## Overview

CloudGuard WAF can be deployed as an add-on for NGINX or Kong, thus providing protection to any applications and APIs served by NGINX Reverse Proxy.

### NGINX

### Kong

The CloudGuard WAF Nano Agent attaches itself to the traffic being **proxied** by the Proxy Server or API server.

If the server serves applications locally, and does not serve as a proxy between an exposed domain and an internal one - the Nano Agent can still inspect the traffic if you change the port for the local applications to a higher port, and add a proxy rule between the exposed listening domain and port, to the same local machine at a higher port.

### Deployment Instructions for NGINX

[NGINX](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/linux/nginx)

### Deployment Instructions for Kong Using Lua PlugIn

[Previous Dual Docker: NGINX / Kong / Envoy + Security Agent](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/docker/dual-docker-nginx-kong-envoy-+-security-agent) [Next NGINX](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/linux/nginx)