Scale Your DMZ with F5 Distributed Cloud Services

Modern DMZ Challenges

The task of securing and optimizing DMZ (Demilitarized Zone) environments is becoming increasingly complex. A traditional DMZ is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, typically the internet. It serves as a buffer zone between the secure internal network and external networks, providing an additional layer of security to ensure that potentially malicious traffic does not reach critical internal systems directly.

To make data center applications accessible on the internet, IT teams traditionally handle several DMZ-related networking operations, including:

NAT (Network Address Translation): Converting public IP addresses to private server IPs.
DNS Resolution: Ensuring domain names resolve to the correct IP addresses.
Load Balancing: Distributes incoming application traffic across multiple servers to ensure reliability, optimal resource utilization, and high availability
Security Operations: Deploying protections such as Web Application Firewalls (WAF) and Distributed Denial of Service (DDoS) mitigation.

With modern microservices-based and API-rich applications handling these DMZ operations at the App Services tier (see highlighted in blue below) or on a per-application basis adds complexity, resulting in some additional challenges impacting app delivery, such as:

Management and “stitching” of multiple app DMZ environments at scale
Standardized, consistent policy across overall data center deployments
Handling unwanted traffic (bad actors and bots) at the global services tier

The end result is that modern DMZ requirements need to keep pace with modern microservices-based API-heavy app architectures. Without uniform security or visibility when managing multiple sites across several datacenters or clouds, organizations struggle to maintain visibility and enforce security at scale.

Scalable DMZ Solution

F5 Distributed Cloud (XC) Services address the modern DMZ challenges by centralizing networking and security functions at the network edge. This includes volumetric DDoS protection, API protection, and Bot mitigation as part of WAF configurations at the network edge.

All of this is enabled through the configuration and operation of a Customer Edge (CE) in various on-premises environments, such as VMWare, OpenShift, Nutanix, or F5’s own rSeries appliances. This results in a “separation of duties” for the App Services Tier and Global Services Tier as follows:

(1) Global Services Tier

Keeps unwanted traffic off your infrastructure
Broad-spectrum volumetric DDoS mitigation (L3/L)
Anti-abuse, including bot/fraud detection and mitigation
Ease of securely exposing applications to the public internet by simplifying or eliminating manual handling of routing and other networking tasks
Simplifying workflows for pushing out App DMZ toward the network edge
Standard company app security policy / policies used by all apps

(2) App Services Tier

Retains important / integrated security controls and policy, including automation and CI/CD pipelines at your app
Workload-specific security policy definitions and enforcement
Closest to the application and Line of Business / security teams managing specific app services

Building a Scalable DMZ

The configuration described below follows the detailed guide in the F5 Devcentral GitHub repo, which provides steps for creating a secure DMZ environment for a sample application (also included in the GitHub repo) using the F5 rSeries hardware platform.

➡️ See here for a reference architecture with details about which F5 rSeries platforms run the F5 XC Customer Edge (CE)

The setup includes two Data Centers, each having an origin pool that connects to the XC site installed in F5 rSeries. The XC site is connected to the BIG-IP, where a Virtual Server is configured. The included sample app is located inside the Virtual Server Pool of the BIG-IP appliance, and is protected by Web Application Firewall (WAF), DDoS Protection, and Bot Protection; it also leverages the API Discovery feature of the XC platform.

The steps include the following:

Configuring the BIG-IP on F5 rSeries;
Configuring of the Customer Edge (CE) Sites on F5 rSeries;
Demo application deployment in the Data Center;
Configuring the XC Cloud Secure Mesh Site and combining them into a single Virtual Site;
Exposing the application to the Internet using the HTTP Load Balancer;
Protecting the application with a Web Application Firewall (WAF), DDoS Protection, Bot Protection, and API Discovery;
Upgrading the solution with a second Data Center and configuring the HTTP Load Balancer for a complete DMZ configuration.

The end result is a modern topology for flexible and scalable networking connectivity, enhanced performance, and protection captured in the following diagram:

At the core of this solution is the Customer Edge (CE), which allows organizations to establish Secure Mesh Sites in various environments. By integrating CE with F5 XC, organizations can create a Virtual Site, simplifying access management while allowing for future scalability.

Once the Secure Mesh Site is established, application traffic can be exposed and optimized using an HTTP Load Balancer within F5 XC. This enables efficient routing, automated certificate management, and secure connectivity to backend application services.

For organizations requiring failover and redundancy, additional Secure Mesh Sites and Virtual Sites can be configured across multiple data centers. This ensures that applications remain accessible even if one data center experiences downtime, improving resilience and disaster recovery capabilities.

Solution Demo

Conclusion: A Modern Approach to Scaling DMZ

By leveraging F5 Distributed Cloud Services, organizations can transition from traditional, fragmented DMZ architectures to a more scalable, cloud-integrated security model. Centralizing networking and security functions at the edge prevents unwanted traffic from reaching core infrastructure, ensures policy consistency across deployments, and simplifies multi-cloud networking.

For organizations looking to implement this model in their own environments, the F5 DevCentral GitHub repository provides a detailed Workflow Guide covering the step-by-step setup process. This guide offers a structured approach to configuring Secure Mesh Sites, deploying CEs, and integrating application security services, enabling teams to modernize their DMZ architecture with confidence.

As security and networking challenges evolve, adopting a scalable, edge-based DMZ strategy ensures greater efficiency, stronger security, and seamless application delivery across hybrid multi-cloud environments.