Deploy using the NGINXaaS Console

Overview

This guide explains how to deploy F5 NGINXaaS for AWS using the AWS Management Console and the NGINXaaS Console. The deployment process involves creating a new deployment, configuring the deployment, and testing the deployment.

Before you begin

Before you can deploy NGINXaaS, follow the steps in the Prerequisites topic to subscribe to the NGINXaaS for AWS offering in the AWS Marketplace.

Access the NGINXaaS Console

• Open the NGINXaaS Console.
• Log in with your preferred identity provider.
• Select the Geography you want to work in.

Create or import an NGINX configuration

In the NGINXaaS Console,

1. On the left menu, select Configurations.

2. Select Add Configuration to add a new NGINX configuration.

3. You can either create a new configuration from scratch or copy an existing configuration:

   • Select New configuration to create a new config.
     • Provide a name for your configuration and an optional description.
     • Select to start with the "F5 NGINXaaS Default" (a basic NGINX setup) or an empty configuration file.
     • Select Next.
   • Select Copy existing configuration to use one of the existing configuration files in your account as template.
     • Provide a name for your configuration and an optional description.
     • Use the Choose configuration to copy list to select the configuration file you want to copy.
     • Use the Choose configuration version to copy list to select the version of the configuration file you want to copy.
     • Select Next.

4. Modify the configuration file as needed.

   • Select Add File to stage new content such as certificates, configuration files, or upload non-configuration files.
   • Select File Actions to rename, move, delete, or copy files as you build out the overall configuration filesystem.
   • Warnings, errors, and recommendations appear in the editor as you modify your configuration content.
   • You can hover over an NGINX configuration directive to view helpful descriptions and usage details.

5. Select Save.

Create a new deployment

Create a new NGINXaaS deployment using the NGINXaaS Console:

1. On the left menu, select Deployments.

2. Select Add Deployment, then select AWS to create a new AWS deployment.

   • Enter a unique Name.
   • Add an optional description for your deployment.
   • Change the NCUs if needed.
     • The default value of 20 works for most common scenarios.
   • Select the AWS Region where you want the NGINXaaS deployment to be created.
   • Enter an IPv4 CIDR Block for the deployment’s private network IP space.
     • NGINXaaS only accepts block sizes between /22 and /18.
     • For more information on choosing a VPC CIDR block, refer to AWS’s VPC CIDR blocks documentation.

   Caution

   NGINXaaS uses VPC peering for network connectivity to your upstream services. VPC peering requires all peered VPCs to have non-overlapping CIDR blocks so unique routing rules can be defined for each IP range. When selecting an IPv4 CIDR block for your AWS deployment, make sure the range doesn’t match or overlap with any VPCs you plan to peer to the deployment’s network.

   • In the Apply NGINX Configuration section, select an NGINX configuration you created earlier from the Choose Configuration list.
   • Select a Configuration Version from the list.
   • Select Managed Public Endpoint or Private Endpoint under Service Frontend.
     • Refer to the Service Frontend documentation for more information on these two frontend types.
   • If you selected Managed Public Endpoint, select + Add ACL Rule to add an Access Control List (ACL) rule. If you don’t add any ACL rules, no traffic is allowed to the deployment. For each rule, set:
     • Protocol: Any, TCP, or UDP.
     • Port Range: Only selectable when you choose a specific protocol.
     • Source Prefixes: A required list of IPv4 or IPv6 CIDR blocks to allow traffic from. Use 0.0.0.0/0 to allow traffic from all IPv4 addresses, and ::/0 to allow traffic from all IPv6 addresses.
     • Description: An optional description for the rule.
   • If you selected Private Endpoint, select + Add Entry to add an entry to the PrivateLink Connection Allow List. If you don’t add any entries, no PrivateLink connections are allowed.
     • Populate the allow list with either AWS account IDs or VPC endpoint IDs – you can’t mix both types in the same allow list:
     • AWS account IDs: You can add these now, or at any point later. Connections from an allowed AWS account are automatically accepted.
     • VPC endpoint IDs: After you create the deployment and its interface VPC endpoint, add these entries to this allow list. This provides a stricter way to accept secure PrivateLink connections than trusting entire AWS account IDs.

3. Select Add Deployment to create the deployment.

Your new deployment will appear in the list of deployments. The status of the deployment is "Pending" while the deployment is being created. Once the deployment is complete, the status changes to "Ready".

Edit your deployment

In the NGINXaaS Console,

1. Open the details of your deployment by selecting its name from the list of deployments.
   • You can view the details of your deployment, including the status, region, VPC endpoint service, NGINX configuration, and more.
2. Select Edit to modify the deployment.
   • From this form, you can edit the description or reserved NCUs.
   • You can apply a different NGINX configuration or configuration version.
   • Configure upstream connectivity by adding entries to the VPC Peering Connections list as detailed further in Upstream connectivity.
   • You can also modify the Service Frontend configuration, including frontend type, ACL rules (Managed Public Endpoint) or PrivateLink Connection Allow List entries (Private Endpoint) from here.
     • This is where you can add VPC endpoint IDs to the allow list after you create an interface VPC endpoint.
   • You can configure monitoring here. For detailed instructions, see Enable Monitoring
3. Select Save Changes.

