Firewall / WAF
Filters malicious or malformed traffic before it reaches the application.
Problem it solves: Public endpoints attract bots, injection attempts and floods.
Where it sits: At the edge, before load balancers or gateways.
When to use
- Any internet-facing endpoint.
When not to use
- As the only security layer; authorisation still belongs in services.
Failure modes
- False positives block real users.
- Rule evaluation adds latency under attack traffic.
Metrics to watch
- Blocked req/s
- False-positive reports
- Added latency (ms)
Alternatives
- CDN-integrated bot protection
- Rate limiter
Configuration in Labs (illustrative defaults)
- Instances (count) = 2 — Identical copies behind this logical component. Capacity scales linearly in this model.
- Capacity per instance (req/s) = 100000 — Maximum requests one instance completes per second before it saturates.
- Base service time (ms) = 1 — Processing time per request at zero load. Queueing adds to this as utilisation rises.