OCI Web Application Firewall (WAF) - Steps for a Quick Implementation

Table of Contents

    Oracle Web Application Firewall (WAF) is a cloud-based, PCI-compliant, global security service that protects applications from malicious and unwanted internet traffic. Oracle Cloud Infrastructure WAF can protect any internet-facing endpoint, providing consistent rule enforcement across a customer's applications.

    WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection, and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable bots to enter. Access rules can be limited based on geography or the signature of the request.

    The global Security Operations Center (SOC) will continually monitor the internet threat landscape acting as an extension of your IT infrastructure.

    Create WAF Policy> - Creating a policy without rules enabled to route traffic through the WAF ensures that there are no regressions by having a reverse proxy in front of the application.

    Update CNAME in DNS - Update the CNAME to OCI DNS zone or on-prem DNS A record based on the provider.

    Map OCI LB hostname to OCI WAF CNAME

    Upload certificate to WAF - Upload certificate to WAF

    Open WAF policy and go to settings, general settings then select HTTPS support to attach the uploaded certificate.

    Test Your Application> - Open a chrome browser and Enter the FQDN of the website protected by WAF. Inspect HTTP Response Headers to see if traffic is flowing through WAF. Some HTTP Response Headers to look for are (X-Cdn: Served-By-Zenedge or Server: ZENEDGE)

    Click the name of your WAF Policy, under Logs, click View. Logs for the WAF policy appear.

    Protection Rules - WAF contains over 250 pre-defined protection rules. The rules match web traffic to rule conditions and determine the action to be taken when the conditions are met. Protection Rule Settings allow you to define the parameters for enforcement any time a protection rule is matched.

    Access Control - Administrators can add and configure their own access controls based on geolocation data, whitelisted and blacklisted IP addresses, and HTTP URL and header characteristics.

    Threat Intelligence> - >Oracle WAF takes feeds from a number of threat intelligence providers to ensure it has the latest, up-to-date information on suspicious IP addresses.

    Bot Management> - >Leverages an advanced set of challenges including JavaScript verification, CAPTCHA, device fingerprinting, and human interaction algorithms to identify and block malicious bot traffic.

    Additional Security> - >Configure the servers to accept traffic from the WAF servers. Configure origin's ingress rules to only accept connections from the following CIDR ranges in NSG and attach to the VNIC.

    CIDR Ranges


    1. Oracle Cloud Infrastructure (OCI)
    2. Web Application Firewall (WAF)

    Document Versioning




    Document Version

    Created by

    Gopinath Samraj



    Reviewed by

    Rahul Somraj



    Approved by

    Mohammed Jiyash



    To learn more about OCI WAF or you need help with setting up your firewall contact us at

    See The Team In Action

    Upcoming Events

    Virtual event
    October 4, 2023
    04:00 PM ET
    • Non-technical
    • Peoplesoft reporting

    Kibana for CS - Deep Dive

    HEUG East - North Carolina
    October 9, 2023
    09:00 AM ET
    • Everyone
    • Peoplesoft

    HEUG East - North Carolina

    Virtual event
    October 11, 2023
    04:00 PM ET
    • Technical
    • Peoplesoft testing

    Webinar: Mastering PTF - Tips and Tricks for CS

    Virtual event
    October 18, 2023
    02:00 PM ET
    • Everyone
    • Erp

    Back Office Evolution: Modernizing ERP Systems

    Virtual event
    October 23, 2023
    04:00 PM ET
    • Everyone
    • Peoplesoft

    Virtual Conference: RECONNECT Dive Deep

    Reach Out

    Ready to Connect?

    Please fill the following form, we will get back to you within a business day.

    Contact Form

    Contact Us

    Schedule an
    Appointment Now

    Meet with an Astute expert today, we would love to help you think about your enterprise applications, and how the cloud can deliver greater value to your customers.