F5 WAF & ASM Mastery: 5 Critical Steps to Harden Your Apps Against OWASP Top 10 Attacks + Video

By /

Listen to this Post

Featured Image

Introduction:

Web Application Firewalls (WAF) and Application Security Manager (ASM) are essential layers in modern application delivery controllers (ADC) like F5 BIG-IP. As cyber threats evolve, integrating F5’s ASM with cloud-native F5 Distributed Cloud (XC) WAF provides real-time protection against OWASP Top 10 vulnerabilities, API abuse, and bot attacks. This article delivers hands-on techniques to configure, test, and optimize F5 WAF policies using CLI, API security hardening, and automated attack simulation.

Learning Objectives:

  • Deploy and tune F5 ASM security policies to block SQLi, XSS, and path traversal attacks.
  • Implement API schema validation and rate limiting on F5 XC Cloud WAF.
  • Simulate OWASP attacks using Linux/Windows tools and analyze F5 WAF logs.

You Should Know:

  1. Deploying F5 ASM Policy from Scratch (CLI & GUI)

A default “blocking” policy often blocks legitimate traffic. Use a “transparent” learning mode first, then enforce.

Step‑by‑step guide (Linux CLI via tmsh):

 SSH into F5 BIG-IP
ssh admin@<F5-MGMT-IP>

Create a new security policy from template
tmsh create security policy my_owasp_policy template "OWASP Top 10"

Set enforcement mode to "blocking"
tmsh modify security policy my_owasp_policy enforcement-mode blocking

Add URL protection for /api/v1/
tmsh create security policy my_owasp_policy urls url "/api/v1/" method ""

Apply policy to virtual server
tmsh modify ltm virtual vs_web_server security-policy my_owasp_policy

Save config
tmsh save sys config

Windows equivalent (using REST API with curl):

 Invoke-RestMethod -Method POST -Uri "https://<F5-MGMT>/mgmt/tm/security/policy" -Credential $cred -Body '{"name":"my_owasp_policy","template":"OWASP Top 10","enforcementMode":"blocking"}'

What this does: Creates a WAF policy that blocks injection attempts, malicious file uploads, and parameter tampering. Use `tmsh list security policy my_owasp_policy violations` to see blocked requests.

  1. Hardening API Endpoints with F5 XC Cloud WAF

Modern APIs require schema validation and rate limiting. F5 XC Cloud WAF allows OpenAPI specification import.

Step‑by‑step guide (F5 XC Console + Linux curl):

  1. Export your OpenAPI spec (swagger.json) from your API gateway.
  2. In F5 XC Console: Web App & API Protection → API Protection → Add OpenAPI Spec.
  3. Enable Strict Schema Validation – blocks requests with unexpected JSON fields.
  4. Create rate limit policy: Rate Limiting → 500 requests per minute per client IP.

5. Test with simulated abuse:

 Normal request (should pass)
curl -X GET "https://your-api.f5xc.net/v1/users" -H "X-API-Key: valid_key"

Attack: SQL injection in query param (should be blocked)
curl "https://your-api.f5xc.net/v1/users?id=1' OR '1'='1" -H "X-API-Key: valid_key"

Rate limit test (run in loop)
for i in {1..600}; do curl -s -o /dev/null -w "%{http_code}\n" "https://your-api.f5xc.net/v1/users" -H "X-API-Key: valid_key"; done

Expected result: After 500 requests, you receive 429 Too Many Requests. The SQLi attempt returns `403 Forbidden` with F5 violation code VIOLATION_SQL.

3. Simulating OWASP Attacks to Test WAF Efficacy

Use open-source tools to validate your F5 ASM configuration. Always perform this in a staging environment.

Linux – Using OWASP ZAP in headless mode:

 Install ZAP
sudo apt install zaproxy

Run automated scan against your test app behind F5
zap-cli quick-scan --spider -r -s xss,sqli,cmd-injection https://testapp.local

Check blocked alerts (ZAP reports HTTP 403/406)
zap-cli alerts -l High

Windows – Using PowerShell and Invoke-WebRequest for XSS test:

$payload = "<script>alert('XSS')</script>"
$body = @{comment=$payload}
Invoke-WebRequest -Uri "https://testapp.local/submit" -Method POST -Body $body -UseBasicParsing
 If WAF blocks, you'll get 403 or connection reset.

