Connect NGINX App Protect WAF to NGINX Security Monitoring

This document explains how to use NGINX Ingress Controller to configure NGINX Agent for sending F5 NGINX App Protect WAF metrics to NGINX Security Monitoring.


This guide assumes that you have an installation of NGINX Instance Manager with NGINX Security Monitoring which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.

If you use custom container images, NGINX Agent must be installed along with NGINX App Protect WAF. See the Dockerfile for examples of how to install NGINX Agent or the NGINX Agent installation documentation for more information.

Deploying NGINX Ingress Controller with NGINX Agent configuration

  1. Add the below arguments to the values.yaml file:

        enable: true
            host: "<FQDN or IP address of NGINX Instance Manager>"
  2. Follow the Installation with Helm instructions to deploy NGINX Ingress Controller with custom resources enabled, and optionally set other nginxAgent.* values if required.

  1. Add the below argument to the manifest file of NGINX Ingress Controller:

      - -agent=true
      - -agent-instance-group=<NGINX Ingress Controller deployment name>
  2. Create a ConfigMap with an nginx-agent.conf file which must be mounted to /etc/nginx-agent/nginx-agent.conf in the NGINX Ingress Controller pod.

     kind: ConfigMap
     apiVersion: v1
     name: <configmap name>
     namespace: <namespace where NGINX Ingress Controller will be installed>
       nginx-agent.conf: |-
           level: error
           path: ""
           host: "<FQDN or IP address of NGINX Instance Manager>"
           grpcPort: 443
         - registration
         - nginx-counting
         - metrics-sender
         - dataplane-status
         - nginx-app-protect
         - nap-monitoring
           report_interval: 15s
           precompiled_publication: true
           collector_buffer_size: 20000
           processor_buffer_size: 20000
           syslog_port: 1514     

    See the NGINX Agent Configuration Overview for more configuration options.

The features list must not contain nginx-config-async or nginx-ssl-config as these features can cause conflicts with NGINX Ingress Controller.
  1. Follow the Installation with Manifests instructions to deploy NGINX Ingress Controller with custom resources enabled.

Once NGINX Ingress Controller is installed the pods will be visible in the NGINX Instance Monitoring Instances dashboard.

Configuring NGINX App Protect WAF to send metrics to NGINX Agent

NGINX Agent runs a syslog listener which NGINX App Protect WAF can be configured to send logs to, which will then allow NGINX Agent to send metrics to NGINX Security Monitoring. The following examples show how to configure NGINX App Protect WAF to log to NGINX Agent.

Modifying the APLogConf in the examples may result in the Security Monitoring integration not working, as NGINX Agent expects a specific log format.