Setup Behavior Upon Failure

CloudGuard WAF implements a Fail-Open mechanism designed to allow no interruption to traffic in case of load or errors. The mechanism is enabled by default and can be configured separately for each agent profile through the profile page.

Setup

This configuration is available on the Agents' Profile level and will apply to all agents using this profile's authentication token for initial registration.

To configure the behavior upon failure, navigate to Policy->Profiles->[select your profile]. See the Behavior Upon Failure section:

How does it work?

Traffic based-Fail-Open

• For each client request and server response, the attachment waits for a total of 3000 milliseconds for a benign/malicious verdict (the wait time for each portion, such as headers, URL, etc.) is up to 150 milliseconds). If a a verdict doesn't arrive, the request/response is allowed to pass. This state is called fail-open.

• In case of consecutive fail-opens the system enters a state called transparency mode in order not to damage connectivity to the upstream server.

• There are three levels of transparency mode fail-open:

  • Level 1: If there is failure to inspect 5 http requests in 20 seconds interval, system enters global fail-open mode for 1 minute and moves the threshold to level 2.

  • Level 2: If there is failure to inspect 5 http requests in 20 seconds interval, system enters fail-open mode for 5 minutes and moves the threshold to level 3. In any other case system falls back to level 1.

  • Level 3: If there is failure to inspect 5 http requests in 20 seconds interval, system enters global fail-open mode for 10 minutes. In any other case system falls back to level 1.

Agent CPU based Fail-Open

In addition to the above traffic based mechanism, the system also monitors the Agent CPU level. The CPU utilization is sampled every 5 seconds, if 6 consecutive samples (30 seconds) were above 85% we enter fail open mode until we identify 6 consecutive samples below 60%.

Critical Errors

In case of any internal error in the attachment or agent during http inspection traffic will be allowed by default.

Notification logs about critical alerts will be shown in a Notifications logs view.