Call : (+91) 968636 4243
Mail : info@EncartaLabs.com
EncartaLabs

F5 Configuring BIG-IP - Advanced WAF

( Duration: 4 Days )

The F5 Configuring BIG-IP Advanced WAF training course, provides with a functional understanding of how to deploy, tune, and operate the F5 Advanced Web Application Firewall to protect the web applications from HTTP-based attacks. The course includes lecture, hands-on labs, and discussion about different F5 Advanced Web Application Firewall tools for detecting and mitigating threats from multiple attack vectors such web scraping, Layer 7 Denial of Service, brute force, bots, code injection, and zero day exploits.

By attending F5 Configuring BIG-IP Advanced WAF workshop, delegates will learn to:

  • Setting up the BIG-IP system
  • Traffic processing with BIG-IP
  • Web application concepts
  • Web application vulnerabilities
  • Security policy deployment
  • Policy Tuning and Violations
  • Attack signatures
  • Positive security policy building
  • Cookies and other headers
  • Reporting and logging
  • Policy Diff and Administration
  • Automatic Policy Building
  • Web Application Vulnerability Scanner Integration
  • Layered Policies
  • Login Enforcement, Brute Force Mitigation, and Session Tracking
  • Web Scraping Mitigation and Geolocation Enforcement
  • Layer 7 DoS Mitigation and Advanced BOT Protection
  • F5 Advanced WAF and iRules
  • Using Content Profiles

  • Attend a training on F5 Networks Administering BIG-IP or equivalent practical experience

The F5 Configuring BIG-IP Advanced WAF class is ideal for:

  • Security and network administrators who are responsible for the installation, deployment, tuning, and day-to-day maintenance of the Web Application Firewall.

COURSE AGENDA

1

Setting Up the BIG-IP System

  • Introducing the BIG-IP System
  • Initially Setting Up the BIG-IP System
  • Archiving the BIG-IP System Configuration
  • Leveraging F5 Support Resources and Tools
2

Traffic Processing with BIG-IP

  • Identifying BIG-IP Traffic Processing Objects
  • Overview of Network Packet Flow
  • Understanding Profiles
  • Overview of Local Traffic Policies
  • Visualizing the HTTP Request Flow
3

Web Application Concepts

  • Overview of Web Application Request Processing
  • Web Application Firewall: Layer 7 Protection
  • F5 Advanced WAF Layer 7 Security Checks
  • Overview of Web Communication Elements
  • Overview of the HTTP Request Structure
  • Examining HTTP Responses
  • How F5 Advanced WAF Parses File Types, URLs, and Parameters
  • Using the Fiddler HTTP Proxy
4

Common Web Application Vulnerabilities

  • A Taxonomy of Attacks: The Threat Landscape
  • What Elements of Application Delivery are Targeted?
  • Common Exploits Against Web Applications
5

Security Policy Deployment

  • Defining Learning
  • Comparing Positive and Negative Security Models
  • The Deployment Workflow
  • Policy Type: How Will the Policy Be Applied
  • Policy Template: Determines the Level of Protection
  • Policy Templates: Automatic or Manual Policy Building
  • Assigning Policy to Virtual Server
  • Deployment Workflow: Using Advanced Settings
  • Selecting the Enforcement Mode
  • The Importance of Application Language
  • Configure Server Technologies
  • Verify Attack Signature Staging
  • Viewing Requests
  • Security Checks Offered by Rapid Deployment
  • Defining Attack Signatures
  • Using Data Guard to Check Responses
6

Policy Tuning and Violations

  • Post-Deployment Traffic Processing
  • Defining Violations
  • Defining False Positives
  • How Violations are Categorized
  • Violation Rating: A Threat Scale
  • Defining Staging and Enforcement
  • Defining Enforcement Mode
  • Defining the Enforcement Readiness Period
  • Reviewing the Definition of Learning
  • Defining Learning Suggestions
  • Choosing Automatic or Manual Learning
  • Defining the Learn, Alarm and Block Settings
  • Interpreting the Enforcement Readiness Summary
  • Configuring the Blocking Response Page
7

Attack Signatures

  • Defining Attack Signatures
  • Attack Signature Basics
  • Creating User-Defined Attack Signatures
  • Defining Simple and Advanced Edit Modes
  • Defining Attack Signature Sets
  • Defining Attack Signature Pools
  • Understanding Attack Signatures and Staging
  • Updating Attack Signatures
8

