A traffic copy keeps the visitor on the reverse proxy in front of the application. The proxy sends the request to the application server and mirrors a copy to Filter. Filter records the attack. The visitor receives the application response. This is the placement for observation without standing on the request path, in the same role as an IDS.
Complete Deploy the agents first. The direct test request to the Filter must already return 403. Do not change the site's DNS record to the Filter.
The visitor reaches Nginx. Nginx proxies the request to the application server and mirrors a copy to Filter. The application response returns to the visitor through Nginx. Nginx opens the mirror connection and discards the response from Filter.
The Filter still needs an upstream that accepts the copy and returns a response, otherwise analysis does not finish. The virtual host below forwards the copy to a local listener that answers 200. That listener is not the application. The real application response is not part of the copy, so response analysis does not see the page the visitor received. Request analysis does: signatures, request rules the request checks performed by MLA and MLC.
The mirror directives for that Nginx are in Nginx traffic mirroring. The same placement is described under Detection mode.
Mikiri WAF packages stay on the Filter. The application server only duplicates the request. On Nginx, follow Nginx traffic mirroring. On Apache, IIS, or another server, use that server's request-mirror feature and send the duplicate to %WAF SERVER%:%PORT% with Host and X-Real-IP.
In WMC, open Web server for the CID of this Filter. Allow TCP %PORT% from the application server. example.com is the value of the Host header from the previous step. The fields are described in Web server settings.
Global settings → Header settings:
| Field | Value |
|---|---|
| real_ip_header | X-Real-IP |
| set_real_ip_from | the application server that sends the copy |
Save.
Upstreams → Add new upstream. Name mirror_local. Add server and set Server IP to 127.0.0.1:86. Leave that server active and Save.
Virtual hosts → Add a virtual host named example-local:
| Field | Value |
|---|---|
| listen | 127.0.0.1:86 |
| return | 200 |
| add_header Content-Type | text/plain |
| Active | on |
Do not add a location. Save.
Add a virtual host named example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | %PORT% |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://mirror_local |
Save.
That local listener is not the application. It only finishes the copy so analysis can complete.
Turn off waf_autoban for this host in WMC or through the API. A copy of a busy site would otherwise put visitor addresses on the block list after the allowed number of detected requests. That list is shared by the Filters of the cluster. An inline site on the same cluster would then block those visitors.
On the application server:
nginx -t && service nginx reload
The Filter takes the virtual hosts from the WMC. Do not reload Nginx on the Filter for those hosts.
Send the test signature to the site name, which still points at the application server:
curl -i https://example.com/mikiri-waf-test
The visitor receives the application server's response. The Filter log records signature ID 1 the event appears in WMC with the visitor's address. A 403 from a request sent straight to the Filter only repeats the check from Deploy the agents. It does not prove that the copy is arriving.
When the recorded events match the traffic you expect, remove the mirror directive from the application server and place the site with Inline protection. On that page, leave waf_host_dm on through the cutover, then remove the host from it after the attacks page shows no mass false blocks. Until that removal the Filter only monitors.