Product Documentation
ADC
14.1-Current Release 13.1 12.1
View PDF

Integrate Fastly NextGen WAF with NetScaler

October 15, 2025
Contributed by: 
C

This feature enables users to integrate Fastly’s NextGen (Signal Sciences) WAF with NetScaler using a module-agent deployment topology. NetScaler accesses incoming request data and passes it to the NextGen WAF agent for inspection through remote procedure calls (RPC) over TCP. Based on the agent’s response, NetScaler blocks, allows, or redirects requests.

Key benefits

The integration of Fastly NextGen (Signal Sciences) WAF agent with NetScaler provides the following benefits to enterprise organizations:

  • Inline application protection: Inspects traffic in real time to block threats before they reach your applications.
  • Lightweight and scalable deployment: Integrates easily with existing infrastructure and scales to meet enterprise needs.
  • Consistent security posture: Applies uniform security policies across environments for reliable protection.
  • Enhanced observability and analytics: Provides detailed insights into traffic and threats for improved monitoring and response.
  • Improved enterprise agility: Enables rapid adaptation to evolving security requirements and business needs.

Module-agent deployment workflow

The following diagram illustrates the architecture of the Fastly NextGen WAF integration with NetScaler.

NetScaler architecture diagram

  • NetScaler acts as a module that performs RPC calls to the Signal Sciences Agent using MessagePack-encoded request/response.

  • NetScaler suspends HTTP(S) requests until the RPC response is received. If the response is positive, the request is forwarded to the origin server.

  • RPC calls are also performed on the HTTP(S) response path, but response forwarding to the client is not blocked while waiting for the RPC response.

Content Inspection and Web Assembly (WASM):

  • The Content Inspection feature allows NetScaler to send traffic data to external devices for inspection.
  • The WASM module converts decrypted traffic into the MessagePack format required by the Signal Sciences Agent.
  • The SigSci WASM module includes functions for encoding and decoding MessagePack data and is packaged with the NetScaler build, along with its signature file.
  • The module loads on NetScaler only after successful signature verification. Currently, only the SigSci WASM module can be loaded.

Configure NetScaler to integrate with the Fastly NextGen WAF by using the CLI

To configure the integration, follow these CLI steps:

  1. Enable content inspection feature.

    enable feature CI
<!--NeedCopy-->

  2. Add the SigSci WASM module and its corresponding signature file.

    add wasm module <user-defined-name> -moduleFile ns_sigsci.wasm -signatureFile ns_sigsci_wasm.sig
<!--NeedCopy-->

    Example:

    add wasm module ns_fastly -moduleFile ns_sigsci.wasm -signatureFile ns_sigsci_wasm.sig
<!--NeedCopy-->

  3. Create content inspection WASM profiles for both request and response.

    add contentinspection wasmProfile <user-defined-name-response> -maxBodyLen 0 –wasmModule <wasm-module-name>

add contentinspection wasmProfile <user-defined-name-request> -wasmModule <wasm-module-name>
<!--NeedCopy-->

    Example:

    add contentinspection wasmProfile ciresprof -maxBodyLen 0 -wasmModule ns_fastly

add contentinspection wasmProfile cireqprof -wasmModule ns_fastly
<!--NeedCopy-->

  4. Add the service that communicates with the Fastly NextGen WAF agent over TCP.

    add service <user-defined-name> <IP> TCP <port>
<!--NeedCopy-->

    Example:

    add service fastly_agent 1.2.3.4 TCP 9999
<!--NeedCopy-->

  5. Add content inspection action for both request and response.

    add contentinspection action <user-defined-name-response> -type WASM –wasmProfileName <content-inspection-wasm-profile-name-response> -serverName <service-name> 

add contentinspection action <user-defined-name-request> -type WASM –wasmProfileName <content-inspection-wasm-profile-name-request> -serverName <service-name>
<!--NeedCopy-->

    Example:

    add contentinspection action ciresact -type WASM -wasmProfileName ciresprof -serverName fastly_agent 

add contentinspection action cireqact -type WASM -wasmProfileName cireqprof -serverName fastly_agent
<!--NeedCopy-->

  6. Add content inspection policy for both request and response actions.

    add contentinspection policy <user-defined-name-request> -rule true –action <content-inspection-action-request> 

add contentinspection policy <user-defined-name-response> -rule true –action <content-inspection-action-response>
<!--NeedCopy-->

    Example:

    add contentinspection policy cireqpol -rule true -action cireqact 

add contentinspection policy cirespol -rule true -action ciresact
<!--NeedCopy-->

  7. Bind the content inspection policy for both request and response to the virtual server.

    bind lb vserver <user-defined-name> -policyname <content-inspection-policy-request> -priority <user-defined> -type REQUEST 

bind lb vserver <user-defined-name> -policyname <content-inspection-policy-response> -priority <user-defined> -type RESPONSE 
<!--NeedCopy-->

    Example:

    bind lb vserver v1 -policyname cireqpol -priority 10 -type REQUEST 

bind lb vserver v1 -policyName cirespol -priority 10 -type RESPONSE
<!--NeedCopy-->
Integrate Fastly NextGen WAF with NetScaler
October 15, 2025
Contributed by: 
C
October 15, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.