Setting up a web application firewall with F5 BIG-IP

Import client key

1. In the BIG-IP console, go to System > Certificate Management > Traffic Certificate Management.
2. Click Import.
3. Select Key from the Import Type.
4. Type in a name for your key under the option Key Name.
5. Either upload your key or paste your key under the option Key Source.
6. Select the proper security type.
7. Click Import.

Import client certificate

1. In the BIG-IP console, go to System > Certificate Management > Traffic Certificate Management.
2. Click Import.
3. Select Certificate from the Import Type.
4. In the Certificate Name field, enter a name for your certificate.
5. Either upload your certificate or paste your certificate under the option Certificate Source.
6. Click Import.

Create a cipher policy

1. In the BIG-IP console, go to Local Traffic > Ciphers > Rules.
2. Click Create.
3. Set the following options:
   • Name: Name that you want to user for this policy
   • Cipher Suites: ECDHE-ECDSA-CHACHA20-POLY1305-SHA256:ECDHE-RSA-CHACHA20-POLY1305-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:TLSV1_3
4. Click Finished.

Create a cipher group

1. In the BIG-IP console, go to Local Traffic > Ciphers > Groups.
2. Click Create.
3. Set the following options:
   • Name: Name that you want to user for this group
   • Under Group Details, move the rule that you created to the Allow the following section
4. Click Finished.

Create a client SSL profile

1. In the BIG-IP console, go to Local Traffic > Profiles > SSL > Client.
2. Click Create.
3. Set the following options:
   • Name: Name that you want to user for this profile
4. In the Configuration section, change Basic to Advanced, select Custom and set the following values:
   • Certificate Key Chain: Add both the key and certificate that you imported in the previous steps
   • Ciphers: select Cipher Group and the name of the group that you created in the previous step
   • Options: Options List...
   • Options List: The only enabled option should be Don't insert empty fragments
5. Click Finished.

Create a server SSL profile

For each server certificate that you imported, create a server SSL profile by completing the following steps:

1. In the BIG-IP console, navigate to Local Traffic > Profiles > SSL -> Server.
2. Click Create.
3. In the General Properties section, specify:
   • Name: Name that you want to use for this profile
4. In the Configuration section, change Basic to Advanced, click the Custom checkbox and set the following values:
   • Secure Renegotiation: Require Strict
   • Server Name: FQDN of your custom application
   • Ciphers: select Cipher Group and the name of the group you created in the step above
   • Options: Options List...
   • Options List: Only enabled option should be Don't insert empty fragments
5. In the Server Authentication section, set the following options:
   • Server Certificate: require...
   • Trusted Certificate Authorities: Set to your intermediate server certificate
6. Click Finished.

Create iRules

An iRule is a feature within the BIG-IP local traffic management (LTM) system that you can use to manage your network traffic. See Getting started with iRules: Basic Concepts for more information about iRules.

1. If you have a backend that serves multiple HTTPS sites by using the TLS Server Name Indication feature, for more information see Configure a virtual server to serve multiple HTTPS sites using the TLS Server Name Indication feature.
2. Host header rewrite is used if your public facing domain is different than your backend. Use the following example to rewrite the host header based on the FQDN of the incoming request:

when HTTP_REQUEST {
    set hostname [getfield [HTTP::host] ":" 1]
}
when HTTP_REQUEST_SEND {
    switch -glob [string tolower $hostname] {
    "mysiteA.public.domain" {
      clientside {
        HTTP::header replace host "mysiteA.backend.domain"
      }
    }
    "mysiteB.public.domain" {
      clientside {
        HTTP::header replace host "mysiteB.backend.domain"
      }
    }
    default {
      reject
    }
  }
}

Create the backend pool

1. In the BIG-IP console, go to Local Traffic > Pools > Pool List.
2. Click Create.
3. In the Configuration section, set the following fields:
   • Name: Name that you want to use for the pool
   • Health Monitor: Select an appropriate protocol to monitor the health of your members
4. In the Resources section, set the following fields:
   • Load Balancing Method: Select an appropriate method that you would like to use for balancing traffic
   • New Members: For each IP or FQDN, input the members of your backend server

Create policies

If you have multiple backend pools to which you need to route traffic, you must create a policy to route traffic to the proper backend pool. For more information, see Introducing Local Traffic Policies.