To modify the contents of the NGINX configuration, see Update an NGINX Configuration.

Set up connectivity

Private Endpoint traffic

If you selected Private Endpoint as the service frontend type, complete the following steps to allow client access. If you selected Managed Public Endpoint, skip this section.

To let clients in your AWS VPC connect directly to your deployment, create an interface VPC endpoint that targets your deployment’s PrivateLink Endpoint Service Name:

Caution

NGINXaaS doesn’t currently support cross-region PrivateLink connections. You can only create an interface VPC endpoint in the same region as your deployment.

1. After your deployment is created, open its Details tab and find the PrivateLink Endpoint Service Name under Cloud Settings > Service Frontend, for example com.amazonaws.vpce.us-east-1.vpce-svc-0c0d939ca9a7ce020.
2. Create an interface VPC endpoint that targets this Service Name. For step-by-step instructions, see AWS’s Connect to an endpoint service as the service consumer documentation. When prompted for Service name, enter the PrivateLink Endpoint Service Name from the previous step.
3. Note the new interface endpoint’s VPC Endpoint Id, for example vpce-0123456789abcdef0, shown in the AWS VPC console Endpoints list.
4. Ensure your deployment’s PrivateLink Connection Allow List includes the AWS account ID or VPC endpoint ID to accept the PrivateLink connection.
   • To add an entry to the allow list, go to your deployment’s Details tab, select Edit, and add the VPC endpoint ID or AWS account ID to the allow list.

Important

The allow list can contain either AWS account IDs or VPC endpoint IDs, but not both. If it uses AWS account IDs, NGINXaaS automatically accepts every PrivateLink connection from those accounts. If it uses VPC endpoint IDs, NGINXaaS accepts each endpoint’s PrivateLink connection only after you add its ID to the list.

Removing an entry disconnects that PrivateLink connection from the deployment.

Upstream connectivity

To let your NGINXaaS deployment reach applications in your upstream network, create a VPC peering connection between your upstream VPC and the deployment’s VPC:

Caution

NGINXaaS doesn’t currently support cross-region VPC peering connections. A peering connection from any region other than the deployment’s region will be rejected.

1. Open your deployment’s Details tab and note its AWS Account ID and VPC ID.
2. From your upstream AWS account, create a VPC peering connection request targeting the deployment’s AWS Account ID and VPC ID. For step-by-step instructions, see AWS’s Create a VPC peering connection documentation.
3. Note the resulting VPC Peering Connection ID, for example pcx-0123456789abcdef0, shown in the AWS VPC console Peering Connections list.
4. On your deployment’s Details tab, select Edit, go to Cloud Details > Upstream Network, select + Add Entry, and add the VPC Peering Connection ID.
5. Select Save Changes to allow NGINXaaS to accept the peering connection request.
6. You must update your upstream VPC’s route tables, network ACLs, and security groups to allow traffic to and from the deployment’s VPC CIDRs.
   • Open your deployment’s Details tab and note its IPv4 CIDR and IPv6 CIDR (if you plan to use IPv6).
   • See AWS’s Update your route tables for a VPC peering connection and Configure security group rules for your VPC documentation.

CIDR overlap

Your upstream VPC CIDRs must not overlap with the deployment’s VPC CIDRs, or the CIDRs of other peered upstream VPCs. If CIDRs overlap, VPC peering will fail. See Upstream network for more information.

Test your deployment

How you test your deployment depends on the service frontend type you selected:

• Managed Public Endpoint: connect to the Service Endpoint URL shown on your deployment’s Details tab, under Cloud Settings > Service Frontend, for example http://speak-lp-9e9707dede.us-east-1.depl.nginxaas.net.
• Private Endpoint: connect through the interface VPC endpoint you created in Private Endpoint traffic. Because the endpoint is only reachable from within your VPC, you need a resource inside that VPC to test the connection:
  1. Launch an EC2 instance in the same VPC and subnet (or a subnet that can route to it) as your interface VPC endpoint.
  2. Open the interface endpoint’s details in the AWS VPC console and note its DNS names.
  3. From the EC2 instance, connect to your NGINX configuration’s listening port using one of the endpoint’s DNS names, for example curl https://vpce-0123456789abcdef0-abc12345.vpce-svc-0c0d939ca9a7ce020.us-east-1.vpce.amazonaws.com.

What’s next

• Monitor your deployment
• Manage certificates in AWS Secrets Manager