Install the WAF compiler

The WAF compiler lets F5 NGINX Instance Manager precompile security configurations before deploying them to F5 WAF for NGINX instances.
Precompiling configurations improves performance and reduces the risk of runtime errors.

Install the WAF compiler on the NGINX Instance Manager host only if you plan to compile configurations on the management plane.
If you compile on the data plane, you can skip this step.

Each version of F5 WAF for NGINX has a corresponding WAF compiler version.
If you manage multiple versions, install the matching compiler for each one on the NGINX Instance Manager host.

The WAF compiler installs to the /opt directory.
Make sure this directory has the correct permissions so the owner can write to it. A typical permission setting of 0755 is sufficient.

To organize instances running the same version, you can create instance groups.

For an overview of how the compiler works, see Security bundle compilation.

Before you begin

Make sure you’ve completed the following tasks:

• You have one or more F5 WAF for NGINX instances running.
  For supported versions, see Support for F5 WAF for NGINX.

  If you plan to use configuration management and Security Monitoring, follow the steps in the setup guide before continuing.

• NGINX Instance Manager is installed, licensed, and running.

  The latest version of NGINX Instance Manager is recommended to ensure full compatibility and access to the newest features.

  If you have a subscription for F5 WAF for NGINX, you can find your license in the subscription details section of MyF5.

WAF compiler version support

Use the table below to find the correct WAF compiler version for each release of F5 WAF for NGINX:

Beginning with version 5.9.0, both the virtual machine and container installation packages are categorized under the 5.x.x tag.
Earlier releases used 4.x.x for VM packages (for example, NAP 4.15.0, NAP 4.16.0) and 5.x.x for container packages (for example, NAP 5.7.0, NAP 5.8.0).

Install the WAF compiler

sudo systemctl restart nms-integrations

sudo systemctl restart nms-integrations

sudo systemctl restart nms-integrations

sudo systemctl restart nms-integrations

sudo systemctl restart nms-integrations

Known Issue for auto-downloaded nms-nap-compiler-v5.690.0

If you see following error messages in UI:

Copy

<instance_name>: failed building config payload: policy compilation failed for deployment <deployment_id> due to integrations service error: compiler controller error: exit status 1

AND

If you see any of the following error message in nms log

debian/ubuntu based system:

Copy

/usr/bin/perl: symbol lookup error: /opt/nms-nap-compiler/app_protect-5.690.0/bin/../lib/perl/auto/F5/PatternMatching/PatternMatching.so: undefined symbol: _ZN3re23RE2C1ESt17basic_string_viewIcSt11char_traitsIcEERKNS0_7OptionsE

OR

RHEL based system:

Copy

Can't load '/opt/nms-nap-compiler/app_protect-5.690.0/bin/../lib/perl/auto/F5/PatternMatching/PatternMatching.so' for module F5::PatternMatching: libre2.so.11: cannot open shared object file: No such file or directory at /usr/lib64/perl5/DynaLoader.pm

Workaround: Execute below command

Copy

sudo bash -c '
cd /opt/nms-nap-compiler/app_protect-5.690.0/lib && \
ln -sfn libre2.so.11.0.0 libre2.so.11 && \
ln -sfn libprotobuf.so.3.21.12.0 libprotobuf.so.32 && \
ln -sfn libprotobuf.so.32 libprotobuf.so
'