# Connect NGINX Gateway Fabric to NGINX Instance Manager

Type of document: How-to guide
Product: NGINX Instance Manager
> Connect NGINX Gateway Fabric to F5 NGINX Instance Manager to export F5 WAF security events to the Security Dashboard.

---


## Overview

Connect NGINX Gateway Fabric to NGINX Instance Manager to export F5 WAF security events to the Security Dashboard.

This connection supports security event export only. F5 WAF policy fetching uses a separate credential flow. See [Configure policy sources](/ngf/waf-integration/policy-sources.md).

---

## Before you begin

Before you begin, verify that you have:

- Administrator access to a Kubernetes cluster
- Helm and kubectl installed locally
- An NGINX Plus subscription

---

## Download your NGINX Plus JWT

1. Log in to [MyF5](https://my.f5.com/manage/s/).
2. Go to **My Products & Plans** > **Subscriptions** to see your active subscriptions.
3. Find your NGINX products or services subscription and select the **Subscription ID** for details.
4. Download the **JSON Web Token (JWT)** from the subscription page.

**Note:**  The Connectivity Stack for Kubernetes JWT does not work with NGINX Plus reporting. Use a regular NGINX Plus instance JWT.

---

## Create the NGINX Plus Secret

Place the JWT in a file called `license.jwt`. Create a Kubernetes Secret using the contents of the JWT file.

```shell
kubectl create secret generic nplus-license --from-file license.jwt -n nginx-gateway
```

You can now delete the `license.jwt` file.

If you need to update the JWT at any time, update the `license.jwt` field in the Secret using `kubectl edit` and apply the changes.

This Secret is required to run NGINX Plus, with or without F5 WAF for NGINX. It also authenticates the connection from NGINX Gateway Fabric to NGINX Instance Manager.

---

## Install Gateway API resources

**Note:**  The [Gateway API resources](https://github.com/kubernetes-sigs/gateway-api) from the standard channel must be installed before deploying NGINX Gateway Fabric. If they are already installed in your cluster, please ensure they are the correct version as supported by the NGINX Gateway Fabric - [see the Technical Specifications](https://github.com/nginx/nginx-gateway-fabric/blob/v/README.md#technical-specifications). 

To install the Gateway API resources, run the following:

```shell
kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/standard?ref=v" | kubectl apply -f -
```

**Note:**  If you plan to use the `edge` version of NGINX Gateway Fabric, you can replace the version in `ref` with `main`, for example `ref=main`. 

Alternatively, you can install the Gateway API resources from the experimental channel.
Installing Gateway API resources from the experimental channel includes everything in the standard release channel plus additional experimental resources and fields.
NGINX Gateway Fabric currently supports a subset of the additional features provided by the experimental channel.
To install from the experimental channel, run the following:

```shell
kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/experimental?ref=v" | kubectl apply -f -
```

**Note:**  To learn more about what Gateway API resources NGINX Gateway Fabric currently supports, visit our [Gateway API Compatibility](/ngf/overview/gateway-api-compatibility.md) document.

---

## Install NGINX Gateway Fabric

This integration requires NGINX Plus with F5 WAF for NGINX. Install NGINX Gateway Fabric using the following Helm command:

```shell
helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
  --set nginx.image.repository=private-registry.nginx.com/nginx-gateway-fabric/nginx-plus \
  --set nginx.plus=true \
  --set nginx.config.waf.enable=true \
  --set nginx.imagePullSecret=nginx-plus-registry-secret \
  --set nginx.usage.secretName=nplus-license \
  --set nginx.nginxInstanceManager.endpointHost=<NIM_HOSTNAME> \
  -n nginx-gateway
```

Replace `<NIM_HOSTNAME>` with your NGINX Instance Manager hostname.

---

## See also

- [Deploy a Gateway for data plane instances](/ngf/install/deploy-data-plane.md)
- [Configure policy sources](/ngf/waf-integration/policy-sources.md)
- [View NGINX Gateway Fabric security events](/nim/security-monitoring/ngf-security-events.md)