Traffic Flow

The exact enabled modules depend on configuration and license capabilities. A typical request follows this path:

graph TD
  A[Client request] --> B[Protocol hardening]
  B --> C[L4 ACL]
  C --> D[Trusted proxy / client IP resolution]
  D --> E[GEO policy]
  E --> F[Rate limits]
  F --> G[Route selection]
  G --> H[WAF policy]
  H --> I[Backend pool]
  I --> J[Application response]
  J --> K[Response logging]

Decision order

1. Protocol hardening rejects malformed or unsafe HTTP patterns before deeper inspection.
2. L4 ACL allows or denies source networks.
3. Client identity resolves the real client IP when trusted proxies are configured.
4. GEO policy evaluates country rules if GEO is enabled.
5. Rate limits apply global, client, and rule-based limits.
6. Routes match host and path to a backend pool.
7. WAF evaluates request target, headers, query, and body.
8. Backend forwarding sends allowed traffic to the selected upstream.
9. Logging records allowed, blocked, rate-limited, and error events.

Best practice

Start with a small set of explicit host/path routes. Keep default actions strict in production, and add allow rules deliberately. Use monitor or log-only rules before enforcing newly introduced high-impact WAF controls.