In modern web applications, user file uploads represent one of the most critical attack surfaces. Whether it is an insurance portal receiving accident photos, an HR management system collecting applicant resumes, or a corporate financial portal accepting spreadsheet invoices, accepting files from untrusted external clients poses severe security risks.
While Web Application Firewalls like F5 BIG-IP Advanced WAF (AWAF) excel at mitigating OWASP Top 10 web vulnerabilities (such as SQL Injection, Cross-Site Scripting, and Parameter Tampering), deep behavioral analysis of complex files requires an enterprise sandbox detonation engine. Check Point ThreatCloud AI Zero-Day Protection (Threat Emulation & ThreatCloud API) is an industry-leading threat emulation engine that subjects unknown binaries and documents to rigorous behavioral detonation within an isolated virtual sandbox.
In this technical article, we present a fully automated F5 iApp Solution that bridges F5 BIG-IP AWAF with Check Point ThreatCloud AI sandbox. We explore the real-world engineering challenges solved and provide a complete, step-by-step deployment guide.
Integration Highlights
F5 BIG-IP Advanced WAF can be deployed wherever your applications live:
- On-Premises: BIG-IP hardware appliances or Virtual Editions (VE) running on VMware vSphere, KVM, or Nutanix.
- Public Cloud: Native cloud instances in AWS, Microsoft Azure, or Google Cloud Platform (GCP).
- Private Cloud / Hybrid: Red Hat OpenShift, OpenStack, or hybrid multi-cloud topologies.
Regardless of where BIG-IP resides, the integration make possible it communicates securely with Check Point Threat Prevention, using the global Check Point ThreatCloud SaaS API.
Instead of routing file traffic through complex external chains, the BIG-IP utilizes an internal Sideband Connection:
- Out-of-Band TLS Offload: The iApp creates an internal sideband virtual server with dedicated ServerSSL profiles. This allows TMM (Traffic Management Microkernel) to open independent, highly optimized HTTPS sessions directly to the Check Point API.
- Zero Backend Code Changes: Your backend web applications remain completely unaware of the inspection layer. No application-level SDKs or code refactoring are required.
- Transport Resilience: Built-in error trapping automatically detects and recovers from dropped TCP connections or cloud gateway keep-alive timeouts, ensuring long-running sandboxing jobs never drop.
The integrated solution implements three different phases:
| Phase | Action | Operation & Latency |
|---|---|---|
| Phase 1: Ingestion & ThreatCloud Query | File extracted & hashed | Intercepts multipart payload, calculates SHA-256, and queries ThreatCloud cache. If known, completes in < 500ms. |
| Phase 2: Sandbox Upload | Zero-Day binary streamed | If hash is unknown (1004 NOT_FOUND), the binary is securely uploaded via multipart HTTP to Check Point API Service. |
| Phase 3: Adaptive Polling & Enforcement | Behavioral detonation & verdict | Polls the sandbox at adaptive intervals (10s default) up to a max timeout (360s default). Benign: request released to pool. Malicious: blocked + AWAF Support ID logged. |
To eliminate user confusion during sandbox detonation cycles, the solution features an optional, non-intrusive Client Progress Banner:
- Dynamic HTML Injection: Injected automatically before </body> on HTML responses.
- Upload-Only Activation: JavaScript hooks only activate on real POST, PUT, or PATCH file submissions; routine site browsing (GET requests, page transitions) is completely ignored.
- 5-Second Verification Delay: Keeps the banner visible with a live countdown (Closing in 5s… 4s…) once inspection finishes, allowing the user to clearly see the benign verdict. An explicit (×) close button is also provided for instant dismissal.
Configurable iApp Deployment Options
The iApp template provides an intuitive, form-driven interface to customize every aspect of the integration:
| Section | Setting | Available Choices | Default Value | Description |
|---|---|---|---|---|
| API Target | Service Type | cloud, appliance | cloud | Toggle between Check Point Cloud API and on-premise SandBlast Appliance. |
| API Hostname / IP | FQDN or IP address | te-api.checkpoint.com | Target API destination for sideband inspection. | |
| API Key | String | User provided | Authentication key for Check Point Threat Emulation. | |
| Emulation Features | te, te,av | te | te = Threat Emulation (Sandbox), av = Antivirus. | |
| Protection Scope | Protected Virtual Server | Drop-down list | Select existing VS | Client-facing virtual server handling web traffic. |
| Virtual Server Action | attach, detach | attach | Easily attach or cleanly detach the iRule during maintenance. | |
| Sandbox Polling | Polling Timeout | Seconds (Integer) | 360 | Maximum time to hold transaction waiting for sandbox detonation. |
| Polling Interval | Seconds (Integer) | 10 | Frequency of sideband polling queries to Check Point. | |
| Client UX | Progress Banner | enabled, disabled | disabled | Toggles dynamic client progress banner injection. |
| Banner Visual Theme | dark, light | dark | High-contrast visual styling matching your application branding. | |
| Enforcement | Malicious Action | block, alert | block | Drop/block malicious requests or alert-only for passive auditing. |
| Debug Logging | enabled, disabled | disabled | Emits detailed trace logs to /var/log/ltm for troubleshooting. |
Step-by-Step Deployment Guide
Deploying the solution is straightforward using the BIG-IP Application Services (iApp) interface.
Prerequisites
- F5 BIG-IP running TMOS v14.1.x, v15.1.x, v16.1.x, or v17.x with AWAF provisioned.
- Outbound internet route for BIG-IP to reach te-api.checkpoint.com:443 (via default gateway or internal proxy).
- Valid Check Point Threat Emulation API Key.
- Target Protected Virtual Server already configured with WAF policy attached.
Step 1: Import the iApp Template
- Download f5_checkpoint_threat_prevention.tmpl.
- In the BIG-IP Web UI, navigate to iApps > Templates > Templates > Import…
- Select the template file and click Import.
Step 2: Instantiate the Application Service
- Navigate to iApps > Application Services > Applications > Create…
- Name: Enter a descriptive name (e.g., cp_upload_security).
- Template: Select f5_checkpoint_threat_prevention.
- Configure the relative parameters within the iApp deployment.
- Click Finished.
The iApp will automatically create the sideband pool, SSL profile, internal sideband virtual server, configuration data group, and attach the inspection iRule to your protected virtual server.
Summary
Combining F5 BIG-IP Advanced WAF with Check Point ThreatCloud API establishes a proactive defense-in-depth security posture. By intercepting file uploads at the application edge, enterprise networks can prevent advanced malware, ransomware, and zero-day evasion techniques from ever reaching backend application tiers.
The packaged iApp automates the underlying complexity—handling object scoping, sideband connection resilience, AWAF event decoupling, and interactive client feedback—delivering an enterprise-ready solution with turnkey simplicity.