web application through an untrusted source."
}
}
The example is shortened. The keys of tags are the attack types, and each value explains its type. The event filter is in Get events. The types that Recheck can confirm are listed in Recheck.