> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/getting-started/protect-a-web-application-api.md).

# Protect a Web Application / API

Check Point WAF provides a configuration wizard that allows you to set up everything you need for basic protection of your web application. Once you completed the wizard you can set up a Check Point WAF's AppSec Gateway or Agent to enforce security.

## New Asset Wizard

#### Launch the configuration wizard:

* When logged in to the management portal, click the **Policy** option in the main navigation menu on the left. You should see the **Check Point Getting Started** page. 
* In the **Policy -> Getting Started** page, then click **New Asset**. The configuration wizard should open.

Follow these configuration steps in the **New Web Application / API** wizard: 

<figure><img src="/files/Wm294k776wPDuCMM9qza" alt="" width="375"><figcaption></figcaption></figure>

#### Step 1: Application Details

Complete the following details (which you have [prepared before](/getting-started/prepare-key-information.md)):

<img src="/files/BLtYJtixHNAm3O8TUiiG" alt="" width="375">

* **Name** - choose a clear distinguishable name for your application
* **Tags** (Optional) - can be used for searches
* **Application URLs for users** - configure at least one host address with optional port. Check Point WAF will protect these hosts. Examples:
  * `https://www.acme.com` (listen to inbound traffic to this address on all ports)
  * `http://www.acme.com:80` (only listen to inbound traffic to this address on port 80)
  * `https://www.acme.com/sales`
  * `https://sales.acme.com`
  * `https://172.20.20.4:3000`
* **Application URL for the reverse proxy function** - This URL is required, if the asset is secured by a Check Point WAF deployment in which the reverse proxy function is configured through the WAF Management. The Reverse Proxy translates the external URL, used by users, into an internal URL and forwards the request to it. This internal URL should be written here (See diagram).

{% hint style="success" %}
Multiple "**Application URL for the reverse proxy function"** to enable Load Balancing can be configured once asset has been created
{% endhint %}

{% hint style="success" %}
For VM, SaaS, or managed Docker deployments, you must provide the internal URL (application, API, or internal load balancer). This URL should be accessible to the Reverse Proxy but not exposed externally.&#x20;
{% endhint %}

#### Step 2: Platform and Deployment configuration

1. Choose a deployment method:

<figure><img src="/files/2BzrJaNc4mG4lB2VHkXd" alt="" width="375"><figcaption></figcaption></figure>

Check Point WAF can be deployed as:

* **A pre-packaged Gateway** (Virtual Machine for secure managed reverse proxy):
  * In AWS
  * In Azure
  * In VMware
* **WAF SaaS** - in supported regions world-wide (DNS configuration for your domain will change to its location)
* **Single Docker -** A pre-packaged docker containing a secure managed reverse proxy.\
  **Note** - a user can opt to manage the reverse proxy settings locally.
* **Dual Docker** - A separate Reverse Proxy/API server Docker + WAF Agent Docker
* **Linux** - An add-on to an existing/new NGINX Kubernetes Ingress&#x20;
* **Kubernetes** - An add-on to an existing/new supported Reverse Proxy/API Server.&#x20;

#### Step 3: Practices

Select the Practices that you want to enable and their Mode:

<figure><img src="/files/1DcfEH9XFcQW3xb5KMFP" alt="" width="375"><figcaption></figcaption></figure>

Modes:

* **Learn/Detect** - we recommend starting with this mode as it allows the Machine Learning engine to train and you can examine the system behavior, all while traffic is not affected.
* **Prevent** - in this mode traffic will be blocked if malicious traffic is found.
* **Disabled** in this mode the practice is not active.&#x20;

#### Step 4: GenAI Protection

Use the GenAI Protection Settings to define how your application or API is secured, if you've enabled the GenAI Protection Practice in the previous step.&#x20;

<figure><img src="/files/5M3OvVKJmtr8nmpZFU9B" alt="" width="375"><figcaption></figcaption></figure>

* **Request URI**: Enter the API endpoint for LLM prompts (e.g., /api/chat).
* **Prompt Location:** Specify where the prompt appears in the request body (e.g., body.prompt).
* **LLM Model**: Select the LLM your app uses.
* **Expected Prompts**: Choose One:
  * Wide range – many different prompt types.
  * Specific – narrow, domain-focused prompts.
* **Expected Users**:
  * All users (internal & external)
  * Internal roles (e.g., admin, sales)
  * External roles (e.g., customers, partners)
  * One specific role
* **Application Description:** Add a short note on your app’s purpose to improve protection accuracy.

#### Step 5: Learning

Define how the Machine Learning engine should distinguish between different API or Human users and who the users are that can be trusted.

<img src="/files/NvIsUONIw9nZEZ905Hk0" alt="" width="375">

1. Select the method by which different users will be distinguished from one another:

* **X-Forwarded-For Header** - When there is a Reverse Proxy or ALB between the Reverse Proxy the agent is running on, and the internet - the original source IP address cannot be seen on the networking level.\
  This option allows the Nano-Agent to identify the original source IP inside the X-Forwarded-For header. No additional parameters are required in the common case where a single Reverse Proxy/ALB is found before the agent's deployment.

{% hint style="info" %}
In the less common case, where there is more than 1 reverse proxy and/or ALB deployments before the reverse proxy with Check Point WAF:

* After the wizard is completed you must edit the created Web Application/API asset object.
* Add the IP addresses of the previous hops, to allow the distinction between them and the original source address.

This is explained in more details [here](/how-to/configure-contextual-machine-learning-for-best-accuracy.md).
{% endhint %}

* **Source IP** **Address** - The Nano-Agent uses the source IP address as the identifier. No additional parameters are required.

