diff --git a/docs/5.0/installation/inline/keepalive.md b/docs/5.0/installation/inline/keepalive.md new file mode 100644 index 0000000000..f9106951a6 --- /dev/null +++ b/docs/5.0/installation/inline/keepalive.md @@ -0,0 +1 @@ +--8<-- "latest/installation/security-edge/inline/keepalive.md" \ No newline at end of file diff --git a/docs/6.x/installation/security-edge/inline/keepalive.md b/docs/6.x/installation/security-edge/inline/keepalive.md new file mode 100644 index 0000000000..f9106951a6 --- /dev/null +++ b/docs/6.x/installation/security-edge/inline/keepalive.md @@ -0,0 +1 @@ +--8<-- "latest/installation/security-edge/inline/keepalive.md" \ No newline at end of file diff --git a/docs/7.x/installation/security-edge/inline/keepalive.md b/docs/7.x/installation/security-edge/inline/keepalive.md new file mode 100644 index 0000000000..f9106951a6 --- /dev/null +++ b/docs/7.x/installation/security-edge/inline/keepalive.md @@ -0,0 +1 @@ +--8<-- "latest/installation/security-edge/inline/keepalive.md" \ No newline at end of file diff --git a/docs/latest/installation/security-edge/inline/deployment.md b/docs/latest/installation/security-edge/inline/deployment.md index 20d7c1ca4a..750071d9bc 100644 --- a/docs/latest/installation/security-edge/inline/deployment.md +++ b/docs/latest/installation/security-edge/inline/deployment.md @@ -115,6 +115,10 @@ To restrict your origins to trusted traffic only, allow Edge Node connections us ![!](../../../images/waf-installation/security-edge/inline/general-settings-section.png) +**Using custom keepalive settings** + +(Optional) To use [custom keepalive settings](../inline/keepalive.md), select the corresponding option. + ## 3. Certificates * If the Edge Inline Node is deployed as a direct, Internet-facing solution, Wallarm requires certificates to securely route traffic to your origin servers. Certificates are issued based on the DNS zones specified in this section. diff --git a/docs/latest/installation/security-edge/inline/keepalive.md b/docs/latest/installation/security-edge/inline/keepalive.md new file mode 100644 index 0000000000..5a99f52478 --- /dev/null +++ b/docs/latest/installation/security-edge/inline/keepalive.md @@ -0,0 +1,36 @@ +# Custom Keepalive Settings + +Keepalive settings control how upstream connections are reused to improve performance in Edge Inline deployments. + +## Requirements + +Keepalive settings are supported starting from Edge Node version 6.7.4-1. + +## How it works + +These settings define the behavior of idle connections between the Edge Inline Node and the protected origin servers. By reusing TCP connections, they reduce connection overhead and improve response times for repeated requests. + +The Edge Inline deployment uses the following [keepalive settings](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive): + +| Setting | Description | Default | +| --------- | ----------- | ------- | +| `keepalive` | The maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. [More details](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive) | `32` | +| `keepalive_requests` | The maximum number of requests that can be served through one keepalive connection. After the maximum number of requests is made, the connection is closed. [More details](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_requests) | `1000` | +| `keepalive_time` | The maximum time during which requests can be processed through one keepalive connection. [More details](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_time) | `1h` | +| `keepalive_timeout` | A timeout during which an idle keepalive connection to an upstream server will stay open. [More details](https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_timeout) | `60s` | + +## Using custom keepalive settings + +If needed, you can enable custom keepalive settings and adjust their values to fit your workload. + +When configuring custom keepalive settings, it is important to choose values carefully to avoid exhausting server resources. Consider the following points: + +* Reducing `keepalive_timeout` can free up resources, but it may reduce the benefits of TCP connection reuse. +* Increasing `keepalive_requests` allows more requests over the same connection but keeps connections open longer. + +Keepalive may not be suitable in these cases: + +* The server has limited memory resources. +* The website handles a very high number of clients with few repeat requests, where connection reuse provides little benefit. + +![!](../../../images/waf-installation/security-edge/inline/keepalive.png) \ No newline at end of file diff --git a/images/waf-installation/security-edge/inline/general-settings-section.png b/images/waf-installation/security-edge/inline/general-settings-section.png index c7e5b06df8..781fecb534 100644 Binary files a/images/waf-installation/security-edge/inline/general-settings-section.png and b/images/waf-installation/security-edge/inline/general-settings-section.png differ diff --git a/images/waf-installation/security-edge/inline/keepalive.png b/images/waf-installation/security-edge/inline/keepalive.png new file mode 100644 index 0000000000..a92e5f1ce3 Binary files /dev/null and b/images/waf-installation/security-edge/inline/keepalive.png differ diff --git a/mkdocs-5.0.yml b/mkdocs-5.0.yml index 4cfc0e0f52..324c6a16c3 100644 --- a/mkdocs-5.0.yml +++ b/mkdocs-5.0.yml @@ -150,6 +150,7 @@ nav: - Custom Block Page: installation/security-edge/inline/custom-block-page.md - Host Redirection: installation/security-edge/inline/host-redirection.md - mTLS Configuration: installation/security-edge/inline/mtls.md + - Custom Keepalive Settings: installation/security-edge/inline/keepalive.md - Multi-Region: installation/security-edge/inline/multi-region.md - NGINX Overrides: installation/security-edge/inline/nginx-overrides.md - Upgrade & Management: installation/security-edge/inline/upgrade-and-management.md @@ -442,4 +443,4 @@ nav: - Glossary: glossary-en.md - Data Retention Policy: about-wallarm/data-retention-policy.md - Shared Responsibility Model: about-wallarm/shared-responsibility.md - - SLA: sla.md + - SLA: sla.md \ No newline at end of file diff --git a/mkdocs-6.x.yml b/mkdocs-6.x.yml index c0eff9a982..1634615c5c 100644 --- a/mkdocs-6.x.yml +++ b/mkdocs-6.x.yml @@ -170,6 +170,7 @@ nav: - Custom Block Page: installation/security-edge/inline/custom-block-page.md - Host Redirection: installation/security-edge/inline/host-redirection.md - mTLS Configuration: installation/security-edge/inline/mtls.md + - Custom Keepalive Settings: installation/security-edge/inline/keepalive.md - Multi-Region: installation/security-edge/inline/multi-region.md - NGINX Overrides: installation/security-edge/inline/nginx-overrides.md - Upgrade & Management: installation/security-edge/inline/upgrade-and-management.md @@ -462,4 +463,4 @@ nav: - Glossary: glossary-en.md - Data Retention Policy: about-wallarm/data-retention-policy.md - Shared Responsibility Model: about-wallarm/shared-responsibility.md - - SLA: sla.md + - SLA: sla.md \ No newline at end of file diff --git a/mkdocs-7.x.yml b/mkdocs-7.x.yml index ea2aad126a..ec1a814a36 100644 --- a/mkdocs-7.x.yml +++ b/mkdocs-7.x.yml @@ -169,6 +169,7 @@ nav: - Custom Block Page: installation/security-edge/inline/custom-block-page.md - Host Redirection: installation/security-edge/inline/host-redirection.md - mTLS Configuration: installation/security-edge/inline/mtls.md + - Custom Keepalive Settings: installation/security-edge/inline/keepalive.md - Multi-Region: installation/security-edge/inline/multi-region.md - NGINX Overrides: installation/security-edge/inline/nginx-overrides.md - Upgrade & Management: installation/security-edge/inline/upgrade-and-management.md