From c96384284512f84e6e556b79b20f7fbf3cfa37be Mon Sep 17 00:00:00 2001 From: AnastasiaTWW <61460069+AnastasiaTWW@users.noreply.github.com> Date: Mon, 22 Jun 2026 17:53:24 +0400 Subject: [PATCH] describe the new IBM connector version --- .../connectors/code-bundle-inventory.md | 10 +++++ .../connectors/ibm-api-connect-for-wizard.md | 4 +- .../connectors/ibm-api-connect.md | 41 +++++++++++++++---- .../installation/connectors/overview.md | 2 +- 4 files changed, 47 insertions(+), 10 deletions(-) diff --git a/docs/latest/installation/connectors/code-bundle-inventory.md b/docs/latest/installation/connectors/code-bundle-inventory.md index af973f00a..e0b8e0730 100644 --- a/docs/latest/installation/connectors/code-bundle-inventory.md +++ b/docs/latest/installation/connectors/code-bundle-inventory.md @@ -237,8 +237,18 @@ The current version can be found in the Wallarm policy file → `info.version`. | Policy version | [Native Node version](../../updating-migrating/native-node/node-artifact-versions.md) | | ------------------- | ------------------- | +| 1.0.2 | 0.13.3 or later in the 0.13.x series, or 0.14.1 or later | | 1.0.1 | 0.13.3 or later in the 0.13.x series, or 0.14.1 or later | +### 1.0.2 (2026-06-22) + +* Added the **monitoring (out-of-band)** traffic mode, selectable per policy with the `failSafeBlock` property + + With `failSafeBlock: false`, the policy mirrors traffic to the Wallarm Node fire-and-forget and never blocks requests or responses. With `failSafeBlock: true` (default), the policy keeps the existing in-line (blocking) behavior. See [Traffic modes](ibm-api-connect.md#traffic-modes). +* Fixed `failSafeBlock` handling when the property is set as a boolean in the assembly YAML + + Previously only the string form (`"true"`/`"false"`) was recognized, so a boolean value (`true`/`false`) set in the assembly was ignored. + ### 1.0.1 (2025-05-20) * Initial release diff --git a/docs/latest/installation/connectors/ibm-api-connect-for-wizard.md b/docs/latest/installation/connectors/ibm-api-connect-for-wizard.md index b7a35c4fe..3e156b632 100644 --- a/docs/latest/installation/connectors/ibm-api-connect-for-wizard.md +++ b/docs/latest/installation/connectors/ibm-api-connect-for-wizard.md @@ -53,7 +53,7 @@ x-ibm-configuration: assembly: execute: - wallarm_pre: - version: 1.0.1 + version: 1.0.2 title: wallarm_pre wallarmNodeAddress: - invoke: @@ -63,7 +63,7 @@ x-ibm-configuration: target-url: $(target-url)$(request.path)?$(request.query-string) persistent-connection: true - wallarm_post: - version: 1.0.1 + version: 1.0.2 title: wallarm_post wallarmNodeAddress: ... diff --git a/docs/latest/installation/connectors/ibm-api-connect.md b/docs/latest/installation/connectors/ibm-api-connect.md index e95c2904c..37d25d9f9 100644 --- a/docs/latest/installation/connectors/ibm-api-connect.md +++ b/docs/latest/installation/connectors/ibm-api-connect.md @@ -16,13 +16,34 @@ To integrate Wallarm with IBM API Connect, **deploy a Wallarm node externally** and **configure IBM API Gateway to proxy traffic to the node** for inspection. -The Wallarm connector for IBM API Connect supports only [in-line](../inline/overview.md) traffic analysis: +The Wallarm connector for IBM API Connect supports both **in-line (blocking)** and **monitoring (out-of-band)** traffic analysis. You select the mode per policy with the `failSafeBlock` property (see [Traffic modes](#traffic-modes)): -![](../../images/waf-installation/gateways/ibm/ibm-traffic-flow-inline.png) +=== "In-line traffic analysis" + In [in-line (blocking)](../inline/overview.md) mode (`failSafeBlock: true`, default), the policy sends each request and response to the Wallarm Node and waits for the verdict. Based on the Node [filtration mode](../../admin-en/configure-wallarm-mode.md), malicious requests can be blocked with `403`, providing real-time threat mitigation. + + ![](../../images/waf-installation/gateways/ibm/ibm-traffic-flow-inline.png) +=== "Monitoring traffic analysis" + In [monitoring (out-of-band)](../oob/overview.md) mode (`failSafeBlock: false`), traffic is mirrored to the Wallarm Node fire-and-forget without affecting the original flow. Malicious requests are logged in Wallarm Console but never blocked. + + + ![](../../images/waf-installation/general-traffic-flow-for-connectors-oob.png) !!! info "Requests matching API specification" According