Breadcrumbs

WAF F5 with Ports redirect

Summary

This document describes the steps required to configure an F5 BIG-IP appliance to work as a reverse proxy and load balancer for VeridiumID services.

The configuration enables the F5 device to:

  • Terminate SSL connections

  • Perform client certificate authentication

  • Insert required Veridium headers:

    • X-SSL-Client-DN

    • x-ssl-termination-proxy-secret

  • Load balance requests to the Veridium backend servers

  • Route traffic to the appropriate services using F5 policies and virtual servers

The guide walks through the complete configuration process, including:

  1. Adding backend nodes

  2. Creating load balancing pools

  3. Creating required iRules

  4. Importing SSL certificates

  5. Creating SSL profiles

  6. Configuring HTTP profiles

  7. Creating traffic policies

  8. Configuring virtual servers

The final result is an F5 configuration that properly routes requests to the following Veridium services:

Service

Purpose

BOPS

Core Veridium authentication service

DMZ Web Application

External authentication endpoints

IDP

Identity Provider (SAML)

SSP

Self-Service Portal

WebSec Admin

Administrative interface

The configuration also ensures that client certificate information is forwarded to VeridiumID using HTTP headers, allowing the platform to properly identify and authenticate users.

1. Add Backend Nodes

Login to the F5 management interface and Create nodes.

Local Traffic → Nodes

 

NODE1.png

 

Final Node Configuration

After creating both nodes, the list under Local Traffic → Nodes should look similar to:

Screenshot 2022-09-21 at 12.43.19.png

 

 

2. Create Pools

Navigate to:

Local Traffic → Pools

Click Create.

Each pool corresponds to a Veridium service.

 

2.1 Pool for bops

Screenshot 2022-09-21 at 12.48.29.png

 

2.2. Pool for dmz

Screenshot 2022-09-21 at 12.50.19.png

 

 

2.3. Pool for idp

Screenshot 2022-09-21 at 12.51.47.png

2.3. Pool for ssp

Screenshot 2022-09-21 at 12.55.04.png

 

2.3. Pool for websec admin

Screenshot 2022-09-21 at 12.56.08.png

2.4. At the end we need to have

Screenshot 2022-09-21 at 12.57.21.png

 

3. Create iRules

Before creating the iRules, retrieve the proxy secret from the Veridium server.

Location:

grep x-ssl-termination-proxy-secret /opt/veridiumid/haproxy/conf/haproxy.cfg | sort -u

Navigate to:

Local Traffic → iRules

Click Create.

3. Create two IRules

!!! Before we create the following rules we need to get the “x-ssl-termination-proxy-secret” from haproxy located the webapp. ( /etc/veridiumid/haproxy/haproxy.cfg ) , and we need to replace XXXXXXXXX with our x-ssl-termination-proxy-secret.

Go in “Local Traffic” → “iRules” and here press “create” button (located in the right side).

3.1 iRule 1 – Basic Header Injection

 

###Retrieve the client certificate DN
when CLIENTSSL_CLIENTHELLO {
    set dist_name ""
}
###Create the Headers to insert the proxy secret and the client certificate DN.
when HTTP_REQUEST {
    set dist_name [X509::subject [SSL::cert 0]]
    HTTP::header insert "x-ssl-termination-proxy-secret" "1111111111111"
    HTTP::header insert "X-SSL-Client-DN" $dist_name 
     #log local0. "HERE START"
     #log local0. "$dist_name"
     #log local0. "HERE END"
}

3.2 iRule 2 – Certificate Validation + Session Persistence

 

###Retrieve the client certificate DN
when CLIENTSSL_CLIENTHELLO {
    set dist_name ""
}
when CLIENTSSL_CLIENTCERT {
    if {[SSL::cert count] > 0} {
        set dist_name [X509::subject [SSL::cert 0]]
        log local0. "$dist_name"
    }
}
###Create the Headers to insert the proxy secret and the client certificate DN.
when HTTP_REQUEST {
    log local0. "$dist_name"
    HTTP::header insert "x-ssl-termination-proxy-secret" "1111111111111"
    if { $dist_name != ""} {
        HTTP::header insert "X-SSL-Client-DN" $dist_name 
    }
  if { [HTTP::cookie exists "JSESSIONID"] } {
    persist uie [HTTP::cookie "JSESSIONID"]
  }
}
when HTTP_RESPONSE {
  if { [HTTP::cookie exists "JSESSIONID"] } {
    persist add uie [HTTP::cookie "JSESSIONID"]
  }
}

 

4. Import Certificates

You must import the following certificates from the Veridium server.

