Create Web Application Firewall

• From the Console homepage, click Web App & API Protection.

• Select the desired namespace from the Namespace drop-down menu.

Figure: Application Namespace

Note: You can also create a namespace where the application firewall needs to be created in. From the Console homepage, Select the Administration service, and then select Personal Management > My Namespaces. Click Add namespace, add a name, and then click Save.

• Click Manage > App Firewall.

• Click Add App Firewall to load the WAF creation form.

Figure: Create App Firewall

Fill in the required information marked with an asterisk (*) symbol:

• In the Name field under the Metadata section, enter a name for the WAF object.

• From the Enforcement Mode drop-down menu under the Enforcement Mode section, select whether you want the WAF to only monitor or block traffic:

  • Blocking: Malicious traffic is both logged and blocked.

  • Monitoring: Traffic is not blocked, but any malicious and suspicious traffic generates security events (logs).

Figure: WAF Metadata and Mode

Note: The Enforcement Mode option is with respect to your load balancer. It overrides your load balancer settings for all traffic.

• From the Security Policy drop-down menu, select which type of policy to use:

  • Default: This setting applies a broad mix of high and medium accuracy signatures, threat campaigns, and all violations.

  • Custom: This setting enables you to apply specific configurations for attack types, signature selections, automatic attack signatures, threat campaigns, and violations. You can change one or all of the configurations.

  Note: If you choose the Custom option, perform the following:

  • Attack Types: Select Custom to configure option to disable a specific attack type. Select Attack Type in Disabled Attack Types drop-down menu.

  Note: Default setting detects all attack types. You can use the drop-down menu to select additional attack types to disable.

  

  Figure: Attack Types

  • Select Attack Types in Attack Signatures section.

    • If Custom option, select Disabled Attack item.

  • From the Signature Selection by Accuracy menu, select from one of the available accuracy options. The High and Medium signatures are enabled by default.

  • Select Signature Settings by Accuracy option Default or Custom.

  • If Custom option:

    • Select High Accuracy option: Block, Report, Ignore.

    • Select Medium Accuracy option: Block, Report, Ignore.

    • Select Low Accuracy option: Block, Report, Ignore.

    Note: You can optionally log excluded attack signatures in Security Events for improved visibility.

  • From the Automatic Attack Signatures Tuning menu, enable or disable the automatic attack signature tuning. This option is enabled by default and the WAF suppresses false positive triggers based on its probabilistic learning model.

  • From the Attack Signatures Staging menu, choose whether new and updated signatures are treated differently from the firewall enforcement mode. When signatures are staged, those signatures will be in monitoring mode, even if your firewall is set to blocking mode. Choose one of the following options:

    • Disable: All signature updates will be enforced.

    • Stage new attack signatures: New signatures will be in monitoring mode for the Staging Period, meaning the new signature will not cause a request to be blocked, but you will see signature trigger details in the security event. Existing signatures that have been updated will still be enforced.

    • Stage new and updated attack signatures: New and updated signatures will be in monitoring mode for the Staging Period, meaning the new/updated signature will not cause a request to be blocked, but you will see signature trigger details in the security event.

  • From the Threat Campaigns menu, enable or disable the threat campaign detection. When enabled, the WAF detects specific threat campaigns and takes action per the enforcement mode settings.

  • From the Violations menu, select Custom to disable one or more violations. From the Disabled Violations menu, select a violation to disable.

  

  Figure: Disable Violation Types

File Types: A File Type in App Firewall is regarded as any file extension found at the end of the URL path, such as .html, .aspx, .php, etc. The following file types are disallowed by default:

{bak, bat, bck, bin, bkp, cer, cfg, cgi, cmd, com, conf, config, crt, dat, der, dll, eml, exe, hta, htr, htw, ida, idc, idq, ini, key, log, msi, nws, old, p12, p7b, p7c, pem, pfx, pol, printer, reg, sav, save, shtm, shtml, stm, sys, temp, tmp, wmz}

To customize the list of file types disallowed, disable Illegal filetype (VIOL_FILETYPE) using the Violations menu option and use a custom rule in Service Policy to disallow specific file types.

