F5 Hybrid Security Architectures (Part 4 - F5 XC BOT and DDoS Defense and BIG-IP Advanced WAF)

Introduction

For those of you following along with the F5 Hybrid Security Architectures series, welcome back!  If this is your first foray into the series and would like some background, have a look at the intro article.  This series is using the F5 Hybrid Security Architectures GitHub repo and CI/CD platform to deploy F5 based hybrid security solutions based on DevSecOps principles.  This repo is a community supported effort to provide not only a demo and workshop, but also a stepping stone for utilizing these practices in your own F5 deployments.  If you find any bugs or have any enhancement requests, open an issue, or better yet contribute!

Here in our fourth example solution, we will be using Terraform to deploy an application server running the OWASP Juice Shop application serviced by a F5 BIG-IP Advanced WAF Virtual Edition.  We will supplement this with F5 Distributed Cloud Web App and API Protection to provide BOT and DDoS Defense at the Edge.  Everything will be tied together using GitHub Actions for CI/CD and Terraform Cloud to maintain state.

Distributed Cloud WAAP:  Available for SaaS-based deployments in a distributed environment that reduces operational overhead with an optional fully managed service.  

BIG-IP Advanced WAF:  Available for on-premises / data center and public or private cloud (virtual edition) deployment, for robust, high-performance web application and API security with granular, self-managed controls.

Bot Defense

The F5 Distributed Cloud Bot Defense is an advanced security add-on included with the F5 Web Application and API Protection (WAAP) service, providing seamless integration for real-time safeguarding of your web applications and APIs against a diverse range of attacks. This feature enables enterprises to benefit from advanced bot defense and sophisticated security monitoring to eliminate malicious traffic targeting user accounts, content scraping, and ad fraud.

DDoS Detection

F5 Distributed Cloud WAAP safeguards applications from volumetric L3-L7 DDoS attacks at the network edge, allowing the app to remain globally accessible while avoiding disruption to genuine customers. Additionally, the Distributed Cloud WAAP furnishes insights into both past and ongoing attacks that have been mitigated, empowering proactive measures to thwart malicious individuals.

XC WAF + BIG-IP Advanced WAF Workflow

GitHub Repo: 

F5 Hybrid Security Architectures

Prerequisites:

• F5 Distributed Cloud Account (F5 XC)
• Create an F5 XC API certificate
• AWS Account - Due to the assets being created, free tier will not work.
  NOTE: You must be subscribed to the F5 BIG-IP AMI being used in the AWS Marketplace.
• Terraform Cloud Account
• GitHub Account

Assets:

• xc: F5 Distributed Cloud WAAP
• bigip-base: F5 BIG-IP Base deployment
• bigip-awaf: F5 BIG-IP Advanced WAF
• infra: AWS Infrastructure (VPC, IGW, etc.)
• juiceshop: OWASP Juice Shop test web application

Tools:

• Cloud Provider: AWS
• Infrastructure as Code: Terraform
• Infrastructure as Code State: Terraform Cloud
• CI/CD: GitHub Actions

Terraform Cloud:

Workspaces: Create a workspace for each asset in the workflow chosen

Workspace Sharing: Under the settings for each Workspace, set the Remote state sharing to share with each Workspace created.

Your Terraform Cloud console should resemble the following:

Variable Set: Create a Variable Set with the following values.
IMPORTANT: Ensure sensitive values are appropriately marked.

• AWS_ACCESS_KEY_ID: Your AWS Access Key ID - Environment Variable
• AWS_SECRET_ACCESS_KEY: Your AWS Secret Access Key - Environment Variable
• AWS_SESSION_TOKEN: Your AWS Session Token - Environment Variable
• VOLT_API_P12_FILE: Your F5 XC API certificate. Set this to api.p12 - Environment Variable
• VES_P12_PASSWORD: Set this to the password you supplied when creating your F5 XC API key. - Environment Variable
• ssh_key: Your ssh key for access to created BIG-IP and compute assets. - Terrraform Variable
• admin_src_addr:  The source address of your administrative workstation. - Terraform Variable
  Environment Variable
• tf_cloud_organization: Your Terraform Cloud Organization name - Terraform Variable

Your Variable Set should resemble the following:

GitHub:

Fork and Clone Repo: F5 Hybrid Security Architectures 

Actions Secrets: Create the following GitHub Actions secrets in your forked repo

• P12: The base64 encoded F5 XC API certificate
• TF_API_TOKEN: Your Terraform Cloud API token
• TF_CLOUD_ORGANIZATION: Your Terraform Cloud Organization
• TF_CLOUD_WORKSPACE_workspace: Create for each workspace used in your workflow. EX: TF_CLOUD_WORKSPACE_BIGIP_BASE would be created with the value bigip-base

Your GitHub Actions Secrets should resemble the following:

Deployment Workflow:

project_prefix = "Your project identifier"
resource_owner = "You"
aws_region = "Your AWS region" ex: us-west-1
azs = "Your AWS availability zones" ex: ["us-west-1a", "us-west-1b"] 

#Assets
nic = false
nap = false
bigip = true
bigip-cis = false

f5_ami_search_name = "F5 BIGIP-16.1.3* PAYG-Adv WAF Plus 25Mbps*"
aws_secretmanager_auth = false

#Provisioning set to nominal or none
asm = "nominal"
apm = "none"

awaf_config_payload = "awaf-config.json"

#XC Tenant and Namespace
api_url = "https://<YOUR TENANT>.console.ves.volterra.io/api"
xc_tenant = "Your tenant id available in F5 XC Administration section Tenant Overview"
xc_namespace = "Your XC Namespace"
app_domain = "Your APP FQDN"

#XC WAF
xc_waf_blocking = true

#XC Bot Defense
xc_bot_def = true

#XC DDoS
xc_ddos_pro = true