Choose your deployment model: Edge WAF runs on Fastly's global edge (no agent installation required, traffic routed through Fastly CDN); Cloud WAF runs on Fastly-hosted infrastructure and requires DNS or load-balancer changes; On-Prem WAF installs an agent directly on your web servers.
For On-Prem WAF, install the Next-Gen WAF agent on each origin server following the Getting Started with the Agent documentation; the agent runs as a service, listens on a local port or Unix socket, and communicates with the Fastly cloud engine every 30 seconds to receive updated rule configurations and upload redacted request data.
In the Fastly Next-Gen WAF console, create a Corp (the top-level organisation), add a Site for each web application, and configure the site's detection mode: blocking mode enforces rules; detection mode logs without blocking (use this for initial rollout).
Configure signals and rules in the console: built-in signals detect common attack patterns (SQLi, XSS, traversal, scanner agents); custom signals can match on any request attribute; rules specify what action to take when a signal fires (block, flag, allow).
Integrate the agent with your web server: for Nginx, the OpenResty or NGINX Plus module proxies requests through the agent; for Apache, use the mod_security-compatible module; the Terraform provider (Signal Sciences Terraform Provider) can manage site and rule configuration as code.
Review the Fastly Next-Gen WAF dashboard for request signals, attack traffic trends, and flagged IPs; promote detection-mode findings to block rules only after confirming no false positives against known-good traffic.
Known gotchas
The agent communicates asynchronously; in blocking mode, the agent makes a local decision based on cached rules rather than calling the cloud engine per-request, so there is no added latency on the request path, but there is a small window after a config change before all agents receive updated rules.
Edge WAF and On-Prem WAF have different rule coverage; some signals available in On-Prem WAF (which inspects decrypted traffic) are not available in Edge WAF (which inspects at the CDN layer before reaching your origin).
Fastly Next-Gen WAF is a separate product from Fastly's CDN and must be licensed independently; confirm your contract includes the WAF module before beginning deployment.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp