Web App Security & Performance

• Click DNS Management service on the Console home page.

Figure: Navigate to DNS Management

• Select DNS Management option in the primary navigation menu located on the left side of the page.

• Click Add Zone.

Figure: Add Zone

• Enter domain or subdomain name in the Domain Name field in the metadata section.

• Optionally, set labels and add a description for your zone.

Select Primary DNS Configuration for the Zone Type field in the DNS Zone Configuration section. Click Edit Configuration under the Primary DNS Configuration field. Do the following in the zone configuration form:

• In the SOA Record Parameters section, the Use Default Parameters is populated by default. To customize this, select SOA Record Parameters option, click View Configuration, and set the SOA parameters such as refresh interval, retry interval, TTL, etc.

Figure: SOA Custom Configuration

• Go to Resource Record Sets section and click Add Item. The resource record sets configuration form opens.

• Enter a value for the Time to live field.

• Select a record type for the Record Set field, enter a name for your record name in the Record Name field, and set the fields as per your record type selection. Refer to the following table for the record type and field mapping:

Note: Use the Add item button available in each record type configuration to add more than one record for that record. See DNS Load Balancer for instructions on how to configure DNS load balancer for your zone.

Figure: Resource Record Set

• Click Add Item to add the resource record set to the list of resource record sets. Use the Add Item button to add more than one resource record step.

This step configures specific groups for resource record sets. A resource record sets group allows grouping of DNS records to make it easier to manage them. For example, you can group DNS records that belong to the same application.

• Enable Show Advanced Fields in the Resource Record Sets section.

• Click Add Item in the appeared Additional Resource Record Sets section. This opens new resource record sets form.

• Enter a Name in the metadata section.

• Click Add Item in the Resource Record Sets section. This opens the resource record sets configuration form.

• Configure the records in the same way as mentioned in previous step.

• Click Add Item to add the resource record set to the group. Use the Add Item button to add more than one resource record set.

• Click Add Item in the Resource Record Sets form to add the group to the Additional Resource Record Sets section. Use the Add Item button to add more than one group.

• In the DNSSEC Mode section, select Enable for the DNSSEC Mode field if you want to use DNS security extensions (DNSSEC) to authenticate DNS response data.

Note: DNSSEC Mode is disabled by default.

• Check the Allow HTTP Load Balancer Managed Records. This is only optional for a legacy delegated domain.

Note: Allow HTTP Load Balancer Managed Records is unchecked by default, which might have made sense for a delegated domain. However, Distributed Cloud Services has deprecated the Delegated Domain capability, which means that new domains will need to be setup as a Primary DNS zone corresponding to your HTTP Load Balancer (which is what you created in these steps), and you must check the Allow HTTP Load Balancer Managed Records checkbox for the HTTP Load Balancer to work properly.

• Click Apply in the primary zone configuration form.

Figure: Primary Zone Configuration

• Click Save and Exit in the main zone configuration form to complete creating the primary zone.

This example demonstrates securing the public website cloud.f5.com. You can obtain the public certificate using more than one method. This example shows how to obtain using Firefox browser.

• Open https://cloud.f5.com website in browser.
• Select the padlock symbol on the URL bar and then select the arrow button next to the Connection Secure option.

Figure: View Connection Information of Public Site

• Select More Information to display the security options.

Figure: View Security Information of Public Site

• Select the View Certificate button in the displayed security options.

Figure: View Certificate Information of Public Site

• Switch to the Entrust Root Certification Authority - G2 tab and scroll down to the Miscellaneous section. Select PEM (Cert) and Ok in the confirmation box to download the certificate.

Figure: Download Certificate of Public Site

• Log into the Console and select the Administration service.
• Navigate to Personal Management and select My Namespaces. Select Add namespace.

Figure: Manage Namespaces

• Set a name, optionally add users, and select Save. This example creates waap namespace.

Figure: Create Namespace

• Select the Web App & API Protection service.
• Change to your new application namespace and navigate to Manage > Load Balancers > Origin Pools.
• Select Add Origin Pool.
• Enter a name for your origin pool in the metadata section.

Figure: New Origin Pool

• In the Origin Servers section, select Add Item.
  • Select Public DNS Name of Origin Server for the Type of Origin Server field.
  • Enter the public DNS name of your origin server in the DNS Name field. This example configures cloud.f5.com as the DNS name.
  • Select Apply to save the origin server selection.

Figure: Origin Pool Basic Configuration

• In the Origin server Port section, enter 443 for the Port field.
• Scroll down to the TLS section, and select Enable.
• Select SNI Value in the SNI Selection field and enter the SNI. This example sets cloud.f5.com as the SNI Value.
• Select High for the TLS Security Level field.
• Select Use Custom CA List for the Origin Server Verification field.
• Select Base64(binary) option for the Trusted CAs field.
• Switch to command terminal and encrypt the downloaded public certificate of the website using Base64. Copy the output.

cat author-www-f5-com.pem | base64

• Go back to Console and enter the copied Base64 string in the Trusted CAs field.

Figure: Origin Pool TLS Configuration

Note: Configuring the public certificate enables Distributed Cloud Services to establish connection to the origin server.

• Select Save and Exit.

