Web App Security & Performance

• Select the DNS Management service.
• Navigate to Domain Management and click Add delegated domain.
• Enter your domain name in the Domain Name field. Ensure that Managed by Volterra is selected for the Domain Method field. Click Save and Exit.

Note: This creates a delegated domain object with a TXT record value and the status as domain verification pending.

• Verify that the delegated domain object is displayed in the list and copy the value of the TXT Record field using the button to the right of the value.

• Add a TXT record in your domain records with the copied TXT string. This example shows how to add the record in Google domains.

• Go back to Console and select your delegated domain entry. Click Verify for your domain.

• After verification, the field Verification Status shows successful verification, and the nameservers get displayed on the Name Servers field.

Go back to your domain and add the NS records with the nameservers obtained from Console. This example shows adding to the Google domains.

This example demonstrates securing the public website filecoin.io. You can obtain the public certificate using more than one method. This example shows how to obtain using Firefox browser.

• Open https://filecoin.io website in browser.
• Click on the padlock symbol on the URL bar and click on the arrow button next to the Connection Secure option.

• Click on More Information to display the security options.

• Click on View Certificate in the displayed security options.

• Click on the DST Root CA X3 tab and scroll down to the Miscellaneous section. Click PEM (Cert) and Ok in the confirmation box to download the certificate.

• Log into the Console and select the Administration service.
• Navigate to Personal Management and select My Namespaces. Click Add namespace.

• Set a name, optionally add users, and click Save. This example creates waap namespace.

• Select the Web App & API Protection service.
• Change to your new application namespace and navigate to Manage -> Load Balancers -> Origin Pools.
• Click Add Origin Pool.
• Enter a name for your origin pool in the metadata section.

• In the Basic Configuration section under Origin Servers, click Add Item.
  • Select Public DNS Name of Origin Server for the Type of Origin Server field.
  • Enter the public DNS name of your origin server in the DNS Name field. This example configures filecoin.io as the DNS name.

• In the Basic Configuration section, enter 443 for the Port field.
• Scroll down and select TLS in the Enable TLS for Origin Servers field.
• Select SNI Value in the SNI Selection field and enter the SNI in the SNI field. This example sets filecoin.io as the SNI.
• Select High for the TLS Configuration for Origin Servers field.
• Select Use Custom CA List for the Origin Server Verification field.
• Select Base64(binary) option for the Trusted CAs field.
• Switch to command terminal and encrypt the downloaded public certificate of the website using Base64. Copy the output.

cat filecoin-io.pem | base64
  

• Go back to Console and enter the copied Base64 string in the Trusted CAs field.

Note: Configuring the public certificate enables Distributed Cloud Services to establish connection to the origin server.

• Click Save and Exit.

• Navigate to Manage -> Load Balancers -> HTTP Load Balancers. Click Add HTTP Load Balancer.

• Enter a name and your domain in the Name and Domains field respectively. This will create an A name entry, filecoin-vip, which will resolve to an IP address that is pointed to VIP that is hosted on F5 ADN.

• Select HTPS with Automatic Certificate in the Type of Load Balancer field. This will create an SSL certificate for this domain and sign it with a public Certificate Authority (CA).

• Since this use case attempts to provide a proxy to an existing public site, it is required to enable automatic host-rewriting. Therefore, route configuration is required. Enable Show Advanced Fields option in the Routes Configuration section and click Configure under the Routes option.

• Click Add Item, select ANY for the HTTP Method, select Regex for the Path Match field, and enter (.*?) (all routes) in the Regex field.

Note: The option Simple Route is applied by default for the Select Type of Route field.

• Click Add Item for the Origin Pools section. Select the origin pool created in the previous step for the Origin Pool field and click Add Item.

• Click Add Item at the bottom of the Routes configuration form to add the route to the load balancer configuration and return to the load balancer configuration form.

Note: Ensure that the Automatic Host Rewrite option is selected by default for the Host Rewrite field. This ensures that the requests coming to the domain you configured are redirected to the public DNS name of the origin server.

• Scroll down and click Add Item to complete this route and return to the Routes list.
• Click Apply to apply this list to the load balancer.
• Scroll to the bottom and click Save and Exit to complete the load balancer.

The load balancer object gets displayed on the screen. The fields DNS info and TLS info with values VIRTUAL_HOST_READY and Certificate Valid indicate that the virtual host certificate is successfully validated and ready for use. You can verify this by entering the load balancer domain into a browser.

Note: Click Refresh on the load balancers display list screen to display the latest status.

• In the Web App & API Protection service, select the same namespace as your load balancer.
• Navigate to Manage -> Load Balancers -> HTTP Load Balancers.
• Click ...->Manage Configuration for your load balancer to view its configuration. Next click Edit Configuration in the upper right corner to edit its configuration.
• Scroll down or click on Security Configuration in the left menu to jump to the security configuration. Select App Firewall for the Web Application Firewall (WAF) Config field.
• In the App Firewall field, use the pull-down menu to click the Create new app firewall button.

• Enter a name for the firewall.
• Select Blocking for the Enforcement Mode field.
• Leave the Protection Settings at their defaults and click Continue to save the WAF and return to the HTTP Load Balancer form.

• Toggle the Show Advanced Fields under the Security Configuration section to see additional security options.
• Scroll down to the ML Config field and change the option to Single Load Balancer Application, which enables locally scoped ML configuration.

Note: Malicious User Detection is enabled by default.

• Scroll down and click Save and Exit to save these security settings.

• In the Web App & API Protection service, select the same namespace as your load balancer.
• Select Performance in the Apps and APIs section of the left navigation sidebar. This shows a Traffic Overview graph and a list of Load Balancers.

• Click the name of the load balancer you want to monitor in load balancers list. This will show the performance dashboard for your load balancer.

• Click the Requests tab. Each request shown represents a call to our website. Click a request to get more information specific to that request.

• Select Security in the Apps & APIs section of the left navigation sidebar. Then lick the name of the load balancer you want to monitor in load balancers list. This will show the security dashboard for your load balancer. This shows several

• Click the Security Events tab. Below the chart is a list of blocked events with three tabs. The Security Events tab shows malicious requests
• Click a request to see the specifics of the request and the violations that were triggered by the attack.