Architecture¶
Solution components¶
F5 API Security Local Edition consists of the following logical components, all hosted within the customer environment:
Component |
Description |
|---|---|
Collector |
Receives HTTP metadata exported by BIG-IP over TCP 6514 |
Analysis Engine |
Continuously processes ingested metadata and reconstructs API endpoints |
Data Store |
Local persistent storage for discovered endpoints, statistics, and configuration |
Web UI |
Local administrative and operational interface, served on TCP 8000 |
Management Connector |
Outbound channel to BIG-IP for enforcement actions over TCP 443 |
Traffic flow¶
Figure 1. High-level architecture and traffic flow between BIG-IP and F5 API Security Local Edition.¶
End-to-end traffic flow follows five steps:
Client traffic reaches the API Virtual Server on BIG-IP. An iRule is attached to this virtual server.
The iRule sends a copy of the HTTP metadata to an Internal Logging Pool.
The Internal Logging Pool forwards the metadata to an Internal Logging Virtual Server on BIG-IP.
The Internal Logging Virtual Server forwards the metadata to an External Collector Pool.
The External Collector Pool delivers the metadata to the API Security Collector over TCP 6514.
Network topology¶
Figure 2. Recommended network topology. BIG-IP exports HTTP metadata to API Security over the data path, and API Security communicates back to BIG-IP over the management path for enforcement actions.¶
The product requires three connectivity paths between BIG-IP and the API Security host.
Path |
Direction |
Port |
Purpose |
|---|---|---|---|
Data |
BIG-IP → API Security |
TCP 6514 |
HTTP metadata ingestion (HSL with TLS) |
Management |
API Security → BIG-IP |
TCP 443 |
iControl REST calls for enforcement |
Administration |
User → API Security |
TCP 8000 |
Web UI access |
Discovery and management connectivity¶
The product distinguishes between two connectivity types:
Discovery connectivity is established automatically once BIG-IP is configured to export metadata logs to the API Security Collector. No registration is required for discovery to begin.
Management connectivity is established by manually registering BIG-IP devices in the API Security UI. This bidirectional channel is required only for enforcement actions, such as blocking shadow endpoints.