CloudGuard WAF
  • Documentation Overview
  • What is CloudGuard WAF?
  • Getting started
    • Prepare key information
    • Log in to the Infinity Portal
    • Protect a Web Application / API
    • Deploy Enforcement Point
      • Gateway/Virtual Machine
        • AWS
          • Store Certificates in AWS
          • Store certificates on Gateway
        • Azure
          • Store Certificates in Azure
          • Store Certificates on Gateway
        • VMware
          • Store Certificates on Gateway
          • Configure networking in VMware Deployments
      • WAF as a Service
        • Certificates Managed by Check Point
        • Bring Your Own Certificate
      • Kubernetes Ingress
        • Kong Application Security
        • Istio Application Security
      • Docker
        • Single Docker
          • Deployment using 'docker' command
            • Store Certificates Locally on Docker
          • Deployment in Azure App Services
        • Dual Docker: NGINX/Kong/Envoy + Security Agent
      • Linux / NGINX / Kong
    • Monitor Events
  • Concepts
    • Gateways & Agents
    • Management & Automation
    • Security Practices
    • Contextual Machine Learning
  • Additional Security Engines
    • Anti-Bot
    • API Protection
      • API Discovery
      • Track API Discovery Learning
      • Enforce API Schema
    • File Security
    • Intrusion Prevention System (IPS)
    • Rate Limit
    • Snort Rules
  • SETUP INSTRUCTIONS
    • Setup Custom Rules and Exceptions
    • Setup Web User Response Pages
    • Setup Log Triggers
    • Setup Report Triggers
    • Setup Notification Triggers
    • Setup Behavior Upon Failure
    • Setup Agent Upgrade Schedule
  • HOW TO
    • Edit Web Application/API Settings
    • Edit Reverse Proxy Advanced Settings for a Web Asset
    • Protect an existing production site with CloudGuard WAF's Gateway
    • View Policy of all your Web Applications/APIs
    • Add Data Loss Prevention (DLP) rules
    • Configure Contextual Machine Learning for Best Accuracy
    • Track Agent Status
    • Track Learning and Move from Learn/Detect to Prevent
    • Rotate profile authentication token
    • Upgrade your Reverse Proxy when a Linux/NGINX agent is installed
    • Use Terraform to Manage CloudGuard WAF
    • Authorize Temporary Access for Check Point Support
    • Restrict Access to Backend Servers from CloudGuard WAF as a Service IPs Only
  • Troubleshooting
    • WAF Gateway / Virtual Machine
      • Azure
        • "Unable to find a tag containing the vault's name in the VMSS" Error
        • How To: Configure Key Vault for a Single Gateway
      • NGINX Error: Upstream Sent Too Big Header While Reading Response Header from Upstream
      • How To: Compare Between the Gateway's Certificate and the Upstream Certificate
    • Linux
      • SELinux: Checking Status and Disabling
    • WAF as a Service
      • Certificate Validation Failed: Adjusting CAA Record
      • How To: Redirect a Root Domain to a Subdomain Protected by WAF SaaS
      • How To: Extend Connection Timeout to Upstream
      • How To: Update Expired Certificates
  • references
    • Agent CLI
    • Management API
    • Event Query Language
    • Writing Snort Signatures
    • Events/Logs Schema
    • CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Email Address Buffer Overflows (HIGH)
    • CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974: Ingress NGINX Controller RCE (Critical)
  • Resources
    • GitHub
    • Docker Hub
Powered by GitBook
On this page
  • Setup
  • How does it work?
  • Traffic based-Fail-Open
  • Agent CPU based Fail-Open
  • Critical Errors

Was this helpful?

  1. SETUP INSTRUCTIONS

Setup Behavior Upon Failure

PreviousSetup Notification TriggersNextSetup Agent Upgrade Schedule

Last updated 3 months ago

Was this helpful?

CloudGuard WAF implements a Fail-Open mechanism designed to allow no interruption to traffic in case of load or errors. The mechanism is enabled by default and can be configured separately for each agent profile through the profile page.

Setup

This configuration is available on the Agents' Profile level and will apply to all agents using this profile's authentication token for initial registration.

To configure the behavior upon failure, navigate to Policy->Profiles->[select your profile]. See the Behavior Upon Failure section:

How does it work?

Traffic based-Fail-Open

  • For each client request and server response, the attachment waits for a total of 3000 milliseconds for a benign/malicious verdict (the wait time for each portion, such as headers, URL, etc.) is up to 150 milliseconds). If a a verdict doesn't arrive, the request/response is allowed to pass. This state is called fail-open.

  • In case of consecutive fail-opens the system enters a state called transparency mode in order not to damage connectivity to the upstream server.

  • There are three levels of transparency mode fail-open:

    • Level 1: If there is failure to inspect 5 http requests in 20 seconds interval, system enters global fail-open mode for 1 minute and moves the threshold to level 2.

    • Level 2: If there is failure to inspect 5 http requests in 20 seconds interval, system enters fail-open mode for 5 minutes and moves the threshold to level 3. In any other case system falls back to level 1.

    • Level 3: If there is failure to inspect 5 http requests in 20 seconds interval, system enters global fail-open mode for 10 minutes. In any other case system falls back to level 1.

Agent CPU based Fail-Open

In addition to the above traffic based mechanism, the system also monitors the Agent CPU level. The CPU utilization is sampled every 5 seconds, if 6 consecutive samples (30 seconds) were above 85% we enter fail open mode until we identify 6 consecutive samples below 60%.

Critical Errors

In case of any internal error in the attachment or agent during http inspection traffic will be allowed by default.

Notification logs about critical alerts will be shown in a .

Notifications logs view