{% hint style="info" %}
Additional methods can be defined later by editing the Web Application/API asset object. These include:

* **Cookie Key** - when you select this option, you need to add the key name within the cookie whose value is used as the unique identifier of the original source.
* **HTTP Header** - when you select this option, you need to add the HTTP header name whose value is used as the unique identifier of the original source.
* **JWT Key** - Authenticated API calls send a JSON Web Token (JWT) received by authentication API. This JWT usually contains identifying field. When you select this option, the value of one of the JWT keys can be used as the unique identifier of the original source.
  {% endhint %}

2\. If you do not intend to use additional methods, you may already define trusted sources that serve as a baseline for comparison for *benign behavior*, and how many Users/Addresses must exhibit similar activity for it to really be considered benign by the learning model\
(Otherwise it is recommended to perform this step after the wizard has been completed by editing the asset and after changing the method by which users are distinguished).

![](/files/OnkKGyxCgTIqgn2urt6R)

#### Step 6: Certificate storage configuration and deployment instructions

If, during the previous step, a "New Profile" option was selected, then the "Certificates" page will also prompt a decision, relevant for all Check Point WAF's AppSec Gateways or WAF SaaS assets that will connect to this profile, regarding where the certificates for HTTPS traffic will be stored.

{% tabs %}
{% tab title="WAF SaaS" %}
For WAF SaaS deployment, you choose between a Check Point-managed certificate — **Wildcard** (covers all subdomains, the default) or **Specific** (a single domain) — or your own certificate (**BYOC**).

{% hint style="warning" %}
Completing the deployment requires actions after the wizard has ended, for each domain configured on the new asset:

1. If using a Check Point-managed certificate: proving ownership of the domain see Certificates Managed by Check Point.
2. If using your own certificate: uploading it see Bring Your Own Certificate (BYOC).
3. Configuring the DNS record for each domain so traffic to it will be routed to WAF SaaS.
   {% endhint %}

<figure><img src="/files/NVeIZfC8ZyB2Q4gX8OD5" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Appsec Gateways" %}
This decision is only relevant for the pre-packaged Gateway (Virtual Machine) option in AWS and Azure. In those cases it is possible to either select a secure vault in the relevant public cloud, or local storage. This configuration can be later changed by editing the created profile via **Cloud->Profiles.**

If the "Existing Profile" option was selected, then it will not be possible to choose a different configuration from what is already set in this profile.

Exact setup instructions for certificates will be available in the profile page.

For Check Point WAF on AWS or Azure, there are two methods for storing certificates and private keys. For all other deployments only the first is available:

* [On the WAF Gateway itself](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/gateway-virtual-machine/vmware/store-certificates-on-gateway) - a simple procedure allows you to upload the certificates and private keys directly to your gateway(s) using Secure Copy Protocol (SCP/SSH). No further configuration is required -  Check Point WAF will locate the local files automatically.
  * **Advantage**: you have full control of your secrets
  * **Disadvantage**: does not support automatic scaling
* If you are using Check Point WAF on [AWS ](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/gateway-virtual-machine/aws/store-certificates-in-aws)or [Azure ](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/gateway-virtual-machine/azure/store-certificates-in-azure)you can store secrets in secured vaults of these platforms and Check Point WAF's AppSec Gateway can fetch it from there.

<img src="https://waf-doc.inext.checkpoint.com/~gitbook/image?url=https%3A%2F%2F2760087783-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FEWA4nfgNrSRL8dA6Kap7%252Fuploads%252F6H2Hq2XunVIiSoWiD01g%252F5-Certificates-AWS.png%3Falt%3Dmedia%26token%3D4a16e423-4b67-4a0b-9e9c-bfb59f5014ca&#x26;width=768&#x26;dpr=3&#x26;quality=100&#x26;sign=21b8895a&#x26;sv=2" alt="" width="375">

<img src="https://waf-doc.inext.checkpoint.com/~gitbook/image?url=https%3A%2F%2F2760087783-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FEWA4nfgNrSRL8dA6Kap7%252Fuploads%252Firp25TnHbR36HbIl5R9T%252F5-Certificates-Azure.png%3Falt%3Dmedia%26token%3D098ae3bc-ccc6-4726-830d-da384319853a&#x26;width=768&#x26;dpr=3&#x26;quality=100&#x26;sign=5c4476ae&#x26;sv=2" alt="" width="375">
{% endtab %}
{% endtabs %}

#### Step 7: Reporting

During the Web Application onboarding it is possible to configure a new Report Trigger to send a summary report, based on your preferences to a list of email addresses or use an existing, pre-configured Report Trigger.

<figure><img src="/files/6w9REsSIWdDW7hlPn5rT" alt="" width="375"><figcaption></figcaption></figure>

#### Step 7: Summary

Review the configuration summary and choose how you would like to proceed.

<figure><img src="/files/QCjq3BmJZH2gn0zi2Uf8" alt="" width="375"><figcaption></figcaption></figure>

By keeping the default selections and clicking **Done**, you can Publish & Enforce your settings and proceed to the **Profile** page, which includes instructions for deployment of an Check Point WAF's AppSec Gateway, WAF SaaS or Agent.&#x20;

You can also choose Advanced Settings to explore additional features and later proceed with enforcement point deployment.

### Deploy Enforcement Point - Gateway or Agent

You are minutes away from protecting your Web Application. The last step is to deploy an Enforcement Point. See instructions here:

{% content-ref url="/spaces/EWA4nfgNrSRL8dA6Kap7/pages/SK2esLt6SM0XOzN5wy9L" %}
[Deploy Enforcement Point](/getting-started/deploy-enforcement-point.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://waf-doc.inext.checkpoint.com/getting-started/protect-a-web-application-api.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.