Overview

Deploying a Web Application Firewall is only the first step toward securing business-critical websites and applications. The effectiveness of application protection also depends on how securely the WAF itself is deployed.

If attackers can directly access backend servers or reach exposed management interfaces, they may bypass important security controls.

The GAJWAF Hardening the Deployment Playbook provides a structured, five-step procedure for securing GAJWAF deployments, restricting unauthorized access and validating that essential security controls are operating correctly.

The guiding principle is simple: No Way Around the WAF. No Way Into the Console.

The playbook focuses on ensuring that protected backend servers accept traffic only through GAJWAF and that administrative interfaces remain accessible exclusively to authorized management networks.

What You'll Learn

The playbook covers five essential deployment-hardening steps.

Step 1: Secure Network Access to GAJWAF

Learn how to configure network firewalls, AWS Security Groups or Azure Network Security Groups (NSGs) to restrict access to GAJWAF.

The guide explains the recommended network access controls:

  • Ports 80/443: Allow website traffic from authorized sources, such as internet clients or an upstream CDN.
  • Port 9443: Restrict GAJWAF management console access to trusted administrative networks.
  • Port 22: Restrict SSH access to authorized management networks or disable it when unnecessary.
  • Other Ports: Deny access unless explicitly required.

These controls help reduce the exposure of administrative services and unnecessary network interfaces.

Step 2: Prevent Direct Access to Backend Servers

A WAF cannot protect traffic that bypasses it.

The playbook explains how to configure backend firewall rules or cloud security groups so that protected application servers accept incoming application traffic only from GAJWAF.

This helps prevent attackers from accessing the origin server directly and circumventing application-layer inspection.

Step 3: Secure CDN and Front-Door Integrations

For deployments using a Content Delivery Network (CDN) or Azure Front Door, the playbook explains how to restrict traffic reaching GAJWAF.

The recommended approach includes:

  • Allowing incoming web traffic only from the configured CDN infrastructure.
  • Restricting access using approved CDN address ranges.
  • Validating CDN-specific instance identifiers where supported.

These measures help prevent unauthorized clients from bypassing the CDN and connecting directly to GAJWAF.

Step 4: Ensure Accurate and Trustworthy Client IP Identification

Accurate client IP identification is essential for effective application security.

GAJWAF uses client IP information for security decisions involving geographic restrictions, rate limiting and automatic bans.

The playbook explains how to:

  • Configure trusted proxies and CDN addresses.
  • Ensure backend web servers record the actual client IP.
  • Handle X-Forwarded-For headers correctly.
  • Prevent attackers from supplying spoofed client IP information through untrusted proxy headers.

Configuration Location: Settings → Network Trust & Lists → Trusted Proxies

Step 5: Harden the Management Console

Protecting GAJWAF's management interfaces is essential for preventing unauthorized configuration changes.

The playbook recommends:

  • Enabling management console authentication.
  • Requiring two-factor authentication (2FA).
  • Creating individual administrator accounts.
  • Rotating the initial bootstrap token after administrator accounts are established.
  • Keeping GAJWAF software updated.

Configuration Locations:

  • Settings → Management Console
  • Settings → Console Users
  • Settings → Software Update

These measures help strengthen administrative accountability and reduce the risk of unauthorized access.

Why This Playbook Matters

An improperly secured WAF deployment may leave critical gaps even when application security rules are correctly configured.

Following this playbook helps organizations:

  • Prevent direct access to protected backend servers.
  • Reduce the risk of attackers bypassing application security inspection.
  • Restrict administrative access to authorized networks.
  • Strengthen management console authentication.
  • Secure integrations with CDNs and cloud networking services.
  • Maintain accurate client IP information for security enforcement.
  • Reduce unnecessary network exposure.
  • Establish documented evidence of deployment-hardening controls.

Security Verification and Compliance Evidence

The playbook includes a seven-point hardening checklist to help administrators verify that:

  1. Management console and SSH access are restricted from the public internet.
  2. Backend servers cannot be accessed directly by unauthorized sources.
  3. CDN-only access restrictions are functioning where applicable.
  4. Backend applications record accurate client IP addresses.
  5. Management console login and two-factor authentication are enabled.
  6. Initial bootstrap credentials have been rotated.
  7. GAJWAF software is up to date.

Each control can be marked as Pass or Fail, providing a documented record of the deployment's security posture.

The checklist also includes fields for the deployment name, cloud platform, verifying administrator, verification date and next review date.

Completed checklists can be retained as supporting evidence for internal security assessments and compliance audits.

Download the Playbook

Document: GAJWAF Playbook – Hardening the Deployment
Document Version: 1.0
Document Type: Security Hardening and Operations Playbook
Publication: October 2026
Pages: 6
Intended Audience: GAJWAF Administrators and Network Teams

Attachment: GAJWAF_Playbook_Hardening_Deployment.pdf

Download the attached PDF for detailed deployment-hardening procedures, network access recommendations, management security settings and the seven-point verification checklist.

Related Documentation

For additional guidance, refer to:

  • GAJWAF Playbook – Compliance Reporting: Prepare security reports and supporting audit evidence.
  • GAJWAF Playbook – Zero-Downtime Cutover: Move application traffic to GAJWAF without unnecessary service disruption.
  • GAJWAF Troubleshooting & Support Manual: Investigate client IP identification and trusted-proxy configuration issues.
  • GAJWAF Quick Setup Guide – AWS & Azure: Configure cloud security groups, network access and initial management console authentication.

Technical Support

For assistance with GAJWAF deployment hardening, network configuration or management console security, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.