Linux – Manual SQL injection via curl with delay (evasion testing):

curl -v "https://testapp.local/product?id=1+AND+1=1" 2>&1 | grep -i "blocked|violation"

Check F5 ASM logs:

tmsh show security log event | grep -i "sql injection"

4. Automating F5 ASM Policy Updates with Ansible

To maintain security at scale, use Infrastructure as Code. Below playbook updates a WAF policy’s trusted IP addresses.

Step‑by‑step guide:

1. Install Ansible and F5 collection:

pip install ansible
ansible-galaxy collection install f5networks.f5_bigip

2. Create `update_waf_whitelist.yml`:


<ul>
<li>name: Update F5 ASM trusted IPs
hosts: f5_bigips
connection: local
tasks:</li>
<li>name: Add office IP to trusted addresses
f5networks.f5_bigip.bigip_security_policy:
name: my_owasp_policy
trusted_addresses:</li>
<li>"192.168.1.0/24"</li>
<li>"10.10.10.5"
state: present
provider:
server: "{{ ansible_host }}"
user: "{{ f5_user }}"
password: "{{ f5_password }}"

3. Run playbook:

ansible-playbook -i inventory update_waf_whitelist.yml -e "f5_user=admin f5_password=secure123"

What this does: Automatically whitelists internal IP ranges, preventing false positives for internal scanners.

  1. Hardening Cloud-Native Applications with F5 WAF & Kubernetes

Deploy F5 XC WAF as an ingress controller in your K8s cluster for east‑west API security.

Step‑by‑step guide (Linux + kubectl):

1. Deploy F5 XC WAF sidecar (using helm):

helm repo add f5xc https://f5devcentral.github.io/f5xc-helm-charts
helm install f5-waf f5xc/f5xc-waf -f values.yaml
  1. Annotate your Kubernetes service to enforce WAF policy: 
    apiVersion: v1
kind: Service
metadata:
name: api-gateway
annotations:
f5xc-waf/policy: "strict_owasp"
f5xc-waf/block-sqli: "true"
spec:
selector:
app: api
ports:</li>
</ol>

- port: 8080

    3. Test with malicious payload inside cluster:

     Run a temporary pod with curl
kubectl run test --rm -it --image=curlimages/curl -- /bin/sh

Inside pod:
curl -X POST http://api-gateway:8080/login -H "Content-Type: application/json" -d '{"user":"admin", "pass":"'\'' OR 1=1--"}'

    If WAF is working, response will be `403 Forbidden` with a violation header X-F5-Violation: SQL Injection.

    What Undercode Say:

    • Defense in depth is non‑negotiable – F5 WAF alone isn’t enough; combine with runtime API validation, rate limiting, and regular policy tuning.
    • Automation beats manual clicks – Use tmsh, REST API, or Ansible to version‑control your WAF policies and avoid configuration drift.
    • Testing must be continuous – Integrate OWASP ZAP or Burp Suite into your CI/CD pipeline to catch regressions before they reach production.

    Modern WAFs like F5 ASM and F5 XC Cloud have evolved from simple signature matching to behavioral analysis and API schema enforcement. Yet, many breaches still happen due to misconfigured policies, over‑permissive rules, or lack of logging. The commands and steps above give you a repeatable framework to validate your WAF posture. Remember to always run attack simulations in a staging environment and monitor false positives using F5 Analytics dashboards.

    Prediction:

    By 2027, AI‑driven WAFs will automatically generate and fine‑tune security policies based on observed traffic patterns, reducing manual tuning by 80%. However, attackers will shift to exploiting WAF blind spots – such as multipart form data parsing or GraphQL introspection – making it critical for security engineers to master both traditional signature‑based blocking and API‑specific hardening techniques on platforms like F5 Distributed Cloud.

    ▶️ Related Video (74% Match):

    🎯Let’s Practice For Free:

    IT/Security Reporter URL:

    Reported By: Grahammattingley Share – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: