Skip to content

describe the new IBM connector version #2078

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnastasiaTWW wants to merge 1 commit into
base: master
Choose a base branch
from
Open

describe the new IBM connector version #2078

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/latest/installation/connectors/code-bundle-inventory.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,8 +237,18 @@ The current version can be found in the Wallarm policy file → `info.version`.

| Policy version | [Native Node version](../../updating-migrating/native-node/node-artifact-versions.md) |
| ------------------- | ------------------- |
| 1.0.2 | 0.13.3 or later in the 0.13.x series, or 0.14.1 or later |
| 1.0.1 | 0.13.3 or later in the 0.13.x series, or 0.14.1 or later |

### 1.0.2 (2026-06-22)

* Added the **monitoring (out-of-band)** traffic mode, selectable per policy with the `failSafeBlock` property

With `failSafeBlock: false`, the policy mirrors traffic to the Wallarm Node fire-and-forget and never blocks requests or responses. With `failSafeBlock: true` (default), the policy keeps the existing in-line (blocking) behavior. See [Traffic modes](ibm-api-connect.md#traffic-modes).
* Fixed `failSafeBlock` handling when the property is set as a boolean in the assembly YAML

Previously only the string form (`"true"`/`"false"`) was recognized, so a boolean value (`true`/`false`) set in the assembly was ignored.

### 1.0.1 (2025-05-20)

* Initial release
Expand Down
4 changes: 2 additions & 2 deletions docs/latest/installation/connectors/ibm-api-connect-for-wizard.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ x-ibm-configuration:
assembly:
execute:
- wallarm_pre:
version: 1.0.1
version: 1.0.2
title: wallarm_pre
wallarmNodeAddress: <WALLARM_NODE_URL>
- invoke:
Expand All @@ -63,7 +63,7 @@ x-ibm-configuration:
target-url: $(target-url)$(request.path)?$(request.query-string)
persistent-connection: true
- wallarm_post:
version: 1.0.1
version: 1.0.2
title: wallarm_post
wallarmNodeAddress: <WALLARM_NODE_URL>
...
Expand Down
41 changes: 34 additions & 7 deletions docs/latest/installation/connectors/ibm-api-connect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,34 @@

To integrate Wallarm with IBM API Connect, **deploy a Wallarm node externally** and **configure IBM API Gateway to proxy traffic to the node** for inspection.

The Wallarm connector for IBM API Connect supports only [in-line](../inline/overview.md) traffic analysis:
The Wallarm connector for IBM API Connect supports both **in-line (blocking)** and **monitoring (out-of-band)** traffic analysis. You select the mode per policy with the `failSafeBlock` property (see [Traffic modes](#traffic-modes)):

![](../../images/waf-installation/gateways/ibm/ibm-traffic-flow-inline.png)
=== "In-line traffic analysis"
In [in-line (blocking)](../inline/overview.md) mode (`failSafeBlock: true`, default), the policy sends each request and response to the Wallarm Node and waits for the verdict. Based on the Node [filtration mode](../../admin-en/configure-wallarm-mode.md), malicious requests can be blocked with `403`, providing real-time threat mitigation.

![](../../images/waf-installation/gateways/ibm/ibm-traffic-flow-inline.png)
=== "Monitoring traffic analysis"
In [monitoring (out-of-band)](../oob/overview.md) mode (`failSafeBlock: false`), traffic is mirrored to the Wallarm Node fire-and-forget without affecting the original flow. Malicious requests are logged in Wallarm Console but never blocked.

<!-- TODO: replace with an IBM-specific out-of-band traffic flow diagram -->
![](../../images/waf-installation/general-traffic-flow-for-connectors-oob.png)

!!! info "Requests matching API specification"
According to IBM API Connect behavior, only requests matching the defined OpenAPI paths will be inspected by the Wallarm Node.