Note: For a list of supported attack types, signatures, and violations, see the following guides:

• Signatures
• Violations
• Threat Campaigns

• Enhance with AI: AI-powered risk scoring in F5 Distributed Cloud WAF simplifies WAF configuration by improving detection accuracy and reducing manual tuning. It evaluates multiple detection signals-such as signatures, attack indicators, and ML-based analysis-and assigns each request a High, Medium, or Low risk score. These risk scores enable consistent enforcement decisions and faster threat mitigation.

  • Action by Risk Score: Assessment assigns a risk level to each request. By default, only high-risk requests are blocked. Blocking for medium-risk requests can be enabled using the corresponding drop-down menus.
  

  Figure: Default Secure Policy Settings

• Enhance with AI: Enabling Enhance with AI in a Custom security policy, the system applies AI-powered risk scoring to evaluate incoming requests and improve threat detection.

  • Action by Risk Score: Enabling Enhance with AI option in a Custom security policy allows options to function. Assessment assigns a risk level to each request. By default, only high-risk requests are blocked. Blocking for medium-risk requests can be enabled using the corresponding drop-down menus.

Figure: Custom Security Policy- Enhance with AI

Important: You must enable AVX (Advanced Vector Extensions) on hardware where your CEs are deployed if you are using F5 Distributed Cloud WAF. If you do not enable AVX, you cannot use the AI features for F5 Distributed Cloud WAF.

From the Signature-Based Bot Protection drop-down menu, select an option for bot defense:

• Default: By default, a malicious bot is blocked and generates a security event. Good and suspicious bot activity generates only security events, and the WAF does not block the activity.

• Custom: Custom protection enables you to specify what action (Block, Report, or Ignore) to take when the WAF detects a malicious bot, suspicious bot, or a good bot. Set the action in the Malicious Bot, Suspicious Bot, and Good Bot menus.

Figure: Signature Bot Protection Settings

• Allowed Response Status Codes: Select Custom to specify a list of HTTP response status codes that are allowed for the client. Any HTTP responses other than these are not allowed.

• Mask Sensitive Parameters in Logs: The Default option will mask the values of sensitive parameters (like credit card numbers) in request logs. You can disable this feature or use Custom to set parameters of your choice, to be masked. For the Custom option, click Add Item and choose an HTTP Header, Query Parameter, or Cookie and enter the name accordingly. After you finish, click Add Item. You can add more than one item using the Add Item option.

• Blocking Response Page: The Default option returns an HTML response page with system settings to the client. To configure a custom response page, select Custom and perform the following:

  • From the Response Code menu, select a response that will be sent for blocked requests.

  • In the Custom Blocking Response Page Body field, enter a response string of your choice. You can specify the string in ASCII format or Base64 format.

Note: Use the base64 command to encode the response in Base64 format.

Figure: HTTP Blocking Response Settings

Click Save and Exit.

• From the Console homepage, click Multi-Cloud App Connect.

• Select the desired namespace from the Namespace drop-down menu.

• Click Manage > Load Balancers > HTTP Load Balancers.

• Find your load balancer and click ... > Manage Configuration.

• Click Edit Configuration to open the edit form.

In the Web Application Firewall section, perform the following:

• From the Web Application Firewall (WAF) menu, select Enable.

• From the Enable drop-down menu, select the WAF object you created in the previous section.

• Configure your routes per the instructions in the HTTP Load Balancer guide, if not yet configured.

• In the Advanced Options field, click Configure.

• In the Security section, perform the following:

  • From the Web Application Firewall (WAF) drop-down menu, select App Firewall.

Figure: Select WAF Option

• From the App Firewall drop-down menu, select the WAF policy for the route you configured.

Figure: Select WAF Option For Route

• Select Apply.

• Select Apply to complete route configuration.

• Select Apply to close the route configuration form.

Click Save and Exit.

Confirm that the Enable option is set in the load balancer configuration.

• Under the Data Guard Rules field, click Configure.

• Click Add Item.

Figure: Add Item

• In the Name field, add a name for this match rule.

• From the Action menu, select an option for Data Guard to take if the request matches the domain and path configured from the Domain and Path Match menus below, respectively:

  • Apply: Applies Data Guard processing for the matching criteria.

  • Skip: Skips Data Guard processing for the matching criteria.

• From the Domain menu, select whether the request is from any domain, an exact domain, or domains with suffixes.

• From the Path Match menu, select an option:

  • Prefix: Match paths using a prefix.

