Skip to content

Commit a4c7f7d

Browse files
authored
Merge branch 'main' into ps-dev-waf-dir
2 parents 1c7a4d6 + b3b84c3 commit a4c7f7d

File tree

3 files changed

+229
-1262
lines changed

3 files changed

+229
-1262
lines changed

content/ngf/overview/gateway-api-compatibility.md

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ Learn which Gateway API resources NGINX Gateway Fabric supports and to which lev
1313

1414
{{< bootstrap-table "table table-striped table-bordered" >}}
1515

16-
| Resource | Core Support Level | Extended Support Level | Implementation-Specific Support Level | API Version | API Release Channel |
17-
|---------------------------------------|--------------------|------------------------|---------------------------------------|-------------|---------------------|
18-
| [GatewayClass](#gatewayclass) | Supported | Not supported | Supported | v1 | Standard |
19-
| [Gateway](#gateway) | Supported | Partially supported | Not supported | v1 | Standard |
20-
| [HTTPRoute](#httproute) | Supported | Partially supported | Not supported | v1 | Standard |
21-
| [GRPCRoute](#grpcroute) | Supported | Partially supported | Not supported | v1 | Standard |
22-
| [ReferenceGrant](#referencegrant) | Supported | N/A | Not supported | v1beta1 | Standard |
23-
| [TLSRoute](#tlsroute) | Supported | Not supported | Not supported | v1alpha2 | Experimental |
24-
| [TCPRoute](#tcproute) | Not supported | Not supported | Not supported | v1alpha2 | Experimental |
25-
| [UDPRoute](#udproute) | Not supported | Not supported | Not supported | v1alpha2 | Experimental |
26-
| [BackendTLSPolicy](#backendtlspolicy) | Supported | Supported | Not supported | v1alpha3 | Experimental |
27-
| [Custom policies](#custom-policies) | N/A | N/A | Supported | N/A | N/A |
16+
| Resource | Core Support Level | Extended Support Level | Implementation-Specific Support Level | API Version | API Release Channel |
17+
|---------------------------------------|---------------------|------------------------|---------------------------------------|-------------|---------------------|
18+
| [GatewayClass](#gatewayclass) | Supported | Not supported | Supported | v1 | Standard |
19+
| [Gateway](#gateway) | Supported | Partially supported | Not supported | v1 | Standard |
20+
| [HTTPRoute](#httproute) | Supported | Partially supported | Not supported | v1 | Standard |
21+
| [GRPCRoute](#grpcroute) | Supported | Partially supported | Not supported | v1 | Standard |
22+
| [ReferenceGrant](#referencegrant) | Supported | N/A | Not supported | v1beta1 | Standard |
23+
| [TLSRoute](#tlsroute) | Supported | Not supported | Not supported | v1alpha2 | Experimental |
24+
| [TCPRoute](#tcproute) | Not supported | Not supported | Not supported | v1alpha2 | Experimental |
25+
| [UDPRoute](#udproute) | Not supported | Not supported | Not supported | v1alpha2 | Experimental |
26+
| [BackendTLSPolicy](#backendtlspolicy) | Partially Supported | Supported | Partially supported | v1alpha3 | Experimental |
27+
| [Custom policies](#custom-policies) | N/A | N/A | Supported | N/A | N/A |
2828

2929
{{< /bootstrap-table >}}
3030

@@ -109,6 +109,8 @@ See the [static-mode]({{< ref "/ngf/reference/cli-help.md#static-mode">}}) comma
109109
- `options`: Not supported.
110110
- `allowedRoutes`: Supported.
111111
- `addresses`: Not supported.
112+
- `infrastructure`: Not supported.
113+
- `backendTLS`: Not supported.
112114
- `status`
113115
- `addresses`: Partially supported (LoadBalancer and Pod IP).
114116
- `conditions`: Supported (Condition/Status/Reason):
@@ -335,30 +337,32 @@ Fields:
335337

336338
{{< bootstrap-table "table table-striped table-bordered" >}}
337339

338-
| Resource | Core Support Level | Extended Support Level | Implementation-Specific Support Level | API Version | API Release Channel |
339-
|------------------|--------------------|------------------------|---------------------------------------|-------------|---------------------|
340-
| BackendTLSPolicy | Supported | Supported | Not supported | v1alpha3 | Experimental |
340+
| Resource | Core Support Level | Extended Support Level | Implementation-Specific Support Level | API Version | API Release Channel |
341+
|------------------|---------------------|------------------------|---------------------------------------|-------------|---------------------|
342+
| BackendTLSPolicy | Partially Supported | Supported | Partially Supported | v1alpha3 | Experimental |
341343