## Traffic modes

Both Wallarm policies (`wallarm_pre` for requests and `wallarm_post` for responses) run in one of two modes, selected by the `failSafeBlock` property. Set the same value on both policies.

| | In-line (blocking) | Monitoring (out-of-band) |
| --- | --- | --- |
| `failSafeBlock` value | `true` (default) | `false` |
| Connector mode | `block` | `oob` |
| Analysis | Synchronous — the policy waits for the Node verdict before the request or response proceeds | Asynchronous — the request or response copy is sent to the Node fire-and-forget |
| Malicious traffic | Can be blocked with `403`, depending on the Node [filtration mode](../../admin-en/configure-wallarm-mode.md) | Logged in Wallarm Console, never blocked |
| Node unavailable or error | Request or response is blocked with `500` — protection fails closed | Logged and ignored, traffic proceeds — fails open |
| Added latency cap | Up to 60 seconds | Up to 3 seconds |

## Use cases

This solution is recommended for securing APIs published via IBM API Connect.
Expand Down Expand Up @@ -116,19 +137,21 @@ x-ibm-configuration:
assembly:
execute:
- wallarm_pre:
version: 1.0.1
version: 1.0.2
title: wallarm_pre
wallarmNodeAddress: <WALLARM_NODE_URL>
failSafeBlock: true # false = monitoring (out-of-band) mode
- invoke:
title: invoke
version: 2.0.0
verb: keep
target-url: $(target-url)$(request.path)?$(request.query-string)
persistent-connection: true
- wallarm_post:
version: 1.0.1
version: 1.0.2
title: wallarm_post
wallarmNodeAddress: <WALLARM_NODE_URL>
failSafeBlock: true # false = monitoring (out-of-band) mode
...
```

Expand All @@ -137,7 +160,9 @@ Supported properties in Wallarm policies:
| Parameter | Step name | Description | Required? |
| --------- | --------- | ----------- | --------- |
| `wallarmNodeAddress` | `wallarm_pre`, `wallarm_post` | Wallarm Node instance URL. | Yes |
| `failSafeBlock` | `wallarm_pre`, `wallarm_post` | If `true` (default), blocks the request or response if the Wallarm Node is unavailable or returns an error during request/response forwarding. | No |
| `failSafeBlock` | `wallarm_pre`, `wallarm_post` | Selects the [traffic mode](#traffic-modes). `true` (default) — in-line (blocking) mode: traffic is analyzed synchronously and can be blocked, and the request or response is blocked if the Wallarm Node is unavailable or returns an error. `false` — monitoring (out-of-band) mode: traffic is mirrored to the Node fire-and-forget and never blocked. | No |

To run the policies in monitoring (out-of-band) mode, set `failSafeBlock: false` on both the `wallarm_pre` and `wallarm_post` steps.

### 4. Publish your product with the updated API

Expand Down Expand Up @@ -193,19 +218,21 @@ x-ibm-configuration:
assembly:
execute:
- wallarm_pre:
version: 1.0.1
version: 1.0.2
title: wallarm_pre
wallarmNodeAddress: <WALLARM_NODE_URL>
failSafeBlock: true # false = monitoring (out-of-band) mode
- invoke:
title: invoke
version: 2.0.0
verb: keep
target-url: $(target-url)$(request.path)?$(request.query-string)
persistent-connection: true
- wallarm_post:
version: 1.0.1
version: 1.0.2
title: wallarm_post
wallarmNodeAddress: <WALLARM_NODE_URL>
failSafeBlock: true # false = monitoring (out-of-band) mode
activity-log:
enabled: true
success-content: activity
Expand Down
2 changes: 1 addition & 1 deletion docs/latest/installation/connectors/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Wallarm offers connectors for the following platforms:
| [Gloo Gateway](gloo.md) | In-line | Self-hosted |
| [Broadcom Layer7 API Gateways](layer7-api-gateway.md) | In-line | Self-hosted |
| [Fastly](fastly.md) | In-line, out-of-band | Security Edge, self-hosted |
| [IBM DataPower](ibm-api-connect.md) | In-line | Security Edge, self-hosted |
| [IBM DataPower](ibm-api-connect.md) | In-line, out-of-band | Security Edge, self-hosted |
| [Azure API Management](azure-api-management.md) | In-line, out-of-band | Security Edge, self-hosted |

If you couldn't find the connector you are looking for, please feel free to contact our [Sales team](mailto:sales@wallarm.com) to discuss your requirements and explore potential solutions.