Technical specifications
This page outlines the technical specifications for F5 WAF for NGINX, which includes the minimum requirements and supported platforms.
You can deploy F5 WAF for NGINX in the following environments:
| Distribution | Version |
|---|---|
| Alpine Linux | 3.19 |
| Amazon Linux | 2023 |
| Debian | 11, 12 |
| Oracle Linux | 8.1 |
| Ubuntu | 22.04, 24.04 |
| RHEL / Rocky Linux | 8, 9 |
For release-specific packages, view the Changelog.
The F5 WAF for NGINX package has the following dependencies:
| Module name | Description |
|---|---|
| nginx-plus-module-appprotect | NGINX Plus dynamic module for F5 WAF for NGINX |
| app-protect-engine | The F5 WAF for NGINX enforcement engine |
| app-protect-plugin | The F5 WAF for NGINX connector API between the engine and the NGINX Plus dynamic module |
| app-protect-compiler | The F5 WAF for NGINX enforcement engine compiler agent |
| app-protect-common | The F5 WAF for NGINX shared libraries package |
| app-protect-geoip | The F5 WAF for NGINX geolocation update package |
| app-protect-graphql | The F5 WAF for NGINX shared library package for GraphQL protection |
| app-protect-attack-signatures | The F5 WAF for NGINX attack signatures update package |
| app-protect-threat-campaigns | The F5 WAF for NGINX threat campaigns update package |
| app-protect-bot-signatures | The F5 WAF for NGINX bot signatures update package |
| app-protect-selinux (1) | The prebuilt SELinux policy module for F5 WAF for NGINX |
| app-protect-ip-intelligence (1, 2) | Necessary for the IP intelligence feature |
- Optional dependencies
- This module needs to be installed separately, and includes a client for downloading and updating the feature’s database
The following security policy features are available with F5 WAF for NGINX.
The names link to additional information in the Policies section.
| Feature | Description |
|---|---|
| Allowed methods | Checks allowed HTTP methods. By default, all the standard HTTP methods are allowed. |
| Attack signatures | The default policy covers the OWASP top 10 attack patterns. Specific signature sets can be added or disabled. |
| Brute force attack preventions | Configure parameters to secure areas of a web application from brute force attacks. |
| Cookie enforcement | By default all cookies are allowed and not enforced for integrity. The user can add specific cookies, wildcards or explicit, that will be enforced for integrity. It is also possible to set the cookie attributes: HttpOnly, Secure and SameSite for cookies found in the response. |
| Data guard | Detects and masks Credit Card Number (CCN) and/or U.S. Social Security Number (SSN) and/or custom patterns in HTTP responses. Disabled by default. |
| Deny and Allow IP lists | Manually define denied & allowed IP addresses as well as IP addresses to never log. |
| Disallowed file type extensions | Support any file type, and includes a predefined list of file types by default |
| Evasion techniques | All evasion techniques are enabled by default, and can be disabled individually. These include directory traversal, bad escaped characters and more. |
| Geolocation | |
| GraphQL protection | |
| gRPC protection | gRPC protection detects malformed content, parses well-formed content, and extracts the text fields for detecting attack signatures and disallowed meta-characters. In addition, it enforces size restrictions and prohibition of unknown fields. The Interface Definition Language (IDL) files for the gRPC API must be attached to the profile. gRPC protection is available for unary or bidirectional traffic. |
| HTTP compliance | All HTTP protocol compliance checks are enabled by default except for GET with body and POST without body. It is possible to enable any of these two. Some of the checks enabled by default can be disabled, but others, such as bad HTTP version and null in request are performed by the NGINX parser and NGINX App Protect WAF only reports them. These checks cannot be disabled. |
| IP address lists | Organize lists of allowed and forbidden IP addresses across several lists with common attributes. |
| IP intelligence | Configure the IP Intelligence feature to customize enforcement based on the source IP of the request, limiting access from IP addresses with questionable reputation. |
| JWT protection | |
| Server technology signatures | Support adding signatures per added server technology. |
| Time-based signature staging | Time-based signature staging allows you to stage signatures for a specific period of time. During the staging period, violations of staged signatures are logged but not enforced. After the staging period ends, violations of staged signatures are enforced according to the policy’s enforcement mode. |
| Threat campaigns | These are patterns that detect all the known attack campaigns. They are very accurate and have almost no false positives, but are very specific and do not detect malicious traffic that is not part of those campaigns. The default policy enables threat campaigns but it is possible to disable it through the respective violation. |
| User-defined HTTP headers | Handling headers as a special part of requests |
| XFF trusted headers | Disabled by default, and can accept an optional list of custom XFF headers. |
| XML and JSON content | XML content and JSON content detect malformed content and detects signatures in the element values. Default policy checks maximum structure depth. It is possible to enable more size restrictions: maximum total length of XML/JSON data, maximum number of elements are more. |