F5 BIG-IQ Centralized Management Lab > BIG-IQ All Labs > Class 8: BIG-IQ Web Application Security > Module 1: Advanced Web Application Firewall (WAF) on BIG-IQ Source | Edit on

Lab 1.5: Deploy a WAF with BIG-IQ and AS3 using an ASM policy on GitHub¶

Note

Estimated time to complete: 20 minutes

Lab environment access¶

If you have not yet visited the page Getting Started, please do so.

Workflow¶

Larry upload the ASM policy in blocking mode on GitHub.
David creates the AS3 template and reference ASM policy URL created by Larry using URL.
David assigns the AS3 template to Paula.
Paula creates her application service using the template given by david.
Paula runs tests against her application in staging environment.
Larry tunes the policy until there are no test failures in the pipeline.
Paula promotes the policy to production environment.

Prerequisites¶

1. First make sure your device has ASM module discovered and imported for SEA-vBIGIP01.termmarc.com under Devices > BIG-IP DEVICES.

2. Check if the Web Application Security service is Active under System > BIG-IQ DATA COLLECTION > BIG-IQ Data Collection Devices.

ASM Policy creation (Larry)¶

In this lab, we are going to use the ASM templates available on the F5 devcentral GitHub repository.

We are going to use the WAF policy template called owasp-auto-tune-v1.1.xml.

AS3 WAF template creation (David)¶

Login as david and Go to the Applications tab > Applications Templates and select AS3-F5-HTTPS-WAF-external-url-lb-template-big-iq-default-<version>.

Select the WAF_Policy AS3 class. Look at the URL of the WAF policy stored on GitHub.

Before paula can use this AS3 template, david needs to update her role. Use the previous steps in Lab 3.2 to make sure AS3 Template AS3-F5-HTTPS-WAF-external-url-lb-template-big-iq-default is assigned to Application Creator VMware custom role used by Paula.

AS3 WAF application service deployment (Paula)¶

Now let’s create the WAF application service using AS3 & BIG-IQ.

Login as paula and select previously created LAB_module3 Application and click Create.
Click Create to create an Application Service:

Application properties:

Grouping = New Application or Part of an Existing Application
Application Name = LAB_module3

Select an Application Service Template:

Template Type = Select AS3-F5-HTTPS-WAF-external-url-lb-template-big-iq-default [AS3]

General Properties:

Application Service Name = https_waf_url_app_service
Target = SEA-vBIGIP01.termmarc.com
Tenant = tenant4

Pool

Members: 10.1.20.123

TLS_Server. Keep default.

WAF_Policy. Keep default.

Enforcement Mode: blocking

Certificate

privateKey: use private key example below
certificate: use certificate example below

Service_HTTPS

Virtual addresses: 10.1.10.126

Analytics_Profile. Keep default.

Security_Log_Profile. Keep default.

Click Create.
Check the application service https_waf_url_app_service has been created under Application LAB_module3.

Note

If not visible, refresh the page. It can take few seconds for the application service to appears on the dashboard.

What is the enforced Protection Mode?

Application Tests & Validation (Paula)¶

From the lab environment, launch a remote desktop session to have access to the Ubuntu Desktop.
Open Chrome and navigate to the following URL: https://10.1.10.126 which open the web application protected by the WAF policy.
We will now install the F5 WAF tester tool. Connect via SSH to the Ubuntu Lamp Server and execute:

f5student@ip-10-1-1-5:~$ sudo pip install git+https://github.com/f5devcentral/f5-waf-tester.git

f5student@ip-10-1-1-5:~$ sudo f5-waf-tester --init
[BIG-IP] Host []: 10.1.1.7
[BIG-IP] Username []: admin
[BIG-IP] Password []:
ASM Policy Name []: /tenant4/https_waf_url_app_service/WAF_Policy
Virtual Server URL []: https://10.1.10.126
Blocking Regular Expression Pattern [<br>Your support ID is: (?P<id>\d+)<br>]:
Number OF Threads [25]:
[Filters] Test IDs to include (Separated by ',') []:
[Filters] Test Systems to include (Separated by ',') []:
[Filters] Test Attack Types to include (Separated by ',') []:
[Filters] Test IDs to exclude (Separated by ',') []:
[Filters] Test Systems to exclude (Separated by ',') []:
[Filters] Test Attack Types to exclude (Separated by ',') []:

Now, let’s launch an attack on this application service.

On the Ubuntu Lamp Server, run:

f5student@ip-10-1-1-5:~$ sudo f5-waf-tester
09-06-20 02:39:44 INFO Test 100000002/parameter pass
09-06-20 02:39:44 INFO Test 100000003/parameter pass
09-06-20 02:39:44 INFO Test 100000005/url pass
09-06-20 02:39:44 INFO Test 100000004/header pass
09-06-20 02:39:44 INFO Test 100000001/url pass
09-06-20 02:39:44 INFO Test 100000005/parameter pass
09-06-20 02:39:44 INFO Test 100000006/parameter pass
09-06-20 02:39:44 INFO Test 100000006/header pass
09-06-20 02:39:44 INFO Test 100000004/url pass
09-06-20 02:39:44 INFO Test 100000001/header pass
09-06-20 02:39:44 INFO Test 100000001/parameter pass
09-06-20 02:39:44 INFO Test 100000003/header pass
09-06-20 02:39:44 INFO Test 100000002/url pass
...
   "100000024": {
      "CVE": "",
      "attack_type": "Server Side Request Forgery",
      "name": "SSRF attempt - Local network IP range 10.x.x.x",
      "results": {
      "request": {
         "expected_result": {
            "type": "signature",
            "value": "200020201"
         },
         "pass": false,
         "reason": "Attack Signature is not in the ASM Policy",
         "support_id": ""
      }
      },
      "system": "All systems"
   }
},
"summary": {
   "fail": 3,
   "pass": 45
}

Notice after few seconds the BIG-IQ dashboard reporting the attack.

Expend the dimensions and filter on Blocked attack to see attacks being blocked by the WAF policy.

Larry tunes the policy until there are no test failures in the pipeline.
Paula promotes the policy to production environment.

Previous Next