Certificate

Location

Wildcard SSL Certificate

 

Veridium Client CA

/etc/veridiumid/haproxy/client-ca.pem

4.1 Import RSA Certificate & Key

Navigate to:

System → Certificate Management
→ Traffic Certificate Management
→ SSL Certificate List

Click Import.

Ensure the certificate file is in the required format.

Screenshot 2022-09-21 at 13.31.33.png

4.2 Import Certificate Bundle (Client CA)

Import the Veridium client CA certificate.

Navigate to:

System → Certificate Management
→ Traffic Certificate Management
→ SSL Certificate List

Click Import.

Screenshot 2022-09-21 at 13.32.31.png

 

At the end we need to have something like this:

Screenshot 2022-09-21 at 13.36.47.png

 

5. SSL Profiles

5.1 SSL Client Profiles

Navigate to:

Local Traffic → Profiles → SSL → Client

Create the following profiles.

 

5.1.1 Profile

wildcard.veridium-dev.com

Screenshot 2022-09-21 at 13.39.45.png
Screenshot 2022-09-21 at 13.40.20.png
Screenshot 2022-09-21 at 13.40.44.png

 

5.1.2 Profile

wildcard.veridium-dev.com-client-ca

 

Screenshot 2022-09-21 at 13.42.23.png
Screenshot 2022-09-21 at 13.42.36.png
Screenshot 2022-09-21 at 13.40.44.png

 

5.2 SSL Server Profile

Navigate to:

Local Traffic → Profiles → SSL → Server

Create one server profile.

Screenshot 2022-09-21 at 13.46.43.png
Screenshot 2022-09-21 at 13.46.54.png
Screenshot 2022-09-21 at 13.47.01.png

 

7. HTTP Profile

Navigate to:

Local Traffic → Profiles → Services

Create the profile:

http_reverse
Screenshot 2022-09-21 at 13.53.38.png
Screenshot 2022-09-21 at 13.54.15.png

 

8. Traffic Policies

Navigate to:

Local Traffic → Policies → Policy List

Create the following policies.

 

8.1. Policy dev9-webapp-dmz

Screenshot 2022-09-21 at 14.56.26.png

8.2. Policy dev9-webapp-idp

Screenshot 2022-09-22 at 10.56.32.png

 

8.3. Policy dev9-webapp-ssp

Screenshot 2022-09-21 at 14.59.13.png

 

8.4. Policy dev9-webapp-websec-admin

Screenshot 2022-09-21 at 14.59.48.png

 

8.5. Policy dev9-webapp-host

Screenshot 2022-09-21 at 15.00.49.png

Publish Policies

After creating policies:

Navigate to:

Local Traffic → Policies → Draft Policies

Select the policies and click Publish.

Final result:

Screenshot 2022-09-21 at 15.04.28.png

 

8. Create Virtual Servers

Navigate to:

Local Traffic → Virtual Servers

Create the following virtual servers.

8.1. Virtual Server “webapp-bops“

Screenshot 2022-09-21 at 15.11.27.png
Screenshot 2022-09-21 at 15.11.37.png

 

Screenshot 2022-09-21 at 15.11.49.png

 

8.2. Virtual Server “webapp-dmz“

Screenshot 2022-09-21 at 15.11.49.png

 

Screenshot 2022-09-21 at 15.14.41.png

 

Screenshot 2022-09-21 at 15.15.00.png

 

8.3. Virtual Server “webapp-idp“

Screenshot 2022-09-21 at 15.17.51.png
Screenshot 2022-09-21 at 15.18.02.png

 

Screenshot 2022-09-21 at 15.18.12.png

 

8.4. Virtual Server “webapp-ssp“

Screenshot 2022-09-21 at 15.20.57.png

 

Screenshot 2022-09-21 at 15.21.05.png

 

Screenshot 2022-09-21 at 15.21.14.png

 

8.5. Virtual Server “webapp-websec-admin“

Screenshot 2022-09-21 at 15.23.47.png
Screenshot 2022-09-21 at 15.23.57.png

 

Screenshot 2022-09-21 at 15.24.13.png

 

Final Virtual Server List

After completing the configuration, the Virtual Servers list should appear as:

Screenshot 2022-09-21 at 15.26.23.png

 


If iRules are not allowed in F5, the following can be applied.

This is not recommended (it can be used if iRules can not be defined in F5) because only one header can be inserted (X-Forwarded-For can not be inserted).

Only one header can be added in this way (the application works also without the proxy secret, that is inserted in haproxy).

X-SSL-Client-DN: [X509::subject [SSL::cert 0]]

 

Screenshot 2023-06-06 at 16.57.16.png


Last updated: