{"id":41374,"date":"2026-04-11T23:12:33","date_gmt":"2026-04-11T23:12:33","guid":{"rendered":"https:\/\/ramsdata.com.pl\/waf-in-f5-how-the-application-firewall-works-and-what-it-protects-against\/"},"modified":"2026-04-11T23:12:33","modified_gmt":"2026-04-11T23:12:33","slug":"waf-in-f5-how-the-application-firewall-works-and-what-it-protects-against","status":"publish","type":"post","link":"https:\/\/ramsdata.com.pl\/en\/waf-in-f5-how-the-application-firewall-works-and-what-it-protects-against\/","title":{"rendered":"WAF in F5 – how the application firewall works and what it protects against"},"content":{"rendered":"

A Web Application Firewall (WAF) is one of the key security components of any organization with web applications accessible from the Internet. Unfortunately, “we have a WAF” doesn’t always mean “we’re protected” – many WAF deployments operate in “monitor only” mode, have outdated signatures or are configured so carefully that they let most attacks through. WAF from F5 Networks<\/a> is a solution that, when properly configured, truly protects applications, not just generates logs. <\/p>\n

Table of contents<\/h3>\n
    \n
  1. What is a WAF and how is it different from a network firewall?<\/li>\n
  2. How WAF F5 works – inspection mechanisms<\/li>\n
  3. OWASP Top 10 protection against attacks<\/li>\n
  4. API protection – why does the WAF need to understand the API?<\/li>\n
  5. Bot management – how to distinguish a good bot from a bad one?<\/li>\n
  6. WAF in learning mode – automatic configuration of policies<\/li>\n
  7. Key findings<\/li>\n
  8. FAQ<\/li>\n
  9. Summary<\/li>\n<\/ol>\n

    What is a WAF and how is it different from a network firewall?<\/h3>\n

    A classic network firewall (L3\/L4) controls the flow of packets based on IP addresses, ports and protocols – allowing or blocking TCP\/UDP connections without insight into the content. WAF operates at the application layer (L7) and understands the HTTP\/HTTPS protocol – it analyzes the content of requests and responses, HTTP headers, URL parameters, POST request body and JSON\/XML structures. <\/p>\n

    This difference is fundamental: a SQL injection attack sent over port 443 (HTTPS) to a normal firewall looks like normal web traffic. WAF sees the content of the request, recognizes the SQL injection pattern and blocks it. The firewall protects the network, the WAF protects the application – and one does not replace the other. <\/p>\n

    F5 Networks<\/a> offers WAF as both a hardware appliance (BIG-IP ASM), virtual software and a cloud service (F5 Distributed Cloud WAAP) – giving you the flexibility to fit different deployment architectures.<\/p>\n

    How WAF F5 works – inspection mechanisms<\/h3>\n

    WAF F5 (Advanced WAF \/ BIG-IP ASM) uses several inspection mechanisms running in parallel. Signature inspection compares requests against a database of known attack patterns – hundreds of thousands of signatures for SQL injection, XSS, command injection, path traversal, SSRF and other categories. The signature database is regularly updated by F5 Threat Intelligence. <\/p>\n

    HTTP protocol analysis verifies that the request is a properly structured RFC-compliant HTTP request – protocol anomalies often indicate attacks or automated tools. Positive Security Model defines what is allowed (as opposed to negative security, which defines what is forbidden) – only requests that meet the defined format are allowed through, everything else is blocked. <\/p>\n

    Behavioral analysis analyzes user behavior over time – request patterns specific to automated tools (scanners, bots) are identified and blocked regardless of the signature of a specific attack.<\/p>\n

    OWASP Top 10 protection against attacks<\/h3>\n

    The OWASP Top 10 is a list of the 10 most serious categories of web application vulnerabilities, published by the Open Web Application Security Project. WAF F5 is optimized to block each of these categories. <\/p>\n

    Injection (SQL, NoSQL, LDAP, OS Command injection) – WAF analyzes request parameters in search of sequences characteristic of code injection attempts. The mechanism is resistant to typical bypass techniques (encoding, fragmentation, SQL comments). <\/p>\n

    Cross-Site Scripting (XSS) – blocking attempts to inject JavaScript code into requests that could be made in other users’ browsers. F5 WAF understands context – the same keyword can be allowed in the content of a blog post and blocked in the search parameter. <\/p>\n

    Broken Access Control and Security Misconfiguration – WAF can enforce access policies at the URL level, blocking access to resources that a user should not have access to.<\/p>\n

    Combining WAF with next-generation firewall solutions<\/a> creates a multi-layered protection from network to application.<\/p>\n

    API protection – why does the WAF need to understand the API?<\/h3>\n

    Modern web applications are largely APIs – frontends communicate with the backend via REST APIs, microservices communicate with each other via APIs, mobile apps call APIs. This makes APIs an increasingly important attack surface that classic WAFs (designed for HTML web applications) do not handle well. <\/p>\n

    F5 Advanced WAF has dedicated API security that understands REST, JSON and GraphQL structure. API security policies can validate the JSON body structure (whether the request contains the required fields, whether the data types are valid), enforce rate limits for specific API endpoints, protect against OWASP API Security Top 10 (BOLA\/IDOR, broken authentication, excessive data exposure and more), and manage API access through OAuth\/JWT integration. <\/p>\n

    Bot management – how to distinguish a good bot from a bad one?<\/h3>\n

    Not all bots are bad – Googelbot, monitoring bots, partner API bots are desirable traffic. Bad bots are: web scrapers stealing content, credential stuffing bots trying to take over accounts through a list of leaked passwords, bots clicking on ads, bots performing application DDoS attacks. <\/p>\n

    F5 Advanced WAF has a built-in bot management module that uses several techniques to identify bots. JavaScript challenge – the site sends a JavaScript challenge that must be executed by the browser. Bots without a JS engine will not pass the challenge. Browser fingerprinting – analysis of browser properties (fonts, plugins, WebGL, screen resolution) compared with expected values for the declared user-agent. CAPTCHA as escalation for suspicious traffic. Behavioral analysis – click patterns, mouse movement, time between actions specific to humans vs. automata. <\/p>\n

    WAF in learning mode – automatic configuration of policies<\/h3>\n

    Configuring a WAF from scratch is a tedious process – especially for complex applications with hundreds of endpoints and thousands of parameters. F5 Advanced WAF offers a learning mode (automatic policy builder) that observes application traffic for a defined period and automatically generates security policies based on observed patterns. <\/p>\n

    In learning mode, WAF does not block anything, but collects information: what URLs are available, what parameters each endpoint accepts, typical values and data types. After the learning period, WAF generates a positive security policy proposal, which the administrator reviews and approves or modifies. This greatly speeds up implementation and reduces the risk of blocking valid traffic. <\/p>\n

    Key findings<\/h3>\n