In some more complex configurations, you may need WAF-as-a-Service to accept traffic on a single IP and/or port, but apply different security policies to it or send it to different backend servers, depending on attributes of that traffic, including:

• Hostname

• URL path

• Port

• Extended Match

• Priority (in case multiple rules match)

This is now supported on WAF-as-a-Service using main applications and sub-applications:

• The main application accepts traffic on its Endpoints, and applies certain global policies (like Request Limits).

• Sub-applications are associated with a main application, and can match traffic based on the criteria above. (Sub-applications do not have Endpoints.)

• Once a sub-application is matched, its own policies are applied, and traffic is sent to that sub-application’s backend servers.

Sub-applications can be configured by Barracuda Support - contact us if you need this configuration. Once configured by Barracuda Support, you will see the configuration reflected in the UI.

If you have used our WAF Appliance, you will recognize this feature as Content Rules or Content Routing. For more details, refer to Content-Based Rules.