In the LoadMaster Web User Interface (WUI), WAF settings can be configured for each individual Virtual Service.

In the WAF Options section of the Virtual Service modify screen (Virtual Services > View/Modify Services > Modify), there is a drop-down list called Default Operation. The Default Operation can be set to Audit Only or Block Mode.

The Audit Only mode of operation sets the SecDefaultAction to phase:2,log,auditlog,pass.

The Block Mode of operation sets the SecDefaultAction to phase:2,log,auditlog,block,drop.