WAF for APM Oauth Authorization VS
Hi,
We are testing the using of F5 as a OAuth Authorization Server and also a Resource Server.
We have a WAF policy attached the VS representing of the Resource Server, which has an IIS server behind it.
Since VS of the Auth Server will only utilize APM capabilities and won't actually have any application/web server behind it, I'm wondering if it's advised to add a WAF policy for this VS.
I was told it's not necessary but I find it odd, since attackers can still try to attack the F5 itself.
Any thoughts?
Hi Jonathan_c,
I had a lengthy discussion about this with fellow MVP Kai_Wilke and we came up with the following answer.
The F5 Authorization Server and the Resource Server should not be at risk, otherwise F5 would provide Attack Signatures or Threat Campaign signatures for APM Resources. F5 doesn't provide any ASM signatures for APM, which for me translates to - F5 is confident you don't need such. You'd rather have to install a BIG-IP upgrade to fix any security issues with APM.The IIS Server might be at risk, and here it might make sense to use ASM.
But for this use case the chain of processing (APM before ASM) would be OK.KR
Daniel