Skip to content

Commit 90f0096

Browse files
mjangmjang
authored
Merge branch 'main' into revamp-spec-summary-table
2 parents d891cc6 + 3243d21 commit 90f0096

File tree

31 files changed

+6565
-2344
lines changed

31 files changed

+6565
-2344
lines changed

‎content/includes/waf/table-policy-features.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,17 @@
1313
| [Deny and Allow IP lists]({{< ref "/waf/policies/deny-allow-ip.md" >}}) | Manually define denied & allowed IP addresses as well as IP addresses to never log. |
1414
| [Disallowed file type extensions]({{< ref "/waf/policies/disallowed-extensions.md" >}}) | Support any file type, and includes a predefined list of file types by default |
1515
| [Evasion techniques]({{< ref "/waf/policies/evasion-techniques.md" >}}) | All evasion techniques are enabled by default, and can be disabled individually. These include directory traversal, bad escaped characters and more. |
16-
| [Geolocation]({{< ref "/waf/policies/geolocation.md" >}}) | |
17-
| [GraphQL protection]({{< ref "/waf/policies/graphql-protection.md" >}}) | |
16+
| [Geolocation]({{< ref "/waf/policies/geolocation.md" >}}) | The geolocation feature allows you to configure enforcement based on the location of an object using the two-letter ISO code representing a country. |
17+
| [GraphQL protection]({{< ref "/waf/policies/graphql-protection.md" >}}) | GraphQL protection allows you to configure enforcement for GraphQL, an API query language. |
1818
| [gRPC protection]({{< ref "/waf/policies/evasion-techniques.md" >}}) | gRPC protection detects malformed content, parses well-formed content, and extracts the text fields for detecting attack signatures and disallowed meta-characters. In addition, it enforces size restrictions and prohibition of unknown fields. The Interface Definition Language (IDL) files for the gRPC API must be attached to the profile. gRPC protection is available for unary or bidirectional traffic. |
1919
| [HTTP compliance]({{< ref "/waf/policies/http-compliance.md" >}}) | All HTTP protocol compliance checks are enabled by default except for GET with body and POST without body. It is possible to enable any of these two. Some of the checks enabled by default can be disabled, but others, such as bad HTTP version and null in request are performed by the NGINX parser and NGINX App Protect WAF only reports them. These checks cannot be disabled. |
2020
| [IP address lists]({{< ref "/waf/policies/ip-address-lists.md" >}}) | Organize lists of allowed and forbidden IP addresses across several lists with common attributes. |
2121
| [IP intelligence]({{< ref "/waf/policies/ip-intelligence.md" >}}) | Configure the IP Intelligence feature to customize enforcement based on the source IP of the request, limiting access from IP addresses with questionable reputation. |
22-
| [JWT protection]({{< ref "/waf/policies/jwt-protection.md" >}}) | |
22+
| [JWT protection]({{< ref "/waf/policies/jwt-protection.md" >}}) | JWT protection allows you to configure policies based on properties of JSON web tokens, such as their header and signature properties. |
2323
| [Server technology signatures]({{< ref "/waf/policies/server-technology-signatures.md" >}}) | Support adding signatures per added server technology. |
2424
| [Time-based signature staging]({{< ref "/waf/policies/time-based-signature-staging.md" >}}) | Time-based signature staging allows you to stage signatures for a specific period of time. During the staging period, violations of staged signatures are logged but not enforced. After the staging period ends, violations of staged signatures are enforced according to the policy's enforcement mode. |
2525
| [Threat campaigns]({{< ref "/waf/policies/threat-campaigns.md" >}}) | These are patterns that detect all the known attack campaigns. They are very accurate and have almost no false positives, but are very specific and do not detect malicious traffic that is not part of those campaigns. The default policy enables threat campaigns but it is possible to disable it through the respective violation. |
2626
| [User-defined HTTP headers]({{< ref "/waf/policies/user-headers.md" >}}) | Handling headers as a special part of requests |
2727
| [XFF trusted headers]({{< ref "/waf/policies/xff-headers.md" >}}) | Disabled by default, and can accept an optional list of custom XFF headers. |
28-
| [XML and JSON content]({{< ref "/waf/policies/xml-json-content.md" >}}) | XML content and JSON content detect malformed content and detects signatures in the element values. Default policy checks maximum structure depth. It is possible to enable more size restrictions: maximum total length of XML/JSON data, maximum number of elements are more. |
29-
{{< /table >}}
28+
| [XML and JSON content]({{< ref "/waf/policies/xml-json-content.md" >}}) | XML content and JSON content profiles detect malformed content and signatures in the element values. Default policy checks maximum structure depth. It is possible to enable more size restrictions: maximum total length of XML/JSON data, maximum number of elements and more. |
29+
{{< /table >}}