• Navigate to Manage > Load Balancers > HTTP Load Balancers. Select Add HTTP Load Balancer.

• Enter a name and your domain in the Name and Domains fields respectively. This will create an A name entry, cloudf5-vip, which will resolve to an IP address that is pointed to a VIP that is hosted on F5 ADN.

• Select HTTPS with Automatic Certificate in the Load Balancer Type field. This will create an SSL certificate for this domain and sign it with a public Certificate Authority (CA).

Figure: HTTP Load balancer creation

• Since this use case attempts to provide a proxy to an existing public site, it is required to enable automatic host-rewriting. Therefore, route configuration is required. Scroll down to the Routes section and select Configure.

Figure: Route Configuration Section

• Select Add Item, select ANY for the HTTP Method, select Regex for the Path Match field, and enter (.*?) (all routes) in the Regex field.

Note: The option Simple Route is applied by default for the Select Type of Route field.

• Select Add Item for the Origin Pools section. Select the origin pool created in the previous step for the Origin Pool field and select Apply.

Figure: Route Origin Pool Configuration

• Select Apply at the bottom of the Routes configuration form to add the route to the load balancer configuration and return to the load balancer configuration form.

Figure: Route Origin Pool Configuration

Note: Ensure that the Automatic Host Rewrite option is selected by default for the Host Rewrite field. This ensures that the requests coming to the domain you configured are redirected to the public DNS name of the origin server.

• Select Apply to apply this list to the load balancer.
• Scroll to the bottom and select Save and Exit to complete the load balancer.

The load balancer object gets displayed on the screen. The fields DNS Info and TLS Info with values VIRTUAL_HOST_READY and Certificate Valid indicate that the virtual host certificate is successfully validated and ready for use. You can verify this by entering the load balancer domain into a browser.

Figure: HTTP Load Balancer Created

Note: Select Refresh on the load balancers display list screen to display the latest status.

• In the Web App & API Protection service, select the same namespace as your load balancer.
• Navigate to Manage > Load Balancers > HTTP Load Balancers.
• Select ...>Manage Configuration for your load balancer to view its configuration. Next select Edit Configuration in the upper right corner to edit its configuration.
• Scroll down to the Web Application Firewall section.
• Select Enable for the Web Application Firewall (WAF) field, and then use the Enable pull-down menu to select the Add Item button.

Figure: HTTP Load Balancer Security Configuration

• Enter a name for the firewall.
• Select Blocking for the Enforcement Mode field.
• Leave the Protection Settings at their defaults and select Continue to save the WAF and return to the HTTP Load Balancer form.

Figure: WAF for HTTP Load Balancer

• Optionally select Enable in the API Discovery drop-down menu of the API Protection section.
• In the DoS Protection section, select Default for the L7 DDoS Auto Mitigation field, and then Default for the Slow DDos Mitigation field.

Figure: DDoS Detection for HTTP Load Balancer Security

• Scroll down to the Common Security Controls section and select Enable for the Malicious User Detection and Challenges field and then Default for the Malicious User Mitigation Settings field.

Note: This quickstart uses default malicious user detection settings. You can customize those settings by creating an app type and applying it to this load balancer with a label (in the metadata section). For more information, see Malicious Users.

• Scroll down and select Save and Exit to save these security settings.

• In the Web App & API Protection service, select the same namespace as your load balancer.
• Select Overview > Dashboards > Performance Dashboard. This provides an overall performance view of the entire namespace, including Health, Active Alerts, Active Configuration, Traffic Overview, and Throughput graphs. Below these is a list of Load Balancers.

Figure: HTTP Load Balancer WAF Monitoring

• Select the name of the load balancer you want to monitor in load balancers list. This will show the performance dashboard for that specific load balancer.

Figure: HTTP Load Balancer Performance Dashboard

• Select the Requests tab. Each request shown represents a call to our website.
• Select a request to get more information specific to that request.
• Select Forensics to see the Forensics panel allowing you to filter the requests chart by various metrics, like country and soure ip.

Figure: HTTP Load Balancer Performance Requests

• Select Overview > Dashboards > Security Dashboard. This provides an overall security view of the entire namespace, including Threat intelligence, Bot Traffics, API Classification, DDoS Attack Activity, Security Events, Top Attack Sources, Top Attacked Paths, Events by Country, and Active Configuration. Below these is a list of Load Balancers.

Figure: HTTP Load Balancer Security Dashboard

• Select the name of the load balancer you want to monitor in the load balancers list. This will show the security dashboard for that specific load balancer.

Figure: Security Dashboard for specific HTTP Load Balancer

• Select the Security Analytics tab to see all security events, shown in a bar chart and below in a table. The chart shows time-based counts for the different types of events. The table shows event summary information across the columns.
• The Actions column provides options to either block the requesting client and/or add the client to the list of trusted clients (depending on the type of event).
• Select > at the left side of a row to see the specifics of the request and the violations that were triggered by the attack.
• To see only blocked requests, use the Add Filter option and select Action, In, Select Block, followed by Apply.

Figure: HTTP Load Balancer Blocked Requests

Note: For more information on analyzing security, see the security section of the Monitor HTTP Load Balancer document.