342344
{{< /bootstrap-table >}}
343345

344346
Fields:
345347

346348
- `spec`
347349
- `targetRefs`
348-
- `group` - supported.
349-
- `kind` - supports `Service`.
350-
- `name` - supported.
350+
- `group`: Supported.
351+
- `kind`: Supports `Service`.
352+
- `name`: Supported.
351353
- `validation`
352-
- `caCertificateRefs` - supports single reference to a `ConfigMap`, with the CA certificate in a key named `ca.crt`.
353-
- `name`- supported.
354-
- `group` - supported.
355-
- `kind` - supports `ConfigMap`.
356-
- `hostname` - supported.
357-
- `wellKnownCertificates` - supports `System`. This will set the CA certificate to the Alpine system root CA path `/etc/ssl/cert.pem`. NB: This option will only work if the NGINX image used is Alpine based. The NGF NGINX images are Alpine based by default.
354+
- `caCertificateRefs`: Supports single reference to a `ConfigMap`, with the CA certificate in a key named `ca.crt`.
355+
- `name`: Supported.
356+
- `group`: Supported.
357+
- `kind`: Supports `ConfigMap`.
358+
- `hostname`: Supported.
359+
- `wellKnownCertificates`: Supports `System`. This will set the CA certificate to the Alpine system root CA path `/etc/ssl/cert.pem`. NB: This option will only work if the NGINX image used is Alpine based. The NGF NGINX images are Alpine based by default.
360+
- `subjectAltNames`: Not supported.
361+
- `options`: Not supported.
358362
- `status`
359363
- `ancestors`
360-
- `ancestorRef` - supported.
361-
- `controllerName`: supported.
364+
- `ancestorRef`: Supported.
365+
- `controllerName`: Supported.
362366
- `conditions`: Partially supported. Supported (Condition/Status/Reason):
363367
- `Accepted/True/PolicyReasonAccepted`
364368
- `Accepted/False/PolicyReasonInvalid`

content/nim/nginx-app-protect/setup-waf-config-management.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
description: Learn how to use F5 NGINX Management Suite Instance Manager to secure your
2+
description: Learn how to use F5 NGINX Instance Manager to secure your
33
applications with NGINX App Protect WAF security policies.
44
docs: DOCS-996
55
doctypes:
@@ -23,7 +23,7 @@ Complete the following prerequisites before proceeding with this guide.
2323

2424
- You have one or more instances of [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect/admin-guide/install/) installed and running. See [Support for NGINX App Protect WAF]({{< relref "tech-specs#support-for-nginx-app-protect-waf" >}}) for a list of supported versions.
2525

26-
{{<note>}}If you are using configuration management and the NGINX Management Suite Security Monitoring module, follow the instructions in the [setup guide]({{<relref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances" >}}) to set up your NGINX App Protect instances before proceeding with this guide.{{</note>}}
26+
{{<note>}}If you are using configuration management and the NGINX Instance Manager Security Monitoring, follow the instructions in the [setup guide]({{<relref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances" >}}) to set up your NGINX App Protect instances before proceeding with this guide.{{</note>}}
2727

2828
- You have Instance Manager v2.6.0 or later [installed]({{< relref "/nim/deploy/vm-bare-metal/_index.md" >}}), licensed, and running.
2929
If you have a subscription to NGINX App Protect WAF, you can find your Instance Manager license in the subscription details section of [MyF5](https://my.f5.com).
@@ -42,7 +42,7 @@ Instance Manager does not support the following NGINX App Protect features:
4242

4343
## Install the WAF Compiler
4444

45-
Instance Manager can use the NGINX App Protect WAF compiler to "pre-compile" security configurations before syncing them to managed data plane instances. You'll need to install the WAF compiler package on the NGINX Management Suite host to enable this functionality. If you'll be continuing with WAF compilation on the data plane host, installing the WAF compiler on the NGINX Management Suite host is not necessary.
45+
Instance Manager can use the NGINX App Protect WAF compiler to "pre-compile" security configurations before syncing them to managed data plane instances. You'll need to install the WAF compiler package on the NGINX Instance Manager host to enable this functionality. If you'll be continuing with WAF compilation on the data plane host, installing the WAF compiler on the NGINX Instance Manager host is not necessary.
4646

4747
Be sure to download and install the correct WAF compiler version for your environment:
4848

@@ -167,7 +167,7 @@ Take the steps below to download the WAF compiler, Attack Signatures, and Threa
167167
1. Select **Product Line**: **NGINX App Protect**.
168168
1. Select a **Product version**.
169169
1. Select the **Linux distribution**, **distribution version**, and **Architecture**.
170-
1. Download the WAF compiler package and transfer it to the NGINX Management Suite host.
170+
1. Download the WAF compiler package and transfer it to the NGINX Instance Manager host.
171171
1. Run the appropriate command on the host to install the WAF compiler package from the file.
172172

