Timeout Error 504 only with CloudGuard WAF

[Alex6]

Hello,

We are using the SaaS version of the WAF. We have deployed an asset of type AppSec SaaS Profile to protect a web server that is also hosted in SaaS. Most of query are ok with the WAF but for a slightly long connection request to this server (around 60 seconds), the WAF returns a 504 error.

Every other access to web page or query is working with the WAF. Only this query with long processing time or response time.

We tested a direct connection, bypassing the WAF, and indeed the request takes time but completes successfully without errors.

We re-enabled the WAF and modified the timeout parameters as follows, but the issue persists. We are still receiving a 504 error:

 

Do you have any idea how to resolve this issue? Without the WAF, everything works fine with direct connexion to the web server.
Is there a way to have detailed logs?

[yuvalmamka · Accepted solution]

Hi Alex,

Thank you for your detailed description. The issue you’re experiencing is indeed related to a timeout within the WAF. CloudGuard WAF operates on an NGINX reverse proxy, and such issues typically occur when the processing time exceeds the default 60-second configuration of NGINX. You’ve correctly extended this timeout through the asset’s advanced settings.

For WAF as a Service, there’s an additional CloudFront layer before the WAF layer, which also requires a timeout increase. Currently, the only way to adjust this is by contacting Check Point support. However, we’re working on making this feature available through the asset’s advanced settings, so you’ll soon be able to manage it independently.

[yuvalmamka · Accepted solution]

I'm happy to share that starting this week, you can increase the timeout for your assets secured by CloudGuard WAF as a Service on your own!

Check our documentation for further details: How To: Extend Connection Timeout to Upstream | CloudGuard WAF