1. Go to Local Traffic > Policies > Policy List.
2. Click Create.
3. Set the following under General Properties:
   • Policy Name: Name that you want to use for the policy
   • Strategy: Set the strategy that you would like to use for rule matching
   • Type: Traffic Policy
4. Click Create.
5. Under Rules, click Create.
6. Under Name, enter the name that you want to specify for this rule.
7. Click the + symbol and enter the conditions that must be matched.
8. Click the + symbol and enter what should be done when the condition is met. If you want to forward to a backend pool, select Forward Traffic.
9. If you need to create multiple rules, click Create again and repeat the previous steps.
10. After all rules are created, click Save Draft.
11. Under Local Traffic > Policies > Policy List, select your policy and click Publish.

Create the virtual server

1. In the console, go to Local Traffic > Virtual Servers > Virtual Server List.
2. Click Create
3. In the General Properties section, select or input the following fields:
   • Name: Name that you want to use for the virtual server
   • Type: Standard
   • Destination Address/Mask: Internal IP of the External interface
   • Service Port: 443
   • State: Enabled
4. Under the Configuration section, select or input the following fields:
   • Protocol: TCP
   • Protocol Profile (Client): tcp
   • Protocol Profile (Server): (Use Client Profile)
   • HTTP Profile (Client): http
   • HTTP Profile (Server): (Use Client Profile)
   • SSL Profile (Client): Name of the client SSL profile you created previously
   • SSL Profile (Server): If you have one server profile, select the name that you created in a previous step, otherwise see the iRules sections
   • Source Address Translation: Auto Map
5. Click Finished.
6. Click the name of your newly created virtual server from the Virtual Server List.
7. Click the Resources tab.
8. Under the Load Balancing section select the following options:
   • Default Pool: Name of backend pool that you created in a previous step
9. Under the iRules section:
   • Click Manage.
   • Move the iRules that you want to enable to the Enabled section.
10. Under the Policies section:
    • Click Manage.
    • Move the policy that you want to enable to the Enabled section.

Enable license

1. Under System > License, click the Module Allocation tab.
2. If Application Security (ASM) is not enabled, enable it with the Nominal selection.
3. BIG-IP restarts.
4. When the restart completes, log back into BIG-IP.

Set up WAF

1. Go to Security > Guided Configuration.
2. Click Web Application Protocol and then Web Application Comprehensive Protection.
3. Click Next.
4. Under Security Layers* do the following:
   1. Enter a configuration name.
   2. Enable any security layers that you would like. The security layers of Security Policy and Behavioral Analysis DoS should at least be enabled.
   3. Click Save and Next.
5. Under Web Application Security Policy Properties:
   1. Set the following:
   • Select Enforcement Mode: Blocking
   • Select type of policy to protect application: Generic
   • Application Language: Select the language encoding for your web application
   1. Click Save and Next.
6. Under Bot Defense Properties
   1. Set the following:
   • Select Enforcement Mode: Blocking
   • Profile Template: Balanced
   1. Click Save and Next.
7. Under DoS Profile Properties
   1. Set the following under Operation Mode:
   • Operation Mode: Blocking
   • Verify that Bad actors behavior detection and Request signature detection are selected
   1. Set the following under Mitigation Mode:
   • Mitigation Mode: Standard
   1. Click Save and Next.
8. Under Virtual Server Properties
   1. Check Assign Policy to Virtual Server(s).
   2. Under Virtual Server select Use Existing.
   3. Under Assign Virtual Servers, move the virtual server that you created previously over from Available to Selected.
   4. Click Save and Next.
9. Click Deploy.
10. Verify that the configuration is under *Deployed status.