FAQ
Answers to common questions about FPT Cloud WAF for L1 Support.
1. Domains and certificates
| # | Question | Answer |
|---|---|---|
| 1.1 | Why is a domain Unprotected and how do I fix it? | Unprotected (red dot + ⓘ icon) means WAF is not protecting the domain. Hover the ⓘ icon for the reason: "Certificate expired" (update the certificate) or "WAF is disabled" (turn WAF protection back on). If both apply, the tooltip prioritizes "WAF is disabled". |
| 1.2 | What do the colors/symbols in the Certificate column mean? | Expires DD/MM/YYYY · Nd left = valid, more than 30 days left. ⚠ Expires DD/MM/YYYY · Nd left (amber) = expiring soon, 0–30 days left — prepare to renew. ✗ Expired · DD/MM/YYYY (red) = expired, the domain becomes Unprotected. |
| 1.3 | What should I know about deleting a domain from WAF? | Deleting a domain cannot be undone; afterward traffic is no longer filtered by WAF and goes straight to the origin. To confirm: open the Actions (⋮) menu → Delete, type delete (lowercase) exactly — the Confirm button enables only on an exact match (DELETE, Delete, or a typo will not enable it). |
2. Add a domain and point DNS
| # | Question | Answer |
|---|---|---|
| 2.1 | What format must Domain name and Origin address use? | Domain name: a valid domain such as shop.abc.com, up to 253 characters, no wildcard (*.abc.com), no leading dot, no double dots, no trailing hyphen. Origin address: a domain name (origin.example.com) or IPv4 (203.0.113.1), accepting public and RFC1918 private IPs (10.x, 172.16.x, 192.168.x) but not loopback 127.0.0.0/8 and not IPv6. |
| 2.2 | How do I choose Protocol and Port correctly? | Protocol defaults to https (can switch to http). Port is required, from 1 to 65535. Constraint: Protocol https with Port 80 returns "Invalid port for HTTPS." |
| 2.3 | I entered a domain but it says it already exists — why? | "This domain already exists in your WAF." means the domain is already registered in your own tenant. "The root domain of this domain is already in use by another tenant." means the root domain is registered by another tenant. Subdomains are not blocked across different tenants. |
| 2.4 | How do I point DNS in Step 3? | The Point your DNS to WAF section has two tabs (default Subdomain). Subdomain: create a CNAME, Name is the subdomain part (for www.ztalk.vn → Name www), Value is the WAF edge hostname (Copy button). Root domain: because RFC 1912 forbids CNAME on a root domain, RECOMMENDED (DNS with ALIAS/ANAME such as Cloudflare, Route 53, DNSimple) is a CNAME at @ to the WAF edge hostname; FALLBACK (A-record-only DNS) is an A record at @ to the WAF public ingress IP. |
| 2.5 | What is "Whitelist WAF egress IPs" for? | These are the IP ranges WAF uses to call your origin. Configure your origin firewall to accept traffic only from these egress IP ranges, so an attacker cannot bypass WAF by calling the origin directly. Note: egress IPs (Whitelist section) are for the origin firewall; the IP used for the A record in DNS is the WAF ingress IP — the two groups are different. |
| 2.6 | Provisioning failed / origin health check failed — how do I handle it? | The Provisioning Failed dialog shows a Reason (often "Origin health check failed...", meaning WAF cannot reach the origin) with a Retry Provisioning button. Check in order: (1) the origin is running and the address/port/protocol in Step 1 are correct; (2) the Step 2 certificate is correct (re-upload if needed); (3) the WAF egress IPs are whitelisted on the origin firewall. Then click Retry Provisioning. |
3. TLS certificates
| # | Question | Answer |
|---|---|---|
| 3.1 | What files do I need and how do I enter the certificate? | Prepare Certificate (PEM) (required), Private Key (PEM) (required), and Certificate Chain (optional). You buy the certificate from a CA (DigiCert, GlobalSign, etc.) and are responsible for renewal. For each field, choose one of two mutually exclusive methods: paste the PEM into the textarea, or upload a file (.pem/.crt for the cert, .key for the key). After uploading, the textarea hides and a Remove File button appears. |
| 3.2 | Why does certificate validation say it is invalid? | The system checks in order: (1) covers the domain → (2) not expired. Cases: certificate does not cover the domain (red "Certificate is invalid" + "Certificate does not cover domain '{domain}'"); expired (red "Certificate is invalid", Expires shows the past date); malformed cert ("Certificate (PEM) is not valid"); malformed key ("Private key (PEM) is not valid"); key does not match cert ("Private key does not match the certificate"). Only when valid does it show "Certificate validated". Editing cert or key after validating resets it and requires re-validation. |
| 3.3 | How do I update the certificate for a running domain? | Go to Domain Details → the Certificate card → Update Certificate →. In the popup: upload the new cert + key → Validate Certificate → when valid, click Save Changes. The validation rules are the same as for a new certificate. |
4. Turn WAF protection and origin on/off
| # | Question | Answer |
|---|---|---|