  • Path: Match an exact path.

  • Regex: Match paths using regular expressions (regex).

• Click Add Item.

Figure: Add Data Guard Rules

Click Apply.

Figure: Apply Data Guard Rules

• From the Console homepage, click Multi-Cloud App Connect.

• Select Manage > Load Balancers > HTTP Load Balancers.

• Select the desired namespace.

• Find your existing load balancer to edit its configuration, or click Add HTTP load balancer to create a new load balancer.

• Go to Web Application Firewall section. Under the WAF Exclusion Rules field, click Configure.

• Click Add Item.

• In the Name field, enter a name for the WAF exclusion rule. Optionally, add a description.

• From the Domain drop-down menu:

  • Select whether this rule applies to all domains, an exact domain, or a particular domain suffix. Any Domain is the default value. If you select Exact Value, enter a value in the field provided. If you select Suffix Value, enter a value with a suffix (for example, xzy.com).

• Configure the Path as per the following:

  • Select Any Path to match all paths.
  • Select Prefix and enter a prefix value in the Prefix field to match all paths that have the specified prefix.
  • Select Path Regex and in the Path Regex field, enter a directory path with regular expressions (regex) to match patterns to exclude from WAF processing.

Figure: Match Pattern with Regex

• Optionally, select request methods to match from the Methods menu.

• Configure detection control from the Action section. Select Skip App Firewall Processing to skip processing or select App Firewall Detection Control and do the following:

  • For the Signature IDs, enter a signature ID to exclude from WAF processing. You can also supply a context to it by selecting a context from the Context drop-down and specifying a value in the Context Name field. Use the Add Item button to add more than one entry.

  • For the Violations, select a violation from the menu to exclude from WAF processing. You can also supply a context to it by selecting a context from the Context drop-down and specifying a value in the Context Name field. Use the Add Item button to add more than one entry.

  • For the Attack Types, select a type of attack to exclude from WAF processing. Use the Add Item button to add more than one entry.

  • For the Bot Names, enter the name of the bot that should not be affected by the WAF. Use the Add Item button to add more than one entry.

• Enter a timestamp in the Expiration Timestamp field if you want this rule to stop being used after the entered timestamp expires.

Figure: Match Criteria for WAF Exclusion

Note: You can exclude an attack type instead of excluding individual signatures. If you are excluding a particular attack type, you do not need to add signature IDs that belong to that attack type. When you exclude an attack type, this action automatically excludes all signatures under that attack type.

• After you finish, click Add Item.

• Click Apply.

Figure: Apply WAF Exclusion Rule

Note: The order of the WAF exclusion rules matter. The WAF will process the rules starting from the top and work its way down. If there is a match on one rule, then the execution process stops and the subsequent rules are not evaluated. You can change the order of these rules by simply dragging and dropping the rules in the order you see fit. You can also click ... > Move to another spot, and then use the arrows to move the rule up or down the list.

Figure: WAF Exclusion Rule Order

• Continue to configure your load balancer, as needed.

• After you finish, click Save and Exit.

Note: For more information about creating or editing a load balancer, see HTTP Load Balancer.

• From the Console homepage, click Multi-Cloud App Connect.

• Select the application namespace.

• Click Manage > Load Balancers > HTTP Load Balancers.

• From the displayed list, find your load balancer and select ... > Manage Configuration.

Figure: List of Load Balancers

• Select Edit Configuration.

• From the left pane menu, select Web Application Firewall.

• Under the WAF Exclusion Rules subsection, click Configure.

• Select Add Item.

Figure: Add Item

• In the Name field, add a rule name.

Figure: Add Rule Name

• From the Domain menu, select whether this exclusion rule and match criteria will apply to all domains, a specific domain, or a grouping of domains. For a specific domain, select Exact Value and then enter the domain name. For a grouping of domains, select Suffix Value and then enter the value.

• In the Path Regex field, enter a regular expression to match incoming requests.

Figure: Path Regex

• From the Methods menu, select the type of request methods to be matched.

• From the WAF Exclusion Rule Action menu, select Skip App Firewall Processing.

Figure: Enable Skip WAF Processing

• Select Apply to save the exclusion rule.

• Select Apply again to apply the exclusion rule.

Select Save and Exit to save the new configuration.