Compatibility and requirements

IMPORTANT

This guide only applies to Next-Gen WAF customers with access to the Next-Gen WAF control panel. If you have access to the Next-Gen WAF product in the Fastly control panel, you can only deploy the Next-Gen WAF with the Edge WAF deployment method.

Next-Gen WAF agent

Per our agent end-of-support policy, we support agent versions that are under two years old. On a quarterly cadence, we deprecate and no longer support agent versions that are older than two years.

Processors

We support the following processors:

  • Intel. All agent and module versions are compatible with Intel processors.

  • AMD. All agent and module versions are compatible with AMD processors.

We do not currently provide ARM agent packages for Amazon Linux or Windows.

You can run the agent on ARM processors with the NGINX C Binary module v1.18.0+ on the following Linux distributions:

  • Alpine (3.13 - 3.20)
  • CentOS/RHEL (EL7 - EL9)
  • Debian (9 - 11)
  • Ubuntu (18.04 - 24.04)

Alternatively, you can run the agent on ARM processors without a module in reverse proxy mode on the Linux distributions mentioned above.

Linux

The Next-Gen WAF agent and modules are supported on the following Linux distributions:

DistributionCode NameVersion
Alpine3.20
3.19
3.18
3.17
3.16
3.15
3.14
3.13
3.12
3.11
Amazon Linux2023
2
CentOSEnterprise Linux 99.x
Enterprise Linux 88.x
Enterprise Linux 77.x
Enterprise Linux 66.x
DebianBookworm12.x
Bullseye11.x
Buster10.x
Stretch9.x
Jessie8.x
Wheezy7.x
Red HatEnterprise Linux 99.x
Enterprise Linux 88.x
Enterprise Linux 77.x
Enterprise Linux 66.x
UbuntuNoble24.04 LTS
Jammy22.04 LTS
Focal20.04 LTS
Bionic18.04 LTS
Xenial16.04 LTS
Trusty14.04 LTS
Precise12.04 LTS

Only 64-bit environments are supported. If you need 32-bit support contact us.

Next-Gen WAF module

The Next-Gen WAF module is a lightweight module that integrates with your web server software or application and is the interface between incoming requests and our agent process. We support NGINX, Apache, and IIS web servers, the HAProxy proxy server, and several application languages (including .NET, Golang, Java, Node.js). Specific details for some of the more commonly deployed platform are listed below:

NGINX Web Servers

The NGINX modules are built specifically for the NGINX Open Source distributions of NGINX and may not be compatible with a custom build of NGINX. If switching to the NGINX Open Source distribution is not an option, reach out to our support team or your Fastly account team for assistance.

The NGINX module is offered in two different variations, depending on the platform and what best meets your needs. We currently support:

C Binary

The NGINX Module is available in a variation built as a C binary, which requires no dependencies. Versions of NGINX Open Source supported by the C binary are:

  • 1.27.0
  • 1.26.0 - 1.26.1
  • 1.25.0 - 1.25.5
  • 1.24.0
  • 1.23.0 - 1.23.4
  • 1.22.0 - 1.22.1
  • 1.21.0 - 1.21.6
  • 1.20.0 - 1.20.2
  • 1.19.0 - 1.19.10
  • 1.18.0
  • 1.17.0 - 1.17.10
  • 1.16.0 - 1.16.1
  • 1.15.12
  • 1.15.10
  • 1.15.9
  • 1.15.8
  • 1.15.7
  • 1.15.3
  • 1.14.1
  • 1.12.2
  • 1.10.3 (on Ubuntu 16.04 only)

Versions of NGINX Plus supported by the C binary are:

  • 32-1 (1.25.5)
  • 31-1 (1.25.3)
  • 30-1 (1.25.1)
  • 29-1 (1.23.4)
  • 28-1 (1.23.2)
  • 27-1 (1.21.6)
  • 26-1 (1.21.5)
  • 25-1 (1.21.3)
  • 24-1 (1.19.10)
  • 23-1 (1.19.5)
  • 22-1 (1.19.0)
  • 21-1 (1.17.9)
  • 20-1 (1.17.6)
  • 19-1 (1.17.3)
  • 18-1 (1.15.10)
  • 17-1 (1.15.7)

These C binary versions are kept up-to-date with stable releases and on demand for mainline releases.

Lua

Alternatively, a variation of the NGINX Module as Lua is available, which requires NGINX to be built with Lua and for LuaJIT support.

This version is written in Lua and requires your NGINX binary to be compiled with the third party ngx_lua module enabled. We also require the ngx_lua module be linked against the LuaJIT just-in-time byte code library for performance.

NGINX deployments vary from organization to organization, and we support two approaches to this installation:

  • Pre-built binary packages - for all the operating system platforms we support we provide three flavors or pre-built NGINX packages that are built with the required ngx_lua module.
  • Source builds - for those organizations building NGINX internally from source, we have published our reference build guidelines that can be used to review and adapt for your own build process.

If you currently use a pre-built binary package of NGINX, either from the operating system’s package collection or from the official NGINX package repositories let us know, and we can provide a suitable replacement package built with our required supporting modules. Contact us for more information.

The Lua variation of the NGINX module is supported on the following versions of NGINX:

ReleaseVersions
1.121.12.x
1.111.11.x
1.101.10.x
1.91.9.x
1.81.8.x
1.71.7.2, 1.7.4, 1.7.7, 1.7.8, 1.7.9
1.61.6.0, 1.6.1, 1.6.2
1.41.4.6
1.21.2.7, 1.2.9
1.1.191.1.19
1.01.0.15

Apache Web Servers

Our Apache module is distributed in binary form as an Apache shared module and supports Apache version 2.2 and 2.4.

Microsoft Windows Servers

  • IIS 7 or higher, Windows Server 2008R2 (Windows 7) or higher (64-bit)
  • .NET 4.5 or higher
  • Version 4.50 and later of the Next-Gen WAF agent requires Windows 10 or Windows Server 2016 or higher

We currently only support 64-bit and 32-bit application pools on Windows 2012 or higher. We only support 64-bit application pools on Windows Server 2008R2.

Additionally, we only support 64-bit OSes. For older or 32-bit versions of Windows, it is possible to deploy the Next-Gen WAF agent as a reverse proxy. If you have questions or require assistance with older or 32-bit versions of Windows, reach out to our support team.

HAProxy Servers

HAProxy module. Our HAProxy module is written in Lua and requires your HAProxy binary to be compiled with the lua module enabled. The HAProxy module requires HAProxy 1.8 or higher.

NOTE

Although supported, there is a known issue with HAProxy 1.8 that may result in performance issues when the Next-Gen WAF module is installed. HAProxy has fixed this issue with HAProxy 2.2, but the fix will not be backported to 1.8. It is recommended to upgrade to HAProxy 2.2 or higher if possible, or use an alternate deployment method (e.g., reverse proxy agent if HAProxy 1.8 must be used).

HAProxy SPOE module. Our HAProxy SPOE module does not require Lua. The HAProxy SPOE module requires HAProxy 1.8 or higher.

Node.js

0.10 or higher

Java

  • Java 1.8 or newer
  • Spring version 2.x
  • Spring Boot Tomcat Starter 2.x
  • Spring Boot Starter WebFlux 2.x
  • Tomcat 8
Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.