Configure a Standalone CDN Distribution

• Log into Console.

• Click the Content Delivery Network service. The CDN distribution configuration page opens.

• Go to Manage > CDN Distributions.

Figure: CDN Distributions Page

• Click Add CDN Distribution.

• In the Name field, enter a name for the distribution.

• Optionally, select a label and enter a description.

• Go to Basic Configuration and enter a domain name in the Domains field. Ensure that you enter a Fully Qualified Domain Name (FQDN) of your web application. FQDN is the complete address of an internet host, specifying its exact location within the Domain Name System (DNS). It includes the hostname, domain name, and top-level domain (TLD). For example, www.f5.com.

• Click Add item to add more domains, if needed.

• Select an option for the Select Type of CDN Distribution. The following options are supported:

  • Select HTTP to create the HTTP Distribution. Click the Automatically Manage DNS Records checkbox if your domain is delegated to F5 Distributed Cloud. Else, ensure in your DNS provider configuration that your domain is resolved.

  • Select HTTPS with Automatic Certificate to create the HTTPS Distribution with an automatic TLS certificate. Ensure that the domain is delegated to F5 Distributed Cloud. Optionally, click HTTP Redirect to HTTPS and Add HSTS Header checkboxes to enable those functions. You can also select the TLS Security Level to be high or medium. The High option is TLS v1.2+ PFS ciphers with strong cryptographic algorithms. The Medium option is TLS v1.1+ PFS ciphers with medium strength cryptographic algorithms.

  • Select HTTPS with Custom Certificate to create the HTTPS Distribution with your custom TLS certificate. Optionally, click HTTP Redirect to HTTPS and Add HSTS Header checkboxes to enable those functions.

• If you are using the HTTPS with Custom Certificate option:

  • Use the TLS Configuration drop-down menu to choose between TLS Certificates or Inline Certificate (legacy) options, and then click Configure.

  • From the TLS Security Level drop-down menu, select high, medium, low, or custom.

  • From the Certificates drop-down menu, either select an existing certificate or select Add Item to see the TLS Certificate form. For a new certificate:

    

    Figure: TLS Certificate Form

    • Enter a name and optionally labels and a description.

    • Click Import from File to see the sliding import panel. Click Upload File and select your file using the system file browser. Then click Import.

    • From the OCSP Stapling choice drop-down menu, select an OCSP stapling choice. Note that OCSP stapling is not supported when the shared certificate is used in a CDN distribution.

Note: OCSP stapling is not supported when the shared certificate is used in a CDN distribution.

• If you have an intermediate chain, select Add Item from the Intermediate Certificate Chain drop-down menu. Then upload the intermediate chain the same way you uploaded the certificate.

• Click Continue.

• Click Apply to save your TLS parameters.

This example configures a CDN Distribution of type HTTPS with Automatic Certificates.

Figure: Distribution of Type HTTPS with Automatic Certificate

• Click Configure in the CDN Origin Pools section. The CDN origin pool configuration page opens.

• Enter the CDN origin domain name in the DNS Name field. The requests to origin servers use this name in the host header.

• Select a TLS choice in the Enable TLS for Origin Servers field. Ensure that this matches your origin server configuration.

• Click Add Item in the List of Origin Servers section. In the origin servers page, enter public DNS name or public IP of your origin server. Click Apply.

• Enter a time value in the Origin Request Timeout Duration field. The default is 60s (sixty seconds).

• Click Apply in the CDN origin pool configuration page.

Figure: Origin Pool Configuration

• In the Caching Policies section, select an option for the Cache Actions field using following guidelines:

  • Select Default Cache TTL if the origin server does not provide a TTL value. Set the value in the Default Cache TTL field.
  • Select Override Cache TTL if the origin server provides a TTL in the response, and you want to override it. Set the value in the Override Cache TTL field.
  • Select Disable Cache to disallow caching content from the origin.

• Optionally create rules in the Cache Rules section to determine the content that is or is not cached. For information on creating Cache Rules, refer Configure CDN Cache Rules.

