F5 - ASM Repro with Ansible (WAF Advanced)
Description?
This article describes how to create a fast ASM repro by using Ansible without needing a pool or server, and above all, without affecting service. Sometimes, we don't understand why the policy generates violations and/or block legitimate requests. This configuration will help to deploy two virtual servers, one to receive the client traffic, and the second will act as a server or pool.
Pre-requisites?
Installing Ansible and Running the playbook?
# 1. Install python
?
$?sudo?apt?install?python
?
?
# 2. Install "pip"
?
$ curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
?
# OR
?
https://bootstrap.pypa.io/pip/2.7/get-pip.py
?
$ python3 get-pip.py --user
?
?
?
# 3. Install ansible using "pip" :
?
$?sudo?pip?install?ansible??## installation pip? ---?https://pip.pypa.io/en/stable/installing/
?
$ pip --version?## check the pip version
?
$ apt?install?python-pip?## If pip is not installed, please run this command for installation
?
$?sudo?pip?install?virtualenv
?
?
?
# 4. Ansible can also be installed inside a new or existing virtualenv:
?
$ python -m virtualenv ansible??# Create a virtualenv if one does not already exist
$?source?ansible/bin/activate???# Activate the virtual environment
$ pip?install?ansible
?
# NOTE: to avoid "The python f5-sdk module is required" errors:
# pip install f5-sdk
?
?
# 5. Create the repository
?
sudo?mkdir?~/ansible
cd?~/ansible
sudo?mkdir?inventory library playbooks files roles scripts templates
sudo?mkdir?-p inventory/group_vars/?inventory/host_vars??????????
sudo?touch?ansible.cfg inventory/hosts
sudo?touch?ansible.cfg inventory/hosts?inventory/group_vars/all.yaml inventory/host_vars/host1.yaml playbooks/site.yaml
?
?
# 6. Add localhost in inventory file and save it.
?
/ansible/inventory$?cat?hosts
localhost
2. Create two files with the following iRules:?
Note: In this example, I used vi as an editor. However, feel free to use the one you like.
$?vi?forwarding.tcl
when HTTP_REQUEST? {
??virtual response
}
$?vi?response.tcl
领英推荐
when HTTP_REQUEST? {?
? ? HTTP::respond 200 content {?
? ? 200 OK }?
? ? http::close
}
3. Create the playbook file:?
$?vi?~/ansible/playbooks/asm_repro.yaml
4.?Now, let's edit the playbook by replacing the following fields:?
server: XXX.XXX.XXX.XXX??= BIG-IP address?
destination: YYY.YYY.YYY.YYY = Virtual Server IP address which goes to receive traffic?
destination: ZZZ.ZZZ.ZZZ.ZZZ = Virtual Server IP address which goes to act as a pool or server
- name: Create two VS, iRules?for?ASM repro
??hosts: all
??connection:?local
??vars:
????provider:
??????password: admin
??????server: XXX.XXX.XXX.XXX
??????user: admin
??????validate_certs: no
??????server_port: 443
??tasks:
????- name: Create a VIP?test
??????bigip_virtual_server:
????????provider:?"{{ provider }}"
????????description:?test
????????destination: YYY.YYY.YYY.YYY
????????name:?test
????????port: 80
????????snat: Automap
????????profiles:
??????????- http
??????delegate_to: localhost
????- name: Create a VIP response
??????bigip_virtual_server:
????????provider:?"{{ provider }}"
????????description: response
????????destination: ZZZ.ZZZ.ZZZ.ZZZ
????????name: response
????????port: 80
????????snat: Automap
????????profiles:
??????????- http
??????delegate_to: localhost
????- name: Add the iRule contained?in?static?file?forwarding.tcl to the LTM module
??????bigip_irule:
????????module: ltm
????????name: forwarding
????????src: forwarding.tcl
????????state: present
????????provider:?"{{ provider }}"
??????delegate_to: localhost
????- name: Add the iRule contained?in?static?file?response.tcl to the LTM module
??????bigip_irule:
????????module: ltm
????????name: response
????????src: response.tcl
????????state: present
????????provider:?"{{ provider }}"
??????delegate_to: localhost
????- name: Attach iRules to VS?test
??????bigip_virtual_server:
????????provider:?"{{provider}}"
????????name:?"test"
????????port: 80
????????irules: forwarding
??????delegate_to: localhost
????- name: Attach iRules to VS forwarding
??????bigip_virtual_server:
????????provider:?"{{provider}}"
????????name:?"forwarding"
????????port: 80
????????irules: response
??????delegate_to: localhost
Note: Bear in mind that Ansible is sensitive to indentation.
?5. Once everything is done, let's execute the playbook:?
~/ansible$ ansible-playbook -i inventory/hosts?playbooks/asm_repro.yaml
6. Import and attach the ASM policy to the Virtual Server called "Test"
7. Apply the logging profile.
8. Send the request to the virtual server " test" to log and validate the violation caused by the client request in the ASM policy.
Hopefully, this article helps to test your own policies, understand how the traffic behaves with your configuration, and make the right corrections to avoid blocking legitimate traffic.