The Cequence platform uses a modular, container-based architecture that supports rapid deployment and integration with existing infrastructure. This article describes integrating the Cequence platform SaaS deployment with Imperva Incapsula WAF. This article is intended for administrators who manage Imperva Incapsula configurations and Cequence platform SaaS deployments.
About Cequence platform SaaS deployment
In the SaaS deployment model, Cequence provisions the platform as a private, customer-specific Cloud Security Pod in proximity to your application infrastructure to minimize latency. Cequence deploys the platform in a public cloud environment, such as AWS, as a private, single-tenant SaaS instance to eliminate data privacy concerns.
The Cequence Customer Success team provisions and operates the solution, which reduces planning and operational burden. This deployment model provides managed service benefits while maintaining the privacy and control of a self-managed deployment.
Traffic flow architecture
In this integration, application traffic flows from clients through the Imperva Incapsula WAF to the Cequence platform SaaS instance. The Cequence platform inspects incoming request traffic inline, then forwards it to your application origin infrastructure.
Prerequisites
Before you begin, ensure you have the following information.
- Your application origin server FQDN or IP address.
- The Host header value that your origin server expects.
- Administrative access to your Imperva Incapsula account.
- The Cequence-provided hostname for your Cequence platform SaaS instance.
Configuring Imperva Incapsula to forward traffic
Configure Imperva Incapsula to route traffic through your Cequence platform SaaS instance before forwarding to your origin server.
Adding the Cequence platform instance as a data center
- From the Imperva Website Management console, select the site configuration that you want to modify.
- Navigate to Website Settings.
- When the deployment uses a single data center, select Multiple Data Centers.
- Select Add Data Center.
- In the Server Address field, enter the Cequence-provided hostname for your Cequence platform SaaS instance.
- Select the Support only forward to data centre rules checkbox to prevent traffic from routing to the Cequence platform until you create a forwarding rule.
- Select Save.
Your Imperva Incapsula account now includes the Cequence platform instance as a data center.
Verifying Host header configuration
Before you create forwarding rules, verify that existing rules do not interfere with Host header routing.
- From your site configuration, navigate to Security Rules.
- Review all existing rules for Rewrite Request rules that modify the Host header.
- When you find Host header rewrite rules, contact Cequence Customer Success to update your Cequence platform SaaS instance configuration before proceeding.
Once you confirm that no conflicting Host header rules exist, you can create a forwarding rule.
Creating a forwarding rule
After you add the Cequence platform data center and verify Host header configuration, create a forwarding rule to route traffic through the Cequence platform.
- From your site configuration, navigate to Security Rules.
- Select Forward Rules.
- Select Add Rule.
- Configure the matching criteria for traffic that you want to route through the Cequence platform. To forward all traffic, use URL contains /.
- From the Target Data Center dropdown, select the Cequence data center that you created.
- For initial testing, select Test Rule Only on My IP Addresses to route only traffic from your IP address through the Cequence platform.
- Verify that traffic from your test client reaches your origin server and functions correctly.
- After you verify functionality, select Enable Rule to route all matching traffic through the Cequence platform.
- Select Save.
Imperva Incapsula now routes matching traffic through your Cequence platform SaaS instance before forwarding it to your origin server.
Provisioning the Cequence platform SaaS instance
Provide the following information to Cequence Customer Success to configure your Cequence platform SaaS instance.
- Application origin server FQDN or IP address.
- Host header value that the origin server expects.
The Cequence platform forwards inspected traffic to your application infrastructure using the origin server hostname that you provide.
Application availability and failover
Imperva Incapsula includes health checks to monitor data center availability. When the Cequence platform SaaS instance becomes unavailable, Imperva automatically routes traffic directly to your origin infrastructure, which bypasses the Cequence platform.
To manually disable traffic routing through the Cequence platform, disable the forwarding rule from Security Rules > Forward Rules.
For additional resilience configuration options, refer to Imperva's documentation on weighted load balancing and failover. These links lead to external Imperva sites, which may change or become unavailable over time.