• Click Apply.

Important: This is an Early Access (EA) feature. To request access, sign up at F5 Beta.

You can choose to disable WAF application (default setting) or you can select a WAF that was previously created, configured, and apply it in your load balancer security settings. In addition, you can also create and enable a new WAF and have your load balancer configured to exclude specific WAF rules from processing certain requests.

• Go to the Web Application Firewall section.

• From the Web Application Firewall (WAF) drop-down menu, select whether to enable the WAF for this CDN distribution. Disable is the default value.

• If you click Enable for All Requests, use the Enable for All Requests drop-down menu to select your WAF to apply to this load balancer, or select Add Item to create a new WAF.

Figure: Add App Firewall

• To add exclusion rules for the WAF, follow the instructions at Create WAF Exclusion Rules.

• Click Configure in the Data Guard Rules section and follow the instructions listed in Configure Data Guard to set data guard rules.

• Click Configure for the Cross-Site Request Forgery Protection option. Specify allowed domains in the Allowed Domains (Source Origin) field in the CSRF protection page, and click Apply. You can either configure to allow all load balancer domains or set specific domains to the allow list.

Note: You can verify the CSRF mitigation in the load balancer security monitoring page. The CSRF mitigation event is displayed as a Service Policy event. Expand the security event's JSON view. The sec_event_name field with value CSRF Policy Violation indicates that CSRF mitigation is active. For more information on load balancer monitoring, see Monitor HTTP Load Balancer.

• To configure the settings for GraphQL inspection, perform the following:

  • Under the GraphQL Inspection section, click Configure.

  • Click Add Item.

  • In the Name field, enter a name for this rule.

  • From the Domain drop-down menu, select an option that corresponds to your domain setting. Default value is Any Domain. You can choose an option match by Exact Value or Suffix Value.

  • From the Path drop-down menu, select an option for the location of your GraphQL server endpoint. Default value is /graphql.

  • From the HTTP Method drop-down menu, select an option that specifies the method used to access the GraphQL endpoint server.

  • In the GraphQL Settings section, perform the following:

    • From the Maximum Total Length menu, enter a value to specify the maximum total length in bytes for a query.

    • From the Maximum Structure Depth menu, enter a value to specify the maximum depth for a query.

    • From the Maximum Batched Queries menu, enter a value to specify the maximum number of single batch queries.

    • From the Introspection Queries menu, select whether to enable introspection of GraphQL schema.

  • Click Apply to save settings.

  • Click Apply to apply settings to load balancer configuration.

• Optionally, in the Cookie Protection field, click Configure to add attributes to an HTTP Response cookie that is sent to the client:

  • Click Add Item.

  • In the Cookie Name field, enter a name for this cookie.

Note: Wildcards and regular expressions (regex) are not supported. You must use the exact cookie name.

• From the SameSite menu, select if or how the new cookie is sent with same-site and cross-site requests. You can select from the following:

  • Ignore
  • Strict
  • Lax
  • None

• From the Secure menu, select whether this new cookie is sent only over an HTTPS encrypted connection to the server. Default option is Ignore.

• From the HttpOnly menu, select whether this new cookie is inaccessible to JavaScript Document.cookie API. Default option is Ignore. Click Add to ensure the cookie is inaccessible.

• Click Enable for the Cookie Tampering Protection field to enable cookie tampering protection. This prevents attackers from modifying the values of session cookies.

• Click Apply to save settings.

• Click Apply to apply settings to load balancer configuration.

Important: This is an Early Access (EA) feature. To request access, sign up at F5 Beta.

Go to API Protection section and do the following:

• Under JWT Validation, click Configure.

• In the Target menu, Base Paths is selected. Enter one or more Prefix Values for token validation.

• Target location (Bearer Token) will look for the JWT token in the Authorization HTTP header with Bearer authentication scheme.

• Action (Block) will block the request is the JWT is not valid.

• Under JSON Web Key Set (JWKS), click Configure.