173173
- Debian or Ubuntu:
@@ -220,7 +220,7 @@ NGINX App Protect provides predefined [Attack Signatures](https://docs.nginx.com
220220
221221
[Threat Campaigns](https://docs.nginx.com/nginx-app-protect/configuration-guide/configuration/#threat-campaigns) is a threat intelligence feature included in an NGINX App Protect WAF subscription. The feature includes frequent update feeds containing contextual information about active attack campaigns currently being observed by F5 Threat Labs that NGINX App Protect WAF can provide protection against. Just like Attack Signatures, the Threat Campaign patterns are updated regularly. Unlike Attack Signatures, the NGINX App Protect WAF installation does not include any Threat Campaigns and you need to install them in order for the protection to take effect. Due to the highly dynamic nature of those campaigns the updates are issued far more frequently than the Attack Signatures. You need to install those updates close to the time they are issued in order to get the most effective protection.
222222
223-
In order to take advantage of new Attack Signature and Threat Campaign packages, you need to upload these packages to NGINX Management Suite.
223+
In order to take advantage of new Attack Signature and Threat Campaign packages, you need to upload these packages to NGINX Instance Manager.
224224
225225
You can either configure Instance Manager to download new versions automatically, or manage the files manually by downloading the packages from MyF5 and then uploading them to Instance Manager by using the REST API.
226226
@@ -462,7 +462,7 @@ To onboard your NGINX App Protect WAF instances to Instance Manager, you need to
462462
463463
1. Use SSH to connect to the NGINX App Protect WAF instance. Take the steps below for each instance to download and install NGINX Agent from the management plane host.
464464
465-
1. Download the NGINX Agent package from the NGINX Management Suite host and run the agent install script.
465+
1. Download the NGINX Agent package from the NGINX Instance Manager host and run the agent install script.
466466
467467
{{< tip >}}You can add instances with the same version of NGINX App Protect installed to an instance group by running the agent install command on each instance with the optional `--instance-group`` flag.{{< /tip>}}
468468
{{< include "agent/installation/install-agent-api.md" >}}
@@ -913,12 +913,12 @@ server {
913913
## enable logging
914914
app_protect_security_log_enable on;
915915
## Reference to the log profile bundle
916-
app_protect_security_log /etc/nms/log-default.tgz;
916+
app_protect_security_log /etc/nms/log-default.tgz /var/log/nginx/security-violations.log;
917917
...
918918
}
919919
```
920920
921-
{{< note >}}If you're using the NGINX Management Suite Security Monitoring module, you should already have the `app_protect_security_log` directive set to reference the `secops_dashboard.tgz` file as shown below. Do not change this setting.
921+
{{< note >}}If you're using the NGINX Instance Manager Security Monitoring, you should already have the `app_protect_security_log` directive set to reference the `secops_dashboard.tgz` file as shown below. Do not change this setting.
922922

923923
```nginx
924924
app_protect_security_log "/etc/nms/secops_dashboard.tgz" syslog:server=127.0.0.1:514;
@@ -1056,11 +1056,11 @@ Once you have added the NGINX App Protect WAF directives to your NGINX configura
10561056
If you're having issues with NGINX App Protect WAF, we suggest trying the following troubleshooting steps. If none of them helps, please reach out to NGINX Customer Support for further assistance.
10571057
10581058
<details>
1059-
<summary>Verify that NGINX App Protect WAF is not installed on the NGINX Management Suite host</summary>
1059+
<summary>Verify that NGINX App Protect WAF is not installed on the NGINX Instance Manager host</summary>
10601060
1061-
To ensure no library conflicts arise when installing `nms-nap-compiler`, verify that NGINX App Protect WAF is not installed on the NGINX Management Suite host. You can do this by taking the following steps:
1061+
To ensure no library conflicts arise when installing `nms-nap-compiler`, verify that NGINX App Protect WAF is not installed on the NGINX Instance Manager host. You can do this by taking the following steps:
10621062
1063-
1. Open an SSH connection to your NGINX Management Suite host and log in.
1063+
1. Open an SSH connection to your NGINX Instance Manager host and log in.
10641064
2. Run the following command:
10651065
10661066
- Debian-based distributions, run `dpkg -s app-protect`
@@ -1077,7 +1077,7 @@ Each NGINX App Protect WAF version has a corresponding version of the WAF compil
10771077

10781078
To view the installed version of the WAF compiler:
10791079

1080-
1. Open an SSH connection to your NGINX Management Suite host and log in.
1080+
1. Open an SSH connection to your NGINX Instance Manager host and log in.
10811081
2. Run the following command:
10821082

10831083
```shell
@@ -1139,7 +1139,7 @@ extensions:
11391139
nginx_app_protect:
11401140
# Report interval for NGINX App Protect details - the frequency the NGINX Agent checks NGINX App Protect for changes.
11411141
report_interval: 15s
1142-
# Enable precompiled publication from the NGINX Management Suite (true) or perform compilation on the data plane host (false).
1142+
# Enable precompiled publication from the NGINX Instance Manager (true) or perform compilation on the data plane host (false).
11431143
precompiled_publication: true
11441144
11451145
nap_monitoring:

0 commit comments

Comments
 (0)