How To - Place a website or application behind the F5 security appliance

 

Audience

This How To document is intended for Infrastructure team members, or outside IT administrators for websites or applications interested in utilizing the F5 security appliance.

 

Overview

This document will assist in moving websites or applications behind the F5 security appliance. Although the intention is to make most websites and applications public facing, it is possible to place a website or application behind the F5 but still restrict to only on-prem/UPMC access (i.e. Test/Dev environments).

Current website or application informational gathering & preparation

Identify the status of the website or application

Starting Point / Environmental Context

  1. Does the website or application have its own FQDN? This FQDN must be separate from the servers FQDN. This becomes an issue if the site FQDN is for both.
  2. Is the website or application in a current operational status?
  3. Does the website answer on both HTTP & HTTPS?
  4. Is the SSL certificate valid and is the certificate a SAN certificate?
  5. Does the website or application use its own IP address?
  6. Is the website or application part of either Tier – Production, Test, Development?

F5 Implementation

The process below will provide the step-by-step instructions for placing a website or application behind the F5.

 

  1. To test out the F5 configurations prior to moving a website or application without creating an impact to the stakeholders it is ideal to create a new FQDN and use that as the first FQDN assigned to the VIP
    1. If your website is named “hsitwebsitename.hs.pitt.edu” then we will create a new one named “pre.hsitwebsitename.hs.pitt.edu”. The new name is placed on the F5 VIP. The original FQDN stays on the server until proper testing and configuration is achieved.
  2. Open a ticket with Pitt IT for creating a new VIP on the F5. The ticket should identify the FQDN that will be placed on the VIP. Pitt IT will provide the appropriate IP address. The ticket will also provide the below information for the Pitt IT team:
    1. The name of the VIP should resemble the server’s name. This provides clarity of identities and server locations for the website or application content. If the server’s name is “joewinsrvr.hs.pitt.edu” than the VIP name would be www.joewinsrvr.hs.pitt.edu. Keep in mind the naming could be anything and has no relevance for how the websites or applications communicate. It is just a naming place holder.
    2. The type of traffic must be identified. This can be any or all the options listed: HTTP, HTTPS. LDAP, LDAPs, or any other combination of protocols/ports required for proper operations of the website or application.
    3. The current HSIT/Pitt standard is to make all public websites or applications secure. This requires an SSL certificate be created and applied on the F5.
    4. Ensure that the VIP is NOT using load balancing. This has caused intermittent communication issues for stakeholders.
    5. Proper logging on the F5 is extremely important, because the logging is part of identifying the blocking mechanism via a support ID#. Support ID#’s are used to resolve any blocking by the ASM policies. When a support ID# is identified a separate ticket must be opened with Pitt IT Security, for each, to evaluate the support ID# and identify the proper resolution.
    6. In some cases, WebSocket’s can be configured for the website or application.
    7. Pitt IT will create the appropriate firewall rules for F5 communications.
  3. Testing
    1. To test the website or application you MUST use the newly created FQDN. This allows the F5 to evaluate communications to and from the website or application without impact to the stakeholders. The concept uses the production website or application to identify and resolve the most common ASM policy violations/risks/activities to ensure the website or application works correctly before moving the real FQDN production name to the F5.
  4. Security verifications
    1. When a website or application is public facing it is imperative that we ensure all possible logging is configured. The below systems require verification that active monitoring is in place.
      1. Splunk Logging – Soon to be replaced by Microsoft Sentinel
      2. Matomo – website analytics
      3. App manager – Update all monitors to reflect the new F5 configurations/IP’s
      4. Website security scan – A minimal yearly security website/application security scan should be completed, and any critical or high risks eliminated.
  5. NESSUS scan – Pitt IT regularly performs NESSUS scans on system, but when moving a website or application to the F5 a recent NESSUS scan should be requested.
  6. Troubleshooting - There are numerous reasons why a F5 configuration might not work correctly. Below are some fo the common issue we have encountered.
    1. DNS name is not assigned to the correct VIP.
      1. Ensure a nslookup responds properly to the correct VIP.
    2. Improper ports configured
    3. TLS version incompatible
      1. TLS v3 doesn't communicate internally. Disable TLS v3 on the F5 for the VIP.
    4. Certificates require updates
    5. Websockets require configuring
    6. Load balancing
      1. Load balancing is not required as HSIT does not employ clustered servers. Ensure Load Balancing on the F5 is disabled for the VIP.
Print Article