F5 & Azure Secure Cloud Computing Architecture

• F5 & Azure Secure Cloud Computing Architecture
  • Introduction
  • Prerequisites
  • Important configuration notes
  • PAYG versus BYOL Settings
  • Variables
  • Requirements
  • Providers
  • Inputs
  • Outputs
  • Deployment
  • Docker
  • Destruction
  • Docker
  • Development

Introduction

Moving to the Cloud can be tough. The Department of Defense (DoD) has requirements to protect the Defense Information System Networks (DISN) and DoD Information Networks (DoDIN), even for workloads residing in a Cloud Service Provider (CSP). Per the SCCA Functional Requirements Document, the purpose of SCCA is to provide a barrier of protection between the DISN and commercial cloud services used by the DoD.

“It specifically addresses attacks originating from mission applications that reside within the Cloud Service Environment (CSE) upon both the DISN infrastructure and neighboring tenants in a multi-tenant environment. It provides a consistent CSP independent level of security that enables the use of commercially available Cloud Service Offerings (CSO) for hosting DoD mission applications operating at all DoD Information System Impact Levels (i.e. 2, 4, 5, & 6).” * https://dl.dod.cyber.mil/wp-content/uploads/cloud/pdf/SCCA_FRD_v2-9.pdf

This solution uses Terraform to launch a Single Tiered or Three Tier deployment of three NIC cloud-focused BIG-IP VE cluster(s) (Active/Standby) in Microsoft Azure. This is the standard cloud design where the BIG-IP VE instance is running with three interfaces, where both management and data plane traffic is segregated.

The BIG-IP VEs have the following features / modules enabled:

• Local / Global Availability

• Firewall

  • Firewall with Intrusion Protection and IP Intelligence only available with BYOL deployments today.

• Web Application Firewall

Prerequisites

• Important: When you configure the admin password for the BIG-IP VE in the template, you cannot use the character #. Additionally, there are a number of other special characters that you should avoid using for F5 product user accounts. See K2873 for details.
• This template requires a service principal, one will be created in the provided script at ./prepare/setupAzureGovVars_local.sh.
  • Important For gov cloud deployments its important to run this script to prepare your environment, whether local or Azure Cloud CLI based. There are extra env variables that ned to be passed by TF to Gov Cloud Regions.
• This deployment will be using the Terraform Azurerm provider to build out all the neccessary Azure objects. Therefore, Azure CLI is required. for installation, please follow this Microsoft link
• If this is the first time to deploy the F5 image, the subscription used in this deployment needs to be enabled to programatically deploy. For more information, please refer to Configure Programatic Deployment
• You need to set your region and log in to azure ahead of time, the scripts will map your authenitcation credentials and create a service principle, so you will not need to hardcode any credentials in the files.

Important configuration notes

• All variables are configured in variables.tf
• MOST STIG / SRG configurations settings have been addressed in the Declarative Onboarding and Application Services templates used in this example.
• An Example application is optionally deployed with this template. The example appliation includes several apps running in docker on the host:
  • Juiceshop on port 3000
  • F5 Demo app by Eric Chen on ports 80 and 443
  • rsyslogd with PimpMyLogs on port 808
  • Note Juiceshop and PimpMyLogs URLS are part of the terraform output when deployed.
• All Configuration should happen at the root level; auto.tfvars or variables.tf.

PAYG versus BYOL Settings

• For PAYG deployments the variables image_name and product need to be configured accordingly, default values are set for PAYG.

  • Example: image_name = f5-bigip-virtual-edition-1g-best-hourly and product = f5-big-ip-best

• For BYOL deployments the variables image_name, product, and licenses need to be configured accordingly.

  • Example: image_name = f5-big-all-2slot-byol, product = f5-big-ip-byol, and licenses = appropriate licenses.

    Variables

Requirements

Providers

Inputs

{
  "application": "10.90.10.0/24",
  "external": "10.90.1.0/24",
  "inspect_ext": "10.90.4.0/24",
  "inspect_int": "10.90.5.0/24",
  "internal": "10.90.2.0/24",
  "management": "10.90.0.0/24",
  "vdms": "10.90.3.0/24",
  "waf_ext": "10.90.6.0/24",
  "waf_int": "10.90.7.0/24"
}

{
  "f5vm01mgmt": "10.90.0.4",
  "f5vm02mgmt": "10.90.0.5",
  "f5vm03mgmt": "10.90.0.6",
  "f5vm04mgmt": "10.90.0.7"
}

{
  "f5vm01ext": "10.90.1.4",
  "f5vm01ext_sec": "10.90.1.11",
  "f5vm02ext": "10.90.1.5",
  "f5vm02ext_sec": "10.90.1.12"
}

{
  "f5vm01int": "10.90.2.4",
  "f5vm01int_sec": "10.90.2.11",
  "f5vm02int": "10.90.2.5",
  "f5vm02int_sec": "10.90.2.12"
}

{
  "f5vm03ext": "10.90.6.4",
  "f5vm03ext_sec": "10.90.6.11",
  "f5vm04ext": "10.90.6.5",
  "f5vm04ext_sec": "10.90.6.12"
}

{
  "f5vm03int": "10.90.7.4",
  "f5vm03int_sec": "10.90.7.11",
  "f5vm04int": "10.90.7.5",
  "f5vm04int_sec": "10.90.7.12"
}

{
  "license1": "",
  "license2": "",
  "license3": "",
  "license4": ""
}

{
  "host1": "f5vm01",
  "host2": "f5vm02",
  "host3": "f5vm03",
  "host4": "f5vm04"
}

{
  "application": "f5app",
  "costcenter": "f5costcenter",
  "environment": "f5env",
  "group": "f5group",
  "owner": "f5owner",
  "purpose": "public"
}

Outputs

Deployment

For deployment you can do the traditional terraform commands or use the provided scripts.

terraform init
terraform plan
terraform apply

OR

./demo.sh

Docker

There is also a dockerfile provided, use make [options] to build as needed.

make build
make shell || make azure || make gov

Destruction

For destruction / tear down you can do the trafitional terraform commands or use the provided scripts.

terraform destroy

OR

./cleanup.sh

Docker

make destroy || make revolution

Development

Outline any requirements to setup a development environment if someone would like to contribute. You may also link to another file for this information.

  # test pre commit manually
  pre-commit run -a -v