I have to protect some Rest API with ASM.
I saw that there are 2 different API protection features :
1) Create an ASM policy with the API security template where you just import the swagger file.
2) Use the guided configuration tool and create an API security protection. I can see that this also add some APM features to manage authentication
What is the difference between the 2 ?
I do not need to manage authentication at F5 level, which one should I use ?
the APM Policy can
The AWAF Policy can
To my surprise the AWAF Policy can import an Open API Spec file but does not build a list of allowed URLs (methods / endpoints) from it.
Referring to your question. This is my opinion below:
1) Swagger file import to F5 ASM / AWAF
Generally the Swagger file will help to security team to reduce the time and false postivie to understand your API service has been protected by WAF/API security solution. I will call this is a "Positive Security Model".
Reference from Introduction to Application Security Manager (f5.com)
" Positive security features indicate which traffic has a known degree of trust, such as which file types, URLs, parameters, or IP address ranges can access the web server."
Then the F5 ASM / AWAF will not touch any authentication method in your API services.
2) API security protection
Reference from Configure API security protection using the F5 BIG-IP Guided Configuration
Seems to F5 APM will interact with session-based level of API since authentication until request/response the data.
3) I do not need to manage authentication at F5 level, which one should I use ?
Normally base on the many criteria within your solution or organization. Below is based on my experience:
The WAF operation team mostly not understand how your API service working, how your API authentication working. I'm try to say you should move API authentication management to API gateway level. But our WAF will help them to secure the API services.
Hope it helpfull.