F5 BIG-IQ Centralized Management Lab > BIG-IQ All Labs > Class 8: BIG-IQ Web Application Security > Module 1: Advanced Web Application Firewall (WAF) on BIG-IQ Source | Edit on

Lab 1.6: Deploy a WAF with BIG-IQ and AS3 using an ASM policy on BIG-IQ (new 8.0)¶

Note

Estimated time to complete: 20 minutes

Lab environment access¶

If you have not yet visited the page Getting Started, please do so.

Workflow¶

Larry creates the ASM policy in blocking mode on the BIG-IQ.
David creates the AS3 template and reference ASM policy created by Larry in the template.
David assigns the AS3 template to Paula.
Paula creates her application service using the template given by david.
Paula runs tests against her application in staging environment.
Larry tunes the policy until there are no test failures in the pipeline.
Paula promotes the policy to production environment.

Prerequisites¶

1. First make sure your device has ASM module discovered and imported for SEA-vBIGIP01.termmarc.com under Devices > BIG-IP DEVICES.

2. Check if the Web Application Security service is Active under System > BIG-IQ DATA COLLECTION > BIG-IQ Data Collection Devices.

ASM Policy creation (Larry)¶

Let’s first create the default Advance WAF policy on BIG-IQ.

Warning

Compared with the other lab Deploy a WAF with BIG-IQ and AS3 using an ASM policy on BIG-IP, Larry does not need to deploy the WAF policy on BIG-IQ as BIG-IP will fetch the policy defined in the AS3 declaration within the template.

Login to BIG-IQ as larry.
Go to Configuration > Security > Web Application Security > Policies and create a new policy called asm-lab4.

AS3 WAF template creation (David)¶

Until now we used a default AS3 template out-of-the-box (available on https://github.com/f5devcentral/f5-big-iq) for deploying an application service. It is a good practice to clone the default AS3 templates and use them more tailored to your custom needs.

Login as david and Go to the Applications tab > Applications Templates and select AS3-F5-HTTPS-WAF-external-url-lb-template-big-iq-default-<version> and press Clone.

Give the cloned template a name: AS3-LAB-HTTPS-WAF-custom-template2 and click Clone.

Open the template AS3-LAB-HTTPS-WAF-custom-template2 and select the WAF_Policy AS3 class. Check the Override chec kbox for each of the below properties:

url: https://10.1.1.4/mgmt/cm/asm/policy-files/download/Common~asm-lab4/14.1.0
skipCertificateCheck: true
authentication:
- method: basic
- username: admin
- passphrase:
  
  ciphertext: cHVycGxlMTIz
  
  JOSE header: eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0
enforcementMode: blocking

Note

In order to get the value of the Ciphertext, we convert the admin password (purple123) using https://www.url-encode-decode.com/base64-encode-decode/ More details on the AS3 Certificate class here.

Before paula can use this AS3 template, david needs to update her role. Use the previous steps in Lab 3.2 to make sure AS3 Template AS3-LAB-HTTPS-WAF-custom-template2 is assigned to Application Creator VMware custom role used by Paula.

AS3 WAF application service deployment (Paula)¶

Now let’s create the WAF application service using AS3 & BIG-IQ.

Login as paula and select previously created LAB_module3 Application and click Create.
Click Create to create an Application Service:

Application properties:

Grouping = New Application or Part of an Existing Application
Application Name = LAB_module3

Select an Application Service Template:

Template Type = Select AS3-LAB-HTTPS-WAF-custom-template2 [AS3]

General Properties:

Application Service Name = https_waf_url_app_service
Target = SEA-vBIGIP01.termmarc.com
Tenant = tenant4

Pool

Members: 10.1.20.123

TLS_Server. Keep default.

WAF_Policy. Keep default.

Certificate

privateKey: use private key example below
certificate: use certificate example below

Service_HTTPS

Virtual addresses: 10.1.10.126

Analytics_Profile. Keep default.

Security_Log_Profile. Keep default.

Click Create.
Check the application service https_waf_url_app_service has been created under Application LAB_module3.

Note

If not visible, refresh the page. It can take few seconds for the application service to appears on the dashboard.

What is the enforced Protection Mode?

Application Tests & Validation (Paula)¶

From the lab environment, launch a remote desktop session to have access to the Ubuntu Desktop.
Open Chrome and navigate to the following URL: https://10.1.10.126 which open the web application protected by the WAF policy.
We will now install the F5 WAF tester tool. Connect via SSH to the Ubuntu Lamp Server and execute:

f5student@ip-10-1-1-5:~$ sudo pip install git+https://github.com/f5devcentral/f5-waf-tester.git

f5student@ip-10-1-1-5:~$ sudo f5-waf-tester --init
[BIG-IP] Host []: 10.1.1.7
[BIG-IP] Username []: admin
[BIG-IP] Password []: purple123
ASM Policy Name []: /tenant4/https_waf_url_app_service/WAF_Policy
Virtual Server URL []: https://10.1.10.126
Blocking Regular Expression Pattern [<br>Your support ID is: (?P<id>\d+)<br>]:
Number OF Threads [25]:
[Filters] Test IDs to include (Separated by ',') []:
[Filters] Test Systems to includ (Separated by ',') []:
[Filters] Test Attack Types to include (Separated by ',') []:
[Filters] Test IDs to exclude (Separated by ',') []:
[Filters] Test Systems to exclude (Separated by ',') []:
[Filters] Test Attack Types to exclude (Separated by ',') []:

Now, let’s launch an attack on this application service..

On the Ubuntu Lamp Server, run:

f5student@ip-10-1-1-5:~$ sudo f5-waf-tester
09-06-20 02:39:44 INFO Test 100000002/parameter pass
09-06-20 02:39:44 INFO Test 100000003/parameter pass
09-06-20 02:39:44 INFO Test 100000005/url pass
09-06-20 02:39:44 INFO Test 100000004/header pass
09-06-20 02:39:44 INFO Test 100000001/url pass
09-06-20 02:39:44 INFO Test 100000005/parameter pass
09-06-20 02:39:44 INFO Test 100000006/parameter pass
09-06-20 02:39:44 INFO Test 100000006/header pass
09-06-20 02:39:44 INFO Test 100000004/url pass
09-06-20 02:39:44 INFO Test 100000001/header pass
09-06-20 02:39:44 INFO Test 100000001/parameter pass
09-06-20 02:39:44 INFO Test 100000003/header pass
09-06-20 02:39:44 INFO Test 100000002/url pass
...
   "100000024": {
      "CVE": "",
      "attack_type": "Server Side Request Forgery",
      "name": "SSRF attempt - Local network IP range 10.x.x.x",
      "results": {
      "request": {
         "expected_result": {
            "type": "signature",
            "value": "200020201"
         },
         "pass": false,
         "reason": "Attack Signature is not in the ASM Policy",
         "support_id": ""
      }
      },
      "system": "All systems"
   }
},
"summary": {
   "fail": 3,
   "pass": 45
}

Notice after few seconds the BIG-IQ dashboard reporting the attack.

Expend the dimensions and filter on Blocked attack to see attacks being blocked by the WAF policy.

Larry tunes the policy until there are no test failures in the pipeline.
Paula promotes the policy to production environment.

Previous Next