# Install the WAF compiler

Type of document: How-to guide
Product: NGINX Instance Manager
> Install the WAF compiler on the F5 NGINX Instance Manager host to precompile security configurations for F5 WAF for NGINX.

---


Use the WAF compiler to precompile security configurations in F5 NGINX Instance Manager before you deploy them to F5 WAF for NGINX instances.  
Precompiling configurations improves performance and reduces the risk of runtime errors.

Install the WAF compiler on the NGINX Instance Manager host only if you plan to compile configurations on the management plane.  
If you compile on the data plane, you can skip this step.

Each version of F5 WAF for NGINX has a corresponding WAF compiler version.  
If you manage multiple versions, install the matching compiler for each one on the NGINX Instance Manager host.

The WAF compiler installs to the `/opt` directory.  
Make sure this directory has the correct permissions so the owner can write to it. A typical permission setting of `0755` is sufficient.

To organize instances running the same version, you can create [instance groups](/nim/nginx-instances/manage-instance-groups).

For an overview of how the compiler works, see [Security bundle compilation](/nim/waf-integration/overview#security-bundle).

## Before you begin

Make sure you’ve completed the following tasks:

- You have one or more [F5 WAF for NGINX](/waf/) instances running.  
  For supported versions, see [Support for F5 WAF for NGINX](/nim/fundamentals/tech-specs.md#f5-waf).

  **Note:** 
  If you plan to use configuration management and Security Monitoring, follow the steps in the [setup guide](/nim/security-monitoring/set-up-app-protect-instances.md) before continuing.
  

- NGINX Instance Manager is [installed](/nim/deploy/vm-bare-metal/_index.md), licensed, and running.  
  
  The latest version of NGINX Instance Manager is recommended to ensure full compatibility and access to the newest features.

  If you have a subscription for F5 WAF for NGINX, you can find your license in the subscription details section of [MyF5](https://my.f5.com).

## WAF compiler version support

Use the following table to find the correct WAF compiler version for each release of F5 WAF for NGINX:

| F5 WAF for NGINX version  | WAF compiler version       |
|---------------------------|----------------------------|
| 5.15.0                    | nms-nap-compiler-v5.715.0  |
| 5.14.1                    | nms-nap-compiler-v5.690.1  |
| 5.14.0                    | nms-nap-compiler-v5.690.0  |
| 5.13.4                    | nms-nap-compiler-v5.635.4  |
| 5.13.3                    | nms-nap-compiler-v5.635.3  |
| 5.13.2                    | nms-nap-compiler-v5.635.2  |
| 5.13.1                    | nms-nap-compiler-v5.635.1  |
| 5.13.0                    | nms-nap-compiler-v5.635.0  |
| 5.12.1                    | nms-nap-compiler-v5.607.1  |
| 5.12.0                    | nms-nap-compiler-v5.607.0  |
| 5.11.2                    | nms-nap-compiler-v5.575.2  |
| 5.11.1                    | nms-nap-compiler-v5.575.1  |
| 5.11.0                    | nms-nap-compiler-v5.575.0  |
| 5.10.0                    | nms-nap-compiler-v5.550.0  |
| 5.9.0                     | nms-nap-compiler-v5.527.0  |
| 5.8.0                     | nms-nap-compiler-v5.498.0  |
| 5.7.0                     | nms-nap-compiler-v5.442.0  |
| 5.6.0                     | nms-nap-compiler-v5.342.0  |
| 5.5.0                     | nms-nap-compiler-v5.264.0  |
| 5.4.0                     | nms-nap-compiler-v5.210.0  |
| 5.3.0                     | nms-nap-compiler-v5.144.0  |
| 5.2.0                     | nms-nap-compiler-v5.48.0   |
| 5.1.0                     | nms-nap-compiler-v5.17.0   |
| 4.16.0                    | nms-nap-compiler-v5.498.0  |
| 4.15.0                    | nms-nap-compiler-v5.442.0  |
| 4.14.0                    | nms-nap-compiler-v5.342.0  |
| 4.13.0                    | nms-nap-compiler-v5.264.0  |
| 4.12.0                    | nms-nap-compiler-v5.210.0  |
| 4.11.0                    | nms-nap-compiler-v5.144.0  |
| 4.10.0                    | nms-nap-compiler-v5.48.0   |
| 4.9.0                     | nms-nap-compiler-v5.17.0   |
| 4.8.1                     | nms-nap-compiler-v4.815.0  |

**Note:** 
Beginning with version 5.9.0, both the virtual machine and container installation packages are categorized under the 5.x.x tag.  
Earlier releases used 4.x.x for VM packages (for example, NAP 4.15.0, NAP 4.16.0) and 5.x.x for container packages (for example, NAP 5.7.0, NAP 5.8.0).

