F5 Distributed Cloud WAAP Use Cases Demo

A collection of managed security services called the xC WAAP offers comprehensive protection for distributed app services. In our example, to simulate a distributed workload, the app services are deployed across numerous vK8s pods in various xC vK8s regions supported by F5 Global PoPs; the same concept would apply to any equivalent deployment on any cloud (s).

With a standard sample app hosted in a docker container and maintained by xC services, the demo is designed to be self-sufficient as a simple method to onramp onto the xC platform. It also includes a separate "utility" tools service that was specifically created to give the tooling for simulating user traffic and attacks (such WAF or bot) in order to demonstrate various WAAP use-cases.

• App docker container: Contains the Start Ratings app that consists of a simple backend service that exposes an API and a front-end that consumes the API.
• Test Tool: Web-based service that contains purpose-built scripts & utilities for testing the status of the WAAP for the deployed sample app only.

WAF testing, BoT testing and checking the status of WAAP and Bot Defense protection may all be done using the Test tool. In order to prevent problems with custom domains outside of the automatically generated.ac.vh.ves.io host, the purpose is to explain how to construct an HTTP load balancer without a domain name.

Several of the fundamental principles of F5 Distributed Cloud (XC) are highlighted in this lab environment.

You will be simulating a customer during the lab who needs to verify the safety of an application. The objective is to verify the applications safety of on-premises or application on cloud before and after enabling F5 Distributed Cloud Console WAAP Capabilities by sending attacks to the application.

The intended goal of this lab is to successfully access the F5 Distributed Cloud Console and enable all the below WAAP use cases:

1.) Application protection

2.) API protection

3.) BoT defense

4.) DDoS protection

Also send simulator attacks to the sample app and verify the F5 Xc console WAAP Protection after enabling the WAAP capabilities.

The lab contains the following components:

• 1 x Ubuntu jumpbox
• 1 x F5 Distributed Cloud(xc) Console access