Application Firewall Add On

The Library — Add-Ons
page is the location of all of your deployed Add-Ons. If this
page is blank it means that you have not deployed any Add-Ons yet. You can
view your available Apps in the Library — Apps page. Here you will need
to first Download the App and then the Deploy button will become
available. You may Deploy more than one type of Add-On. For example you
may want to deploy two instances of a Firewall Add-On for different
services.

• Buying an Application Firewall Add-On

• Running your Application Firewall

• Example Architecture

• Accessing your Firewall Add-On

Buying an Application Firewall Add-On

• You can access the App Store direct at https://appstore.edgenexus.io or open the Services — App Store page from within your ALB-X

• Click on the Add-On icon 
• Click on the edgeNEXUS Application Firewall icon

• You will see more information about the Application Firewall
• You can then choose how many you would like to download. If you are accessing the App Store from within your ALB-X please choose only 1
• If you are accessing direct from the website you may choose multiple and you can assign the correct MachineID to the App later in the process
• Click Add to Cart. (These are often free)
• Proceed to Checkout.
• Here you will be asked to login if you are a returning customer
• Alternatively you can fill out your billing details and tick the box to create an account. You will not be charged for products that are free
• Click Place Order
• You should now be presented with a screen that allows you download your product manually by entering the MachineID and clicking Download
  
• If the download is blanked out then you have already tied a purchase to another ALB-X
• If you have purchased from within an ALB-X via the Services — App Store page then you can now see your purchased Apps in the Library — Apps page
• Once you have purchased your Firewall App, the first step is to find it in the Library–Apps page and click the green Download button

• Once your Firewall has been downloaded you will be able to click the Deploy button (it will be greyed out if the Firewall has not been downloaded)

• Once you click Deploy your Firewall will be deployed in the Library — Add-Ons page

Running your Application Firewall

All Add-Ons run in a Docker Container and therefore have some networking constraints.
Once you have deployed your Add-On you will be able to set some parameters and start it

Stop:

Pause:

Play:

Container name:

External IP:

External Port:

Update:

Remove Add-On:

Parent Image:

Internal IP:

Started At:

Stopped At:

Example Architecture

Firewall Using External IP Address:

• In this architecture only HTTP can be used for your service as the Firewall cannot inspect HTTPS traffic.
• The Firewall will need to be configured to send traffic on to the ALB-X VIP.
• The ALB-X VIP in turn will be configured to load balance traffic to your web cluster.

Firewall Using Internal IP Address:

• In this architecture you can specify HTTP and HTTPS.
• HTTPS can be end to end where the connections from the Client to ALB-X are
  encrypted and also from the ALB-X to the Real Servers.
• The traffic from the ALB-X to the internal IP address of the firewall needs to be un-encrypted so that it can be inspected.
• Once the traffic has passed through the Firewall it is then forwarded on to
  another VIP which can then either re-encrypt  the traffic and load
  balance to secure servers or  simply load balance to insecure
  servers over HTTP.

Accessing your Firewall Add-On

• Fill out the details for your Firewall
• You can either restrict your Ports to what you need or leave it blank to allow all ports
• Click the Play button
• An Add-On GUI button will appear

• Click on this button and it will open up a browser on http://[External IP]:88/waf in this example it will be http://10.4.8.15:88/waf

• Username:  admin
• Password:  jetnexus
• It is recommended to change the default password in the Management–Users section
• After logging in you will see the home page of the Application Firewall

• The home page displays a graphical overview of the events, i.e. filtering actions performed by the Application Firewall.
• The graphs will most likely be blank when you first open the page as there will be no access attempts through the firewall.
• You
  can configure the IP address or the domain name of the web site you
  will like to send the traffic to after it has been filtered by the
  firewall.
• This is changed in the Management—>Config section

• The Firewall will inspect the traffic and then send it on to the Real Sever IP or VIP address here. You may also enter a port along with your IP address. If you just enter an IP address on its own the port will be assumed to be port 80. Click the “Update Configuration” button so save this new setting.
• When the Firewall blocks an application resource, the rule that is blocking traffic will appear in the Blocking Rules list on the Whitelist page.
• In order to prevent the firewall from blocking the valid application resource, please move the blocking rule to the Whitelist Rules section.

• Press Update Configuration when you have transferred all the rules from the Blocking section to the Whitelist section.

Updating Rules

• edgeNEXUS Application Firewall rules can be updated by accessing the Advanced — Software
• Click the Refresh to view available software button in the Software Upgrade Details section
• This will reveal an additional box called Download from Cloud
• Check to see if you there is an OWASP Core Rule set available

• If so you can highlight and click Download Selected Software to ALB-X
• This will then download the smart file to the Apply Software stored on ALB

• Highlight the jetNEXUS-WAF-OWASP-CRS and click Apply Selected Software Update and click Apply
• The Firewall will automatically detect updated rule set, load and apply it.
• The IDs
  of Whitelisted rules will be kept, however new rules may start blocking valid
  application resources.
• Please check the Blocking Rules list on the Whitelist
  page in this case.
• You can also check the Management Info section of the Firewall GUI for the OWASP CRS Version