f5devcentral / f5-agility-labs-xc

F5XC Appworld Labs

F5 Agility Lab Template

Introduction

This repo contains a template that should be used when creating lab documentation for F5's Agility Labs.

Setup

1. Download or git clone the f5-agility-lab-template
2. Download and install Docker CE (https://docs.docker.com/engine/installation/)
3. Build the sample docs ./containthedocs-build.sh. The first time you build a container (~1G in size) will be downloaded from Docker Hub.
4. Open the docs/_build/html/index.html file on you system in a web browser

Configuration & Use

To use this template:

1. Copy contents of this repo to a new directory cp -Rf . /path/to/your/docs
2. cd /path/to/your/docs
3. Edit docs/conf.py
4. Modify the following lines:
   • classname = "Your Class Name"
   • github_repo = "https://github.com/f5devcentral/your-class-repo"
5. Build docs ./containthedocs-build.sh (see Build Scripts below)
6. Open the docs/_build/html/index.html file on you system in a web browser
7. Edit the *.rst files as needed for your class
8. Rebuild docs as needed using ./containthedocs-build.sh

Converting from Microsoft Word

To convert a .docx file from Microsoft Work to reStructuredText:

1. Copy your .docx file into the f5-agility-lab-template directory
2. Run ./containthedocs-convert.sh <filename.docx>
3. Your converted file will be named filename.rst
4. Images in your document will be extracted and placed in the media directory

Warning

While the document has been converted to rST format you will still need to refactor the rST to use the structure implemented in this template.

Build Scripts

The repo includes build scripts for common operations:

• containthedocs-bash.sh: Run to container with a BASH prompt
• containthedocs-build.sh: Build HTML docs using make -C docs html to docs/_build/html
• containthedocs-clean.sh: Clean the build directory using make -C docs clean
• containthedocs-cleanbuild.sh: Clean the build directory and build HTML docs using make -C docs clean html
• containthedocs-convert.sh: Convert a Word .docx file to rST

f5-agility-labs-xc's Issues

Class 1 Lab 4 Introduction to F5 Distributed Cloud DNS - permissions issue prevent Zone creation - Task 2

Can't complete Task 2 or the rest of the lab.

"Update Password" email misidentifies XC domain as "account name"

When I start the lab on UDF, I get a message from F5 Distributed Cloud telling me to 'Update Your Account' (See attached screenshots)

The message misidentifies the XC domain as the "account name" - I may be slow, but this caused confusion and delay.

The XC login page wants the user to specify the domain 'f5-xc-lab-sec' and to use the F5 email address as the account name. The best thing would be to correct the label used by the email message. Next best would be to update the lab guide to identify this error.

Class 2 Lab 3 - Malicious Users NEEDS TEST to demontrate feature.

There is no malicious user testing in the lab to show the feature works.

Just walking through the config is not enough.

HTTP Load Balancer - "Advanced Configuration" is now "Other Settings"

In Lab 3 https://github.com/f5devcentral/f5-agility-labs-xc/blob/dev/docs/class1/lab3.rst

https://github.com/f5devcentral/f5-agility-labs-xc/blob/dev/docs/class1/lab3.rst#exercise-3-configure-local-vip
Task 3 Exercise 3: Configure Local VIP; the instructions say to go under "Advanced Configuration". This now appears to be called "Other Settings".

"Where to Advertise the VIP" is now called "VIP Advertisement"
The "Advertise Custom" option is now called "Custom"
Step 3, Next to "Custom Advertise VIP Configuration" click on "Show Advanced Fields" does not appear to be necessary as there is no "Show Advanced Fields" button to click.

https://github.com/f5devcentral/f5-agility-labs-xc/blob/dev/docs/class1/lab3.rst#exercise-4-configure-waf-policy
Exercise 4: Configure WAF Policy
The Security Configuration section in the console is before the "Other Settings" section, so maybe the WAF section shoul dcome first in the guide?

F5 Distributed Cloud - WAF/WAAP Deeper Dive: some attacks don't work as expected

Lab 1 Task 3 Step 2 has the user launch 4 attacks.

/?cmd=cat%20/etc/passwd
/product?id=4%20OR%201=1
/../../../../etc/shadow
/cart?search=aaa’><script>prompt(‘Please+enter+your+password’);</script>

The request hangs.

The second sees a connection reset.

Class 2 Lab 3: Exploring Rate Limiting & Routes

We don't do anything with routes in this lab. I suggest changing titles and removing the vestigial routes section at the end.

class 2 - Lab 1 Deploying and Managing F5 Distributed Cloud Web Application Firewall Configuration - only 1 of 3 attacks blocked as expected

After configuring the WAF, I made the 3 requests to test. The first timed out, the second had a connection reset, and only the third showed the expected rejection page with id.

I do not have the permissions to investigate the properties of shared/base-appfw to troubleshoot.

See attached gif.

class 2 lab 2 Reviewing Signature-based Bot Strategies - asks us to edit object we haven't created

Task 1: Reviewing Signature-based Bot protection
2. on your App Firewall policy THAT DOESN'T EXIST <namespace>-appfw, click the three dots...

I just used the shared/base-appfw. I couldn't edit it, couldn't clone it.

I created a new object <namespace>-appfw with the signature-based bot protection and left all the defaults except for enabling enforcement. Signature-based bot protection was configured as specified in the lab guide.