Attack signatures, security policies and NAT vs Virtual Servers

Hi bsm1970, you are supposed to NAT the public IP to VS IP address of F5 using your perimeter firewall either for each website or for all websites (in this latter case, irule should be in place to differentiate between different websites) The virtual server should be standard and has at least http profile, SSL offloading (for ASM policy), SNAT, Pool and finally an ASM policy

Let me see if I understand what you're saying. The public IP of the web server the external user wants to reach should be routed to the VS on the F5 by the perimeter firewall. I would probably set up a different VS for each website so we would do the same thing for all of the other sites we stand up. I think initially I won't have any ASM policy running. I just want to get traffic flowing initially then work toward adding ASM policy. So for that, where would SNAT come into play? Is that just to make sure the traffic is routed back through the F5? And would SNAT be necessary if the web server nodes have the F5 as their default gateway?

I think I've got my virtual servers set up properly. My question now is how NAT relates to all this. I have my public IP and my private internal IP for my web servers. I have a VS set up for each of them pointing to that private IP. How do I make it so that traffic coming in using the public IP address of a certain site hits the right VS? Do I put the public IP address of the web server in the Source Address field of the VS?