Deploying WAF in production using Azure Resource Manager template with F5 Nginx App Protect

Introduction:

In production-grade deployments, it is always a challenge for anyone who wants to give a demo in their environment with a WAF deployment.  Usually, it takes at least a few weeks for an average team to design and implement a production-grade WAF in a cloud environment because for each cloud deployment, virtual networking, infrastructure security, virtual machine images, auto-scaling, logging, monitoring, automation, and many more topics require detailed analysis. To mitigate this time and effort, we came up with the conclusion that a proper WAF deployment can be templatized and automated, so a team doesn’t need to spend time on deployment and maintenance and uses a WAF from day zero.

In this article we introduced a project that implements an Azure Resource Manager template to deploy a production-grade WAF in Azure cloud in just a few clicks. The WAF is using the F5 NGINX App Protect WAF official image, which is available under the Azure marketplace. This eliminates the need to manually prebuild the VM image for your WAF deployment. It contains all the necessary code and packages on top of the OS of your choice. Additionally, it allows you to pay as you go for NGINX App Protect WAF software instead of purchasing a year-long license. 

Why Azure?

Globally, 90% of Fortune 500 companies are using Microsoft Azure to drive their business. Using deeply integrated Azure cloud services, enterprises can rapidly build, deploy, and manage simple to complex applications with ease. Azure supports a wide range of programming languages, frameworks, operating systems, databases, and devices, allowing enterprises to leverage tools and technologies they trust. 

Here are some of the reasons why customers are deploying their applications using Azure. 

• Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) capabilities 
• Security offers scalability and ductility 
• Environmental integration with other Microsoft tools 
• Cost efficiency and interoperability 

Project:

This project implements an ARM (Azure Resource Manager) template that automatically deploys a production grade WAF using NGINX App Protect WAF to Azure cloud. It allows administrators to deploy, manage, and monitor Azure resources. It also allows administrators to apply access controls to all services in a resource group with role-based access control (RBAC), which is available in ARM.

Architecture:

The high-level architecture represents an Azure availability system that runs an application load balancer, Virtual Machine Scale Set (VMSS), and a subset of virtual machines running NGINX App Protect WAF software behind it. A load balancer is supposed to manage TLS certificates, receive traffic, and distribute it across all Azure VMs (Virtual Machine). NGINX App Protect WAF VM instance inspects traffic and forwards it to the application backend. The VMSS scales up the virtual machines based on the rules configured.

 

Major components:

• ARM template (GIT repository which contains the source of data plane and security policy configurations): 
  The pipeline runs the ARM templates which will connect to the Azure portal and deploy the solution. Also, a user can directly login to the Azure portal and run the template under the Template Spec which will deploy the solution directly.  

• Auto-scaling (data plane based on official NGINX App Protect WAF Azure VM Images): 
  The solution uses a Virtual Machine Scale Set configured to spin up new NGINX App Protect WAF Virtual Machine instances based on incoming traffic volumes. This removes operational headaches and optimizes costs as the Scale Set adjusts the amount of computing resources and charges a user on an as-you-go basis. 

• Visibility (dashboards displaying the NGINX App Protect WAF health and security data): 
  The template sets up a set of visibility dashboards in Azure Dashboard Service. Data plane VMs send logs and metrics to the Dashboard service that visualizes incoming data as a set of charts and graphs showing NGINX App Protect WAF health and security violations. 
• Example:
  

   

These three components form a complete NGINX App Protect WAF solution that is easy to deploy, doesn’t impose any operational headache, and provides handy interfaces for NGINX App Protect WAF configuration and visibility right out of the box. 

Automation:

The following diagram represents the end-to-end automation solution. GitHub is being used as the CI/CD platform. The GitHub pipeline sets up and configures the entire system from the ground up. The first stage creates all necessary Azure resources such as Azure AS (Analysis Service), VMSS, Virtual Machines, and the Load Balancer. The second stage sends test traffic (including malicious requests) and verifies the solution.

 

Project Repository:

f5devcentral/azure-waf-solution-template (github.com)

Steps:

• Pre-requisites: 
• Azure account and credentials. 
• Admin privileges to your Azure resource group. 
• Service principal and password (follow link to create the service principal (https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli)) 
• Resource group created in the Azure portal. 
• Add the below variables under github-->secrets 
          AZURE_SP --> Azure service principle 
          AZURE_PWD --> Azure client password 
• Add your resource group and other params under Lib/azure-user-params file. mandatory params: 
          ResourceGroup
          TenandId
          SubscriptionId 
• On GitHub.com, navigate to the main page of the repository and below repository name, click Actions tab. 
• In the left sidebar select the workflow with name "Resource Manager Template Deployment in Azure". 
• Above the list of workflow runs, select Run workflow. 

LOG:

 

Conclusion:

Using a template to deploy a cloud WAF significantly reduces the time spent on WAF deployment and maintenance. It also provides a complete and easy-to-use solution to deploy resources and verify the NGINX App Protect WAF security solution on the Azure platform in any location. Handy interfaces for configuration and visibility turn this project into a boxed solution, allowing a user to easily operate a WAF and focus on application security.