• In the text box, copy and paste the JSON Web Key Set (JWKS) used for authorization with the server. JWKS should be in JSON format.

• Click Apply to save the JWKS.

• Click Apply to complete JWT validation rules.

Important: This is an Early Access (EA) feature. To request access, sign up at F5 Beta.

• From the L7 DDoS Auto Mitigation menu, select an option:

  • Default: This option blocks traffic from suspicious sources. No JavaScript challenge is returned.

  • Block: This option blocks traffic from suspicious sources. No JavaScript challenge is returned.

  • JavaScript Challenge: This option serves a JavaScript challenge to all traffic from suspicious sources. Click View Configuration to change the default settings and message for the JavaScript challenge.

• Under DDoS Mitigation Rules, select Configure to open the rules list page. Use Add Item to add a rule:

  • In the DDoS Mitigation Rule page, set a name for the rule.

  • Select a choice for the Mitigation Choice menu. The mitigation choice can be either a list of IP addresses or combination of ASN, Region, and TLS Fingerprinting.

  • Click Apply to add the rule to the list of rules.

  • Click Apply to add the rules list to the DDoS protection configuration.

• From the Slow DDoS Mitigation menu, select an option:

  • For the Custom option, enter Request Headers Timeout and Total Request Timeout values.

Note: See the Explore Security Monitoring section in the Monitor HTTP Load balancer guide to learn more about observing and reacting to an active DDoS attack.

Important: This is an Early Access (EA) feature. To request access, sign up at F5 Beta.

The Common Security Controls section allows you to configure a number of common security measures to protect your CDN distribution.

Step 8.1: Service Policies.

Figure: Service Policy Configuration

• From the Service Policies menu, select an option to apply the service policy. The following options are available:

  • Apply Namespace Service Policies: This option applies the service policy to an entire namespace.

  • Do Not Apply Service Policies: This option does not apply any service policy.

  • Apply Specified Service Policies: This option applies a service policy to a specified load balancer, not the entire namespace.

• To apply a specific service policy, select Apply Specified Service Policies, and perform the following:

  • Click Configure.
  

  Figure: Apply Specific Service Policy

  • From the Policies menu, select a service policy, and then click Apply.
  

  Figure: Select Specific Service Policy

Important: This is an Early Access (EA) feature. To request access, sign up at F5 Beta.

The Cross-Origin Resource Sharing (CORS) policy is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources.

• In the CORS Policy field, click Configure.

• To enable a specific origin server, click Add item under the Allow Origin field.

• To enable origin servers by regex, click Add item under the Allow Origin Regex field.

• In the Allow Methods field, enter information to be used for the access-control-allow-methods header.

• In the Allow Headers field, enter information to be used for the access-control-allow-headers header.

• In the Expose Headers field, enter information to be used for the access-control-expose-headers header.

Figure: CORS Policy

• In the Maximum Age field, enter information in seconds to cache the headers.

• After you finish, click Apply.

• Click the Add Location checkbox to append the location header in the response. Value for this header is the Regional Edge Site name that serves your request.

Click Save and Exit.

It might take a few minutes for your CDN Distribution to be deployed and to be ready to cache and serve content at Regional Edges. Check your distribution in the CDN Distributions table and verify its status is listed as Active. Click > against your distribution object and expand its JSON view. Verify that the service domain is created.

Delegated Domain with Automatic Certificates:

• Wait for the DNS Info and Certificate status to display the VIRTUAL_HOST_READY and Certificate Valid values.

Figure: Distribution Created

• Verify that the requests to your CDN domain are processed, and the content is returned.

Note: In case of content updates in your origin servers, you can force the CDN servers to fetch the updated content using the purge option. Click ... > Purge for your distribution object and the CDN service initiates purge for all the cache servers. Purging manually does not immediately delete content, but marks content as expired. When expired content is requested, the CDN service performs a HEAD request to the origin. If the CDN finds that the content time stamp is not changed, the existing expired entry is marked as active. This prevents a re-fetch from the origin and saves time and bandwidth in re-downloading the content.