‎content/nginx-one/agent/configure-instances/configure-agent-features.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
title: Review and configure features
3+
weight: 350
4+
toc: true
5+
nd-docs: DOCS-000
6+
nd-content-type: how-to
7+
---
8+
9+
## Overview
10+
11+
This guide describes the F5 NGINX Agent features, and how to enable and disable them using the NGINX Agent configuration file, CLI flags, environment variables, and gRPC updates.
12+
13+
## Before you begin
14+
15+
Before you start, make sure that you have:
16+
17+
- [NGINX Agent installed]({{< ref "/nginx-one/agent/install-upgrade/" >}}) in your system.
18+
- Access to the NGINX Agent configuration file, CLI, or container environment.
19+
20+
## Features
21+
22+
The following table lists the NGINX Agent features:
23+
24+
{{< table "features" >}}
25+
| Feature Name | Description | Default |
26+
| ------------------- | --------------------------------------------------------------------------- | ------- |
27+
| configuration | Full read/write management of configurations, controlled by DataPlaneConfig ConfigMode. | On |
28+
| certificates | Inclusion of public keys and other certificates in the configurations toggled by DataPlaneConfig CertMode | Off |
29+
| file-watcher | Monitoring of file changes in the allowed directories list and references from product configs. | On |
30+
| metrics | Full metrics reporting. | On |
31+
| > metrics-host | Host-level metrics (cpu, disk, load, fs, memory, network, paging). | On |
32+
| > metrics-container | Container-level metrics from cgroup information. | On |
33+
| > metrics-instance | OSS and Plus metrics depending on NGINX instance. | On |
34+
| logs | Collection and reporting of NGINX error logs. | Off |
35+
| > logs-nap | F5 WAF for NGINX logs. | Off |
36+
{{< /table >}}
37+
38+
## Configuration sources
39+
40+
You can enable or disable features using several configuration sources:
41+
42+
### CLI parameters
43+
44+
Enable features at launch:
45+
46+
```shell
47+
./nginx-agent --features=configuration,metrics,file-watcher
48+
```
49+
50+
### Environment variables
51+
52+
Use environment variables for containerized deployments:
53+
54+
```shell
55+
export NGINX_AGENT_FEATURES="configuration,metrics,file-watcher"
56+
```
57+
58+
### Configuration file
59+
60+
Define features in the `nginx-agent.conf` file:
61+
62+
```yaml
63+
features:
64+
- configuration
65+
- metrics
66+
- file-watcher
67+
```
68+
69+
## Use cases
70+
71+
### Enable metrics only
72+
73+
1. Access the NGINX instance: Connect using SSH to the VM or server where NGINX Agent is running.
74+
75+
`ssh user@your-nginx-instance`
76+
77+
1. Open the NGINX Agent configuration file in a text editor.
78+
79+
`sudo vim /etc/nginx-agent/nginx-agent.conf`
80+
81+
1. Add the features section: Add the following to the end of the configuration file if it doesn't already exist.
82+
83+
```yaml
84+
features:
85+
- metrics
86+
- metrics-host
87+
- metrics-container
88+
- metrics-instance
89+
```
90+
91+
1. Restart the NGINX Agent service to apply the changes.
92+
93+
`sudo systemctl restart nginx-agent`
94+
95+
Once the steps have been completed, users will be able to view metrics data being sent but will not have the capability to push NGINX configuration changes.
96+

‎content/nginx-one/changelog.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ h2 {
3030

3131
Stay up-to-date with what's new and improved in the F5 NGINX One Console.
3232

33+
## October 2, 2025
34+
35+
### You can now set up config templates
36+
37+
- Start with how you can [Author templates]({{< ref "/nginx-one/nginx-configs/config-templates/author-templates.md" >}})
38+
- Automate with our **experimental** endpoints for [NGINX One Console templates]({{< ref "/nginx-one/api/api-reference-guide/#tag/Templates" >}})
39+
3340
## September 16, 2025
3441

3542
### IPv6 endpoints for NGINX Agent and NGINX Plus usage reporting

‎content/nginx-one/nginx-configs/config-templates/_index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
description:
3+
title: Manage config templates
4+
weight: 400
5+
url: /nginx-one/nginx-configs/config-templates
6+
---

0 commit comments

Comments
 (0)