BIG-IP Access Policy Manager: Implementing Zero Trust with Per-Request Policies

Case Management

MY PRODUCTS & PLANS

Subscriptions

Product Usage

Trials

Registration Keys

Resources
Downloads
Licensing
Activate F5 product registration key
Ihealth
Verify the proper operation of your BIG-IP system

F5 University
Get up to speed with free self-paced courses
Devcentral
Join the community of 300,000+ technical peers

F5 Certification
Advance your career with F5 Certification
Product Manuals
Product Manuals and Release notes

Manual : BIG-IP Access Policy Manager: Implementing Zero Trust with Per-Request Policies

Applies To:

Show Versions

Show Versions

BIG-IP APM

17.1.0, 17.0.0, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 15.1.10, 15.1.9

Original Publication Date: 07/07/2021
Updated Date: 08/30/2023

Per-Request Policy Concepts

About zero trust

About per-request policies

About per-request policy subroutines

About subsessions

About gating criteria in subroutines

Implementing Device Posture Checks

What are device posture checks?

Checking for client information in a per-request policy

Configuring subroutine settings

Implementing endpoint state checks

Checking for antivirus in a subroutine

Checking for a firewall in a subroutine

Checking for hard disk encryption in a subroutine

Checking patch management in a subroutine

Checking file sharing software in a subroutine

Checking for system health software in a subroutine

Step-Up Authentication with APM

What is step-up authentication?

Use cases for step-up authentication

Concepts to know for building step-up authentication policies

Authentication types APM supports for step-up authentication

Example: Step-up authentication at the application layer

Example: Step-up authentication for an IP address change

Session variables for more granular access control in step-up authentication

Step-up authentication configuration basics

Overview: Configuring step-up authentication

Using Step-Up Authentication with SAML

Overview: Using step-up authentication with SAML

About the SAML step-up authentication example

Creating a per-session policy for the SAML step-up authentication example

creating-a-per-request-policy_for-saml-step-up-auth

How SAML step-up authentication works

Example: Configuring an SP policy with different IdPs

Seamless SSO: Azure with SAML and MFA

Overview of Azure with SAML for Seamless SSO and MFA

Creating an external IdP connector for standard authentication with Azure AD

Creating an external IdP connector for MFA with Azure AD

Creating a local Service Provider for primary authentication with Azure AD

Creating a local Service Provider for MFA with Azure AD

Creating an allow-all per-session policy

Creating the per-request policy for Azure AD with SAML and MFA

Adding a URL branching rule

Adding subroutines for SAML Auth with and without MFA

Creating a virtual server for SAML Auth with Azure and MFA

Okta MFA using Factors API

Overview: Okta MFA using Factors API

Configuring the Okta site for Okta Factors API

Defining an HTTP Connector Transport for Okta MFA

Creating an Okta Connector

Creating an access profile for Okta

Adding primary authentication to a per-session policy

Creating a per-request policy for Okta API

Adding Okta MFA to a per-request policy

Creating a virtual server for Okta API

Enrolling Factors and Signing in with Okta MFA

Okta MFA subsession variables

Okta API or connectivity errors

Seamless OAuth with Okta and RADIUS MFA

Overview of Okta with OAuth, step-up authentication, and RADIUS MFA

Creating an Okta configuration for seamless access

Assigning the Okta application to users

Configuring an Okta OAuth provider with discovery

Configuring an OAuth server for APM as client and resource server

Creating an allow-all per-session policy

Creating the per-request policy for Okta with OAuth and RADIUS MFA

Adding a URL branching rule

Creating an OAuth authentication subroutine

Adding a Variable Assign agent to collect the username in an OAuth MFA subroutine

Completing the per-request policy for Okta OAuth with RADIUS MFA

Using HTTP Connector to Access External Servers

About the HTTP Connector

Defining an HTTP Connector Transport

Creating an HTTP Connector Request for an external IP blocklist

Configuring a per-request policy for an HTTP Connector

Adding an HTTP Connector to a subroutine to check an external blocklist

Adding the HTTP Connector subroutine to the per-request policy

Creating an allow-all per-session policy

Creating a virtual server for the HTTP Connector policy

LTM SSL Forward Proxy and Per-Request Policies

Overview: Adding a per-request policy to LTM SSL forward proxy

Example policy: SSL forward proxy bypass

Overview: SSL forward proxy client and server authentication

Task summary for SSL Forward Proxy on a single BIG-IP system

Implementation result

Protecting Internal Resources Per-Request

Overview: Protecting internal resources on a per-request basis

Example policy: URL filter per user group

Example policy: Access control by date, time, and user group

Example policy: User-defined category-specific access control

Example policy: Application lookup and filter

Forward Proxy Chaining Per Request

BIG-IP system forward proxy chaining and APM benefits

Interoperability characteristics for forward proxy chaining

Configuration essentials for forward proxy chaining

Overview: Simple forward proxy chaining example

Confirming Requests in Secure Web Gateway

Overview: Confirming requests in per-request policies

Confirming requests example

Additional SWG per-request examples