to IBM API Connect behavior, only requests matching the defined OpenAPI paths will be inspected by the Wallarm Node. +## Traffic modes + +Both Wallarm policies (`wallarm_pre` for requests and `wallarm_post` for responses) run in one of two modes, selected by the `failSafeBlock` property. Set the same value on both policies. + +| | In-line (blocking) | Monitoring (out-of-band) | +| --- | --- | --- | +| `failSafeBlock` value | `true` (default) | `false` | +| Connector mode | `block` | `oob` | +| Analysis | Synchronous — the policy waits for the Node verdict before the request or response proceeds | Asynchronous — the request or response copy is sent to the Node fire-and-forget | +| Malicious traffic | Can be blocked with `403`, depending on the Node [filtration mode](../../admin-en/configure-wallarm-mode.md) | Logged in Wallarm Console, never blocked | +| Node unavailable or error | Request or response is blocked with `500` — protection fails closed | Logged and ignored, traffic proceeds — fails open | +| Added latency cap | Up to 60 seconds | Up to 3 seconds | + ## Use cases This solution is recommended for securing APIs published via IBM API Connect. @@ -116,9 +137,10 @@ x-ibm-configuration: assembly: execute: - wallarm_pre: - version: 1.0.1 + version: 1.0.2 title: wallarm_pre wallarmNodeAddress: + failSafeBlock: true # false = monitoring (out-of-band) mode - invoke: title: invoke version: 2.0.0 @@ -126,9 +148,10 @@ x-ibm-configuration: target-url: $(target-url)$(request.path)?$(request.query-string) persistent-connection: true - wallarm_post: - version: 1.0.1 + version: 1.0.2 title: wallarm_post wallarmNodeAddress: + failSafeBlock: true # false = monitoring (out-of-band) mode ... ``` @@ -137,7 +160,9 @@ Supported properties in Wallarm policies: | Parameter | Step name | Description | Required? | | --------- | --------- | ----------- | --------- | | `wallarmNodeAddress` | `wallarm_pre`, `wallarm_post` | Wallarm Node instance URL. | Yes | -| `failSafeBlock` | `wallarm_pre`, `wallarm_post` | If `true` (default), blocks the request or response if the Wallarm Node is unavailable or returns an error during request/response forwarding. | No | +| `failSafeBlock` | `wallarm_pre`, `wallarm_post` | Selects the [traffic mode](#traffic-modes). `true` (default) — in-line (blocking) mode: traffic is analyzed synchronously and can be blocked, and the request or response is blocked if the Wallarm Node is unavailable or returns an error. `false` — monitoring (out-of-band) mode: traffic is mirrored to the Node fire-and-forget and never blocked. | No | + +To run the policies in monitoring (out-of-band) mode, set `failSafeBlock: false` on both the `wallarm_pre` and `wallarm_post` steps. ### 4. Publish your product with the updated API @@ -193,9 +218,10 @@ x-ibm-configuration: assembly: execute: - wallarm_pre: - version: 1.0.1 + version: 1.0.2 title: wallarm_pre wallarmNodeAddress: + failSafeBlock: true # false = monitoring (out-of-band) mode - invoke: title: invoke version: 2.0.0 @@ -203,9 +229,10 @@ x-ibm-configuration: target-url: $(target-url)$(request.path)?$(request.query-string) persistent-connection: true - wallarm_post: - version: 1.0.1 + version: 1.0.2 title: wallarm_post wallarmNodeAddress: + failSafeBlock: true # false = monitoring (out-of-band) mode activity-log: enabled: true success-content: activity diff --git a/docs/latest/installation/connectors/overview.md b/docs/latest/installation/connectors/overview.md index 330392637..351bb11d0 100644 --- a/docs/latest/installation/connectors/overview.md +++ b/docs/latest/installation/connectors/overview.md @@ -39,7 +39,7 @@ Wallarm offers connectors for the following platforms: | [Gloo Gateway](gloo.md) | In-line | Self-hosted | | [Broadcom Layer7 API Gateways](layer7-api-gateway.md) | In-line | Self-hosted | | [Fastly](fastly.md) | In-line, out-of-band | Security Edge, self-hosted | -| [IBM DataPower](ibm-api-connect.md) | In-line | Security Edge, self-hosted | +| [IBM DataPower](ibm-api-connect.md) | In-line, out-of-band | Security Edge, self-hosted | | [Azure API Management](azure-api-management.md) | In-line, out-of-band | Security Edge, self-hosted | If you couldn't find the connector you are looking for, please feel free to contact our [Sales team](mailto:sales@wallarm.com) to discuss your requirements and explore potential solutions.