Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions content/nginxaas-azure/app-protect/configure-waf.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ This guide explains how to configure the F5 WAF for NGINX security features.

## Configure

To use NGINX App Protect apply the following changes to the NGINX config file.
To use F5 WAF for NGINX apply the following changes to the NGINX config file.

1. Load the F5 WAF for NGINX module on the main context:

Expand All @@ -27,7 +27,7 @@ load_module modules/ngx_http_app_protect_module.so;
app_protect_enforcer_address 127.0.0.1:50000;
```

{{< call-out "note" >}} The app_protect_enforcer_address directive is a required directive for Nginx App Protect to work and must match 127.0.0.1:50000{{< /call-out >}}
{{< call-out "note" >}} The app_protect_enforcer_address directive is a required directive for F5 WAF for NGINX to work and must match 127.0.0.1:50000{{< /call-out >}}


3. Enable F5 WAF for NGINX with the `app_protect_enable` directives in the appropriate scope. The `app_protect_enable` directive may be set in the `http`, `server`, and `location` contexts.
Expand All @@ -44,7 +44,7 @@ app_protect_enable on;
app_protect_policy_file /etc/app_protect/conf/NginxDefaultPolicy.json;
```

Sample Config with App Protect configured:
Sample Config with F5 WAF for NGINX configured:

```nginx
user nginx;
Expand Down Expand Up @@ -85,8 +85,8 @@ http {

## Precompiled Policies

NGINXaaS for Azure ships with the two reference policies (Default and Strict) supported in NGINX App Protect. These policies are supported in both the blocking and transparent enforcement modes.
For more information on these policies refer the NGINX App Protect [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).
NGINXaaS for Azure ships with the two reference policies (Default and Strict) supported in F5 WAF for NGINX. These policies are supported in both the blocking and transparent enforcement modes.
For more information on these policies refer the F5 WAF for NGINX [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).

The following table shows the path to the precompiled policy file that needs to be used with the `app_protect_policy_file` directive:

Expand All @@ -99,11 +99,11 @@ The following table shows the path to the precompiled policy file that needs to
| Strict | Transparent | /etc/app_protect/conf/NginxStrictPolicy_transparent.json |
{{< /table >}}

To view the contents of the available security policies, navigate to the azure portal and select the **Security Policies** tab in the App Protect section.
To view the contents of the available security policies, navigate to the azure portal and select the **Security Policies** tab in the F5 WAF for NGINX section.

## Custom policies

NGINXaas for Azure also supports custom security policies. You can create and modify custom security policies to deploy to NGINX App Protect Instances using the API or Azure Portal.
NGINXaas for Azure also supports custom security policies. You can create and modify custom security policies to deploy to F5 WAF for NGINX Instances using the API or Azure Portal.

### Manage custom policies

Expand All @@ -121,7 +121,7 @@ In the policy editor:
- The **File path** must start with the prefix "/etc/app_protect/conf/".
- The **File path** extension must be ".json".

After your policy has been saved, you can then reference it in your NGINX configuration. For more information on policy configuration and syntax, refer to the NGINX App Protect [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).
After your policy has been saved, you can then reference it in your NGINX configuration. For more information on policy configuration and syntax, refer to the F5 WAF for NGINX [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).

{{< call-out "note" >}}The **name** field within the security policy must be unique among the policies referenced in your NGINX configuration.{{< /call-out >}}

Expand Down
6 changes: 3 additions & 3 deletions content/nginxaas-azure/app-protect/enable-logging.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@ type:

## Overview

F5 NGINXaaS for Azure (NGINXaaS) supports exporting NGINX App Protect logs to an Azure Storage account or to a Log Analytics workspace.
F5 NGINXaaS for Azure (NGINXaaS) supports exporting F5 WAF for NGINX logs to an Azure Storage account or to a Log Analytics workspace.

## Setting up operational logs

NGINX App Protect operational logs are sent to the NGINX error logs. See [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}) to configure error logs.
F5 WAF for NGINX operational logs are sent to the NGINX error logs. See [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}) to configure error logs.

## Setting up security logs

Expand Down Expand Up @@ -93,7 +93,7 @@ The following table shows the path to the log configuration file that needs to b
| log_grpc_blocked | /etc/app_protect/conf/log_grpc_blocked.json |
{{< /table >}}

To view the contents of the available log configuration, navigate to the azure portal and select the Log Configurations tab in the App Protect section.
To view the contents of the available log configuration, navigate to the azure portal and select the Log Configurations tab in the F5 WAF for NGINX section.

### Logging Destinations

Expand Down
6 changes: 3 additions & 3 deletions content/nginxaas-azure/app-protect/enable-waf.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ This guide explains how to enable F5 WAF for NGINX on a F5 NGINX as a Service fo
## Before you start
- F5 WAF for NGINX can only be enabled on NGINXaaS for Azure deployments with the **Standard v2** [plan]({{< ref "/nginxaas-azure/billing/overview.md" >}})

## Enable NGINX App Protect
## Enable F5 WAF for NGINX

NGINX App Protect is disabled by default and needs to be explicitly enabled on an NGINXaaS deployment. Follow these steps:
F5 WAF for NGINX is disabled by default and needs to be explicitly enabled on an NGINXaaS deployment. Follow these steps:

### Using the Microsoft Azure Portal

Expand All @@ -26,7 +26,7 @@ Access the [Microsoft Azure portal](https://portal.azure.com)

2. Select NGINX app protect in the left menu.

3. Select **Enable App Protect**.
3. Select **Enable F5 WAF for NGINX**.

## What's next

Expand Down
2 changes: 1 addition & 1 deletion content/nginxaas-azure/changelog/changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ NGINXaaS now supports downloading certificate from Azure Key Vault via Private E

- {{% icon-feature %}} **Support for both precompiled and custom WAF policies in the same NGINX config**

NGINXaaS now allows both precompiled and custom policies for F5 NGINX App Protect WAF to be referenced within the same NGINX config. This removes a previous restriction.
NGINXaaS now allows both precompiled and custom policies for F5 WAF for NGINX to be referenced within the same NGINX config. This removes a previous restriction.

## September 18, 2025

Expand Down
2 changes: 1 addition & 1 deletion content/nginxaas-azure/loadbalancer-kubernetes.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ The NLK controller monitors [Kubernetes Services](https://kubernetes.io/docs/con

### Example use cases

- You can use NGINXaaS for Azure to enforce rate limiting and application security with NGINX App Protect, then forward all accepted traffic to your Kubernetes applications.
- You can use NGINXaaS for Azure to enforce rate limiting and application security with F5 WAF for NGINX, then forward all accepted traffic to your Kubernetes applications.
- You can use NGINXaaS for Azure to receive traffic on `api.example.com` and route requests by URL path - for example, forwarding `/login` to a Kubernetes-based login service, `/graph` to a Kubernetes-hosted graph service, and `/process` to an application server on a standalone VM.

## Getting Started
Expand Down
2 changes: 1 addition & 1 deletion content/nginxaas-azure/overview/feature-comparison.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ Below is a feature breakdown with notes on support and limitations.

**Limitations:**

- Internal redirect and App Protect DoS are not available
- Internal redirect and F5 WAF for NGINX DoS are not available

---

Expand Down