| 4.1 | How do I turn WAF protection on/off for a domain? | Use the WAF protection switch in the Domain Details header; each change has a confirmation dialog. Off ("Turn Off WAF Protection?"): traffic goes straight to the origin with no inspection, and attacks are not blocked or logged; the domain becomes Unprotected and shows "WAF is turned off". On ("Turn On WAF Protection?"): WAF inspects again, and the previous configuration is restored. |
| 4.2 | The origin shows Unhealthy — what should I do? | Unhealthy means the origin does not respond to WAF's health check. Check that the origin is running, the port/protocol are correct, and the WAF egress IPs are whitelisted on the origin firewall. Then click Check Now to re-check (the button is locked while checking, then shows "Origin health checked"). |
5. Security Policies
| # | Question | Answer |
|---|---|---|
| 5.1 | In what order are rules evaluated? | The pipeline evaluates three layers in order (How Rules Are Evaluated): (1) IP Rules — Allow > Block; every rule is checked, Allow always beats Block; Allow skips the selected protection layers and goes to origin, Block returns 403. (2) Rate Limiting — evaluated independently, multiple rules can match, each counts separately; Block > Challenge. (3) WAF / OWASP — Custom Rules → FPT Managed Rules → OWASP CRS, first match wins. |
| 5.2 | Why haven't my changes taken effect? | Most changes (add/edit/delete a rule, move a slider, toggle, import) are gathered into a draft and only apply when you click Save Changes. When there are unsaved changes, the header shows "Unsaved changes" and enables Save Changes / Discard. Switching steps in the pipeline keeps the draft, but leaving Security Policies shows an Unsaved Changes dialog (Stay / Leave Anyway). |
| 5.3 | What should I know about configuring Rate Limiting? | Each rule has Path, Threshold (request count), Window (10 sec to 1 hour), Action (Block/Challenge), and Scope (Per IP/Per IP + Path). * in Path matches any sub-path after the prefix (/api/* matches /api/v1, /api/v1/users). Constraint: a Path with * combined with Scope Per IP + Path returns "Wildcard paths only apply to the Per IP scope." Challenge sends visitors through a quick (~1 second) browser verification that most legitimate users pass automatically. |
| 5.4 | Which Paranoia Level (PL1 to PL4) should I choose? | OWASP CRS uses a cumulative anomaly-score model; Paranoia Level adjusts coverage. PL1 — Conservative: low false positives, safe to enable in production. PL2 — Balanced: catches more sophisticated variants, more false positives; for higher protection. PL3 — Aggressive: very strict, may block apps with complex payloads; test first. PL4 — Maximum: extremely strict, only for apps with rigorous input validation. |
| 5.5 | Custom Rules: what is the difference between Allow and Log only? | Custom Rules run before FPT Managed Rules and OWASP CRS, by Priority (lower runs first, first match wins). Allow skips all following rules and sends the request straight to the origin. Log only just logs — the request still reaches the origin, but the following rules are still evaluated. (The other two actions: Block returns 403, Challenge verifies the browser.) Priority is required, unique, and cannot be edited when editing (set only at creation). |
| 5.6 | Does importing a CSV overwrite existing rules? | Yes. Import replaces all existing rules (overwrite) for IP Rules, Rate Limit Rules, and Custom Rules. Flow: pick a .csv → the system validates the whole file (must be 100% valid) → an Import & Replace confirmation dialog → applied only after Save Changes. Export to back up current rules before importing, and use Download template for the correct column structure. |
6. Access
| # | Question | Answer |
|---|---|---|
| 6.1 | What is the difference between the Admin and Member roles? | WAF Admin can perform every action. WAF Member can only view (Domain List, Domain Detail, Security Policies, WAF Logs) and can still use Check Now. Change buttons are hidden for Member — + Add Domain, Delete domain, the WAF protection toggle, Update Certificate →, and all configuration buttons in Security Policies (Save Changes, Discard, add/edit/delete/Import rule, Apply Update, Restore). If you cannot see one of these buttons, you are likely a Member. |
7. Common errors
| # | Symptom | Common cause | Resolution |
|---|---|---|---|
| 7.1 | Domain is Unprotected | Certificate expired, or WAF protection is off | Update the certificate or turn WAF protection back on |
| 7.2 | "Invalid port for HTTPS." | Protocol https combined with Port 80 | Use a valid HTTPS port, or switch Protocol to http |
| 7.3 | "This domain already exists in your WAF." / "The root domain ... is already in use by another tenant." | Domain already registered in your tenant, or the root domain is used by another tenant | Use a different domain; subdomains are not blocked across tenants |
| 7.4 | "Certificate is invalid" on validation | The certificate does not cover the domain, is expired, or the key does not match | Upload a certificate that covers the domain and is in date, with a matching key |
| 7.5 | Provisioning Failed / "Origin health check failed..." | WAF cannot reach the origin | Check the origin is running, the address/port/protocol are correct, and the WAF egress IPs are whitelisted, then Retry Provisioning |
| 7.6 | Origin shows Unhealthy | The origin does not respond to the health check | Check origin, port/protocol, and egress IP whitelist, then click Check Now |