F5 Distributed Cloud - Customer Edge Source | Edit on

Class 3: [Day-1] CE - Secure and Protect Web Apps with WAAP¶

Objective:¶

Secure and Protect Application and API with WAAP

Note

Continiously protect and secure application and API with F5XC Web Application and API Protection

Arcadia Financial
Hipster Retail
Bank of XC

For the purpose of the lab, below are the high level tasks

Create a common App firewall policy in Shared namespace and consumed by all apps
Create HTTP LB and apply common App Firewall policy
Advertise HTTP LB (with HTTPS - domain ce.local) on CE
Test and validate protected application.

Use the following wildcard certificate for all apps

ce.local certificate

ce.local private key

App Firewall Policy¶

Follow the following instruction to create a shared app firewall rules. This app firewall reside on Shared namespace and will be visible to other namespaces. This allow SecOps to define App Firewall and DevOps consume from their individual namespace.

App#1 - Arcadia Financial Apps [Internal]¶

Create App Protection¶

Arcadia Financial	Value
Protected FQDN	https://arcadia.ce.local
Type of Origin Server	IP address of Origin Server on given Sites
Origin Server	10.1.20.21
Origin Server Port	80
Origin Server Network on the Site	Inside
VIP Advertisement	Custom
Where to advertise	Outside on CE site

Add new HTTP LB

Create custom TLS certificate

Add Origin Pool. Where the HTTP LB should send traffic to.

The Web server or Origin server resides inside network (10.1.10.21) of the CE.

Create Health Check. It is a good practice to always create appropriate health check. This to ensure HTTP LB constant know the health of the application.

Attach WAF policy to HTTP LB

Enable API Discovery, API Traffic Learning, DDoS Protection and DDoS Auto-Mitigation

Configure where this HTTP LB listen on - “listerner”. For CE deployment, select Custom

Specify HTTP Listerner listen on Outside Network in reference to the CE site.

HTTP LB for arcadia-lb created with valid certificate.

Validate App Protection¶

Attack from Client browser

Username	olivia
Password	ilovef5

Try to access Web Server /etc/passwd file

Triger blocking by CE WAAP. Match an attack signature. Attack mitigated.

Validate detection and mitigation from F5XC Console

App#2 - Hipster Retails Apps [Public Internet]¶

Create App Protection¶

Hipster Retail	Value
Protected FQDN	https://hipster.ce.local
Type of Origin Server	Public DNS Name of Origin Server
Origin Pool	https://hipster.edgecnf.com
Origin Server Port	443
Origin Pool TLS	Enable
VIP Advertisement	Custom
Where to advertise	Outside on CE site

Create HTTP LB and add custom certificte.

Add Origin Pool. Origin pool reside on Internet.

Due to orgin pool runing on HTTPS, enable TLS so that when CE connect to origin server, it invoke a secure connection.

Enable and select Shared app firewall.

Advertise the listener on CE outside interface. Hence, select Custom

HTTP LB for hipster-lb created

Validate App Protection¶

Select and item and Add item to cart.

Inject SQL Injection attack vector ( ‘ OR 1=1# ) to street address field.

Attack blocked and mitigated by CE WAAP.

Validate detection and mitigation from F5XC Console

App#3 - Bank of XC [ Public Internet]¶

Warning

No instruction given for this task. You should be familiar to secure any Apps and API. Leverage your understand to execute this task. Leverage the following provided information.

Bank of XC	Value
Protected FQDN	https://boxc.ce.local
Type of Origin Server	Public DNS Name of Origin Server
Origin Pool	https://pay.edgecnf.com
Origin Server Port	443
Origin Pool TLS	Enable
VIP Advertisement	Custom
Where to advertise	Outside on CE site

Suggested sample attack vector

/?page=test|/bin/cat%20/etc/passwd
‘ OR 1=1# –> SQL injection
<script>alert(123)</script> –> Cross Site Scripting

Previous Next