## Install the WAF compiler

#### Debian/Ubuntu

1. Install the WAF compiler:

   ```shell
   sudo apt-get install nms-nap-compiler-v5.715.0
   ```

1. Append the `--force-overwrite` option after the first installation to install multiple compiler versions on the same system:

   ```shell
   sudo apt-get install nms-nap-compiler-v5.715.0 -o Dpkg::Options::="--force-overwrite"
   ```

1. Restart the `nms-integrations` service:

```shell
sudo systemctl restart nms-integrations
```

#### RHEL/Oracle/Rocky 8

1. Download the `dependencies.repo` file to `/etc/yum.repos.d`:

   ```shell
   sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo
   ```

1. Enable the CodeReady Builder repository:

   On RHEL 8, run:

   ```shell
   sudo dnf config-manager --set-enabled codeready-builder-for-rhel-8-rhui-rpms
   ```

   On Oracle Linux 8, run:

   ```shell
   sudo dnf config-manager --set-enabled ol8_codeready_builder
   ```

   On Rocky Linux 8, run:

   ```shell
   sudo dnf config-manager --set-enabled powertools
   ```

1. Install the WAF compiler:

   ```shell
   sudo dnf install nms-nap-compiler-v5.715.0
   ```

1. Restart the `nms-integrations` service:

```shell
sudo systemctl restart nms-integrations
```

#### RHEL/Rocky 9

1. Download the `dependencies.repo` file to `/etc/yum.repos.d`:

   ```shell
   sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo
   ```

1. Enable the CodeReady Builder repository:

   On RHEL 9, run:

   ```shell
   sudo dnf config-manager --set-enabled codeready-builder-for-rhel-9-rhui-rpms
   ```

   On Rocky Linux 9, run:

   ```shell
   sudo dnf config-manager --set-enabled crb
   ```

1. Install the WAF compiler:

   ```shell
   sudo dnf install nms-nap-compiler-v5.715.0
   ```

1. Restart the `nms-integrations` service:

```shell
sudo systemctl restart nms-integrations
```

#### RHEL/Rocky 10

1. Download the `dependencies.repo` file to `/etc/yum.repos.d`:

   ```shell
   sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo
   ```

1. Enable the CodeReady Builder repository:

   On RHEL 10, run:

   ```shell
   sudo dnf config-manager --set-enabled codeready-builder-for-rhel-10-rhui-rpms
   ```

   On Rocky Linux 10, run:

   ```shell
   sudo dnf config-manager --set-enabled crb
   ```

1. Install the WAF compiler:

   ```shell
   sudo dnf install nms-nap-compiler-v5.715.0
   ```

1. Restart the `nms-integrations` service:

```shell
sudo systemctl restart nms-integrations
```

**Note:** 
If the log contains the `Can't locate JSON/XS.pm` error message during policy compilation, install the `perl-JSON-XS` package manually.

   ```shell
   sudo yum install perl-JSON-XS
   ```

**Note:** 
If you see the following error message in the UI:
```text
<instance_name>: failed building config payload: policy compilation failed for deployment <deployment_id> due to integrations service error: compiler controller error: exit status 1
```

And the log contains one of the following error messages:

For Debian or Ubuntu-based systems:

```text
/usr/bin/perl: symbol lookup error: /opt/nms-nap-compiler/app_protect-5.690.0/bin/../lib/perl/auto/F5/PatternMatching/PatternMatching.so: undefined symbol: _ZN3re23RE2C1ESt17basic_string_viewIcSt11char_traitsIcEERKNS0_7OptionsE
```

For RHEL-based systems:

```text
Can't load '/opt/nms-nap-compiler/app_protect-5.690.0/bin/../lib/perl/auto/F5/PatternMatching/PatternMatching.so' for module F5::PatternMatching: libre2.so.11: cannot open shared object file: No such file or directory at /usr/lib64/perl5/DynaLoader.pm
```

**Workaround**: Run the following command:
   ```shell
   sudo bash -c '
   cd /opt/nms-nap-compiler/app_protect-5.690.0/lib && \
   ln -sfn libre2.so.11.0.0 libre2.so.11 && \
   ln -sfn libprotobuf.so.3.21.12.0 libprotobuf.so.32 && \
   ln -sfn libprotobuf.so.32 libprotobuf.so
   '
   ```