Configure the Bot Defense infrastructure

Important: Bot Defense self-service policy management is an early access feature.

Use the F5 Distributed Cloud Console to add and configure your Bot Defense infrastructures in the F5 Hosted Cloud. Bot Defense infrastructures are virtual machines that host components that process and evaluate your traffic to determine what traffic is human and what is automation.

A typical Bot Defense deployment consists of multiple Test and Production infrastructures. You can add as many Production and Test infrastructures as your subscription limit allows.

Before you begin:

• You must purchase Bot Defense.
• You must have an active F5 Distributed Cloud account. If you don't have an account, see Get Started with Distributed Cloud Console.
• You must have either the f5xc-bot-defense-admin or ves-io-admin-role role.
• Know the geographic region where you want the infrastructure located, and the IP addresses from which you want to allow traffic to access the new infrastructure.
• Make sure you enable Bot Defense in the correct namespace. You can enable Bot Defense on any Distributed Cloud namespace, but once deployed, you can't move Bot Defense to a new namespace. To enable Bot Defense on an HTTP load balancer in Distributed Cloud, deploy Bot Defense in the same namespace as the load balancer.

To add a new Bot Defense infrastructure:

1. In the Distributed Cloud Console, select Bot and Risk Management.

2. From the Bot and Risk Management navigation menu, select Manage > Bot Infrastructure.

3. Select Add Bot Infrastructure.

4. Enter a unique Name for the new infrastructure.

5. From the Traffic Type drop-down menu, select the type of traffic you want to route to and process with this infrastructure:

   • Web: When selected, only web traffic, including browser-based traffic from mobile devices, is routed through this Bot Defense infrastructure.
   • Mobile: When selected, only mobile traffic from native mobile apps with the Bot Defense SDK are routed through this Bot Defense infrastructure.

6. From the Infra Type drop-down menu, make sure the F5 Cloud Hosted option is selected.

7. From the Environment Type drop-down menu, select one of the following options:

   Important: F5 recommends that you select regions that are geographically close to your traffic and that you select a different region for each infrastructure.

   • Production: Select this to add an infrastructure to protect your live production applications and services from automated attacks.

     From the Redundancy Mode drop-down menu, select one of the following options:

     • Active-Active: Two active infrastructure regions in which traffic is routed equally between the two regions. Use the Active drop-down menus to select the regions where you want to locate your infrastructures.
     • Active-Passive: One active infrastructure that fails over to the passive infrastructure when health checks fail. Use the Active and Passive drop-down menus to select where you want to locate your active and passive infrastructures.
     • Single Active: All traffic is routed to a single infrastructure. Use the Active drop-down menu to select where you want to locate your infrastructure.

   • Test: Select to add an infrastructure to evaluate new features, settings, and system performance.

     A Test infrastructure has a Single Active infrastructure region that processes all traffic. Use the Active drop-down menu to select where you want to locate your infrastructure.

8. If necessary, add entries to the Access Control List:

   • To add allowed host names, in the Access Control List - Host Names section, select Add, and enter a host name. To add additional host names, select Add again.
   • To add allowed IP addresses, in the Access Control List - IP Addresses section, select Add, and enter an IP address in CIDR notation. To add additional IP addresses, select Add again.

   Only traffic from these IP addresses or hostnames is allowed to access your Bot Defense infrastructure.

9. When you finish, select Add Bot Infrastructure.

It takes a few minutes for Bot Defense to create the infrastructure and default policies. Select Refresh on the Bot Infrastructure page to see the latest list of infrastructures.

Next steps:

After you configure your Bot Defense infrastructure, you must review and configure Bot Defense policies. Default versions of Endpoint, Allowlist and Network policies are automatically created when you add the Bot Defense infrastructure.

For information about configuring Bot Defense policies, see Get started with Bot Defense - Configure your bot policies.