Integrate

F5 XC Origin Pool Integration

This origin server is designed to be used as an origin pool member behind an F5 Distributed Cloud HTTP load balancer. The F5 XC platform provides WAF, Bot Defense, API Security, and Client-Side Defense in front of this origin.

Architecture

End User -> F5 XC HTTP LB (WAF/Bot/API/CSD) -> Origin Server VM (nginx -> Docker apps)

Origin Pool Configuration

Create an F5 XC origin pool pointing to this VM’s public IP:

Setting	Value
Origin Server Type	Public IP of Origin Server
IP Address	<terraform output public_ip>
Port	80
Health Check	HTTP, path /health

HTTP Load Balancer Configuration

Create an HTTP load balancer with the origin pool:

Setting	Value
Domains	Your demo domain (e.g., demo.example.com)
Origin Pool	The pool created above
WAF	Attach your WAF policy
Bot Defense	Enable as needed
API Discovery	Enable for VAmPI endpoints

Path-Based Routing

Each application is accessible via its path prefix through the load balancer:

F5 XC LB URL	Origin Path	Application
https://demo.example.com/juice-shop/	/juice-shop/	Juice Shop (4 instances, cookie sticky)
https://demo.example.com/dvwa/	/dvwa/	DVWA (4 instances + MariaDB, cookie sticky)
https://demo.example.com/vampi/	/vampi/	VAmPI (4 instances, ip_hash sticky)
https://demo.example.com/httpbin/	/httpbin/	httpbin (4 instances, round-robin)
https://demo.example.com/whoami/	/whoami/	Request diagnostics (4 instances)
https://demo.example.com/csd-demo/	/csd-demo/	CSD Demo (4 instances, ip_hash sticky)
https://demo.example.com/dvga/	/dvga/	DVGA (4 instances, ip_hash sticky)
https://demo.example.com/restaurant/	/restaurant/	RESTaurant (4 instances, round-robin)
https://demo.example.com/health	/health	Health check (nginx direct)

Verify F5 XC Header Injection

Use the whoami endpoint to verify what headers F5 XC injects into requests reaching the origin:

LB_DOMAIN="demo.example.com"

curl -sk "https://${LB_DOMAIN}/whoami/"

Look for these F5 XC injected headers in the response:

Header	Meaning
X-Forwarded-For	Client IP chain through F5 XC
True-Client-IP	Original client IP
X-Forwarded-Proto	https if TLS terminates at F5 XC
X-Volterra-Bot-Type	Bot classification (when Bot Defense is enabled)
X-Request-ID	F5 XC request tracking ID

WAF Testing Through F5 XC

With a WAF policy attached to the HTTP load balancer, test attack payloads:

LB_DOMAIN="demo.example.com"

# SQL Injection (should be blocked by WAF)
curl -sk "https://${LB_DOMAIN}/dvwa/vulnerabilities/sqli/?id=%27+OR+1%3D1--&Submit=Submit"

# XSS (should be blocked by WAF)
curl -sk "https://${LB_DOMAIN}/juice-shop/rest/products/search?q=<script>alert(1)</script>"

# Command Injection (should be blocked by WAF)
curl -sk "https://${LB_DOMAIN}/dvwa/vulnerabilities/exec/" \
  -d "ip=127.0.0.1;cat+/etc/passwd&Submit=Submit"

# Normal request (should pass through)
curl -sk "https://${LB_DOMAIN}/httpbin/get" | jq .

API Security Testing

Enable API Discovery on the HTTP load balancer to map VAmPI’s API endpoints:

# These requests build the API inventory in F5 XC
curl -sk "https://${LB_DOMAIN}/vampi/users/v1"
curl -sk -X POST "https://${LB_DOMAIN}/vampi/users/v1/register" \
  -H "Content-Type: application/json" \
  -d '{"username":"apitest","password":"test123","email":"api@test.com"}'
curl -sk -X POST "https://${LB_DOMAIN}/vampi/users/v1/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"apitest","password":"test123"}'

crAPI Integration (Port 8888)

crAPI runs on a dedicated port (8888) because it is a single-page application that hardcodes its API paths and cannot be served behind a path prefix. To integrate crAPI with F5 XC:

Setting	Value
Origin Server Type	Public IP of Origin Server
IP Address	<terraform output public_ip>
Port	8888
Health Check	HTTP, path /

Create a separate origin pool for crAPI on port 8888, or add a second origin pool member to your existing pool with port 8888 and use route rules to direct traffic:

# Test crAPI through F5 XC (if configured)
curl -sk "https://${LB_DOMAIN}:8888/"

# Or if using route rules on the same LB domain:
# Configure an F5 XC route rule matching Host header or path prefix
# to forward to the crAPI origin pool (port 8888)

Note

The NSG on the origin VM allows inbound traffic on port 8888. No additional Azure network changes are needed.

Sticky Session Awareness

The origin server uses nginx sticky sessions internally to route stateful applications to consistent backend containers. When configuring the F5 XC HTTP load balancer, be aware:

Application	Sticky Method	Why
Juice Shop	hash $cookie_token	Node.js session state
DVWA	hash $cookie_PHPSESSID	PHP session state
VAmPI	ip_hash	SQLite database per instance
CSD Demo	ip_hash	In-memory exfil log per instance
DVGA	ip_hash	SQLite database per instance
RESTaurant	Round-robin	Shared PostgreSQL backend
crAPI	— (single port 8888)	7 microservices, PostgreSQL + MongoDB
httpbin	Round-robin	Stateless
whoami	Round-robin	Stateless

F5 XC does not need to replicate these sticky sessions — nginx on the origin VM handles the backend routing. F5 XC should treat the origin as a single endpoint (the VM’s public IP on port 80).

Multi-Component Architecture

When combined with the CDN Simulator, the full lab architecture is:

End User -> CDN Simulator (nginx cache) -> F5 XC HTTP LB -> Origin Server (this component)

The CDN Simulator uses the F5 XC HTTP load balancer VIP as its origin, and the F5 XC load balancer uses this origin server as its backend. This creates a realistic multi-layer architecture for comprehensive testing.