Positive Security Policy Building

  • Defining and Learning Security Policy Components
  • Defining the Wildcard
  • Defining the Entity Lifecycle
  • Choosing the Learning Scheme
  • How to Learn: Never (Wildcard Only)
  • How to Learn: Always
  • How to Learn: Selective
  • Reviewing the Enforcement Readiness Period: Entities
  • Viewing Learning Suggestions and Staging Status
  • Violations Without Learning Suggestions
  • Defining the Learning Score
  • Defining Trusted and Untrusted IP Addresses
  • How to Learn: Compact
9

Cookies and Other Headers

  • F5 Advanced WAF Cookies: What to Enforce
  • Defining Allowed and Enforced Cookies
  • Configuring Security Processing on HTTP headers
10

Reporting and Logging

  • Overview: Big Picture Data
  • Reporting: Build Your Own View
  • Reporting: Chart based on filters
  • Brute Force and Web Scraping Statistics
  • Viewing F5 Advanced WAF Resource Reports
  • PCI Compliance: PCI-DSS 3.0
  • The Attack Expert System
  • Viewing Traffic Learning Graphs
  • Local Logging Facilities and Destinations
  • How to Enable Local Logging of Security Events
  • Viewing Logs in the Configuration Utility
  • Exporting Requests
  • Logging Profiles: Build What You Need
  • Configuring Response Logging
11

Advanced Parameter Handling

  • Defining Parameter Types
  • Defining Static Parameters
  • Defining Dynamic Parameters
  • Defining Dynamic Parameter Extraction Properties
  • Defining Parameter Levels
  • Other Parameter Considerations
12

Policy Diff and Administration

  • Comparing Security Policies with Policy Diff
  • Merging Security Policies
  • Restoring with Policy History
  • Examples of F5 Advanced WAF Deployment Types
  • ConfigSync and F5 Advanced WAF Security Data
  • ASMQKVIEW: Provide to F5 Support for Troubleshooting
13

Automatic Policy Building

  • Overview of Automatic Policy Building
  • Defining Templates Which Automate Learning
  • Defining Policy Loosening
  • Defining Policy Tightening
  • Defining Learning Speed: Traffic Sampling
  • Defining Track Site Changes
14

Web Application Vulnerability Scanner Integration

  • Integrating Scanner Output into F5 Advanced WAF
  • Will Scan be Used for a New or Existing Policy?
  • Importing Vulnerabilities
  • Resolving Vulnerabilities
  • Using the Generic XML Scanner XSD file
15

Layered Policies

  • Defining a Parent Policy
  • Defining Inheritance
  • Parent Policy Deployment Use Cases
16

Login Enforcement, Brute Force Mitigation, and Session Tracking

  • Defining Login Pages
  • Configuring Automatic Detection of Login Pages
  • Defining Session Tracking
  • What Are Brute Force Attacks?
  • Brute Force Protection Configuration
  • Defining Source-Based Protection
  • Source-Based Brute Force Mitigations
  • Defining Session Tracking
  • Configuring Actions Upon Violation Detection
  • Session Hijacking Mitigation Using Device ID
17

Web Scraping Mitigation and Geolocation Enforcement

  • Defining Web Scraping
  • Mitigating Web Scraping
  • Defining Geolocation Enforcement
  • Configuring IP Address Exceptions
18

Layer 7 DoS Mitigation and Advanced Bot Protection

  • Defining Denial of Service Attacks
  • The General Flow of DoS Protection
  • Defining the DoS Profile
  • Overview of TPS-based DoS Protection
  • Applying TPS mitigations
  • Create a DoS Logging Profile
  • Defining DoS Profile General Settings
  • Defining Bot Signatures
  • Defining Proactive Bot Defense
  • Defining Behavioral and Stress-Based Detection
  • Defining Behavioral DoS Mitigation
19

F5 Advanced WAF and iRules

  • Common Uses for iRules
  • Identifying iRule Components
  • Triggering iRules with Events
  • Defining F5 Advanced WAF iRule Events
  • Defining F5 Advanced WAF iRule Commands
  • Using F5 Advanced WAF iRule Event Modes
20

Using Content Profiles

  • Defining Asynchronous JavaScript and XML
  • Defining JavaScript Object Notation (JSON)
  • Defining Content Profiles
  • The Order of Operations for URL Classification

Encarta Labs Advantage

  • One Stop Corporate Training Solution Providers for over 6,000 various courses on a variety of subjects
  • All courses are delivered by Industry Veterans
  • Get jumpstarted from newbie to production ready in a matter of few days
  • Trained more than 50,000 Corporate executives across the Globe
  • All our trainings are conducted in workshop mode with more focus on hands-on sessions

View our other course offerings by visiting https://www.encartalabs.com/course-catalogue-all.php

Contact us for delivering this course as a public/open-house workshop/online training for a group of 10+ candidates.

Top
Notice
X