F5 Distributed Cloud

F5 Distributed Cloud 用例图，使用 f5-brand 图标包演示安全、网络和应用交付架构。

Web 应用与 API 保护

WAAP 安全检测流水线

多层 WAAP 检测流水线，在流量到达应用之前依次经过防火墙、应用代码保护和机器人防御。

flowchart LR
  user@{ icon: 'lucide:globe', label: 'Users' }
  fw@{ icon: 'f5-brand:security-firewall-shield', label: 'Firewall Shield' }
  appcode@{ icon: 'f5-brand:security-shield-app-code', label: 'App Code Protection' }
  botdef@{ icon: 'f5-brand:security-bot-defence', label: 'Bot Defence' }
  app@{ icon: 'carbon:application', label: 'Application' }

  user --> fw
  fw --> appcode
  appcode --> botdef
  botdef --> app

边缘安全架构

边缘安全架构，包含 WAF、盾牌验证以及跨云源站的应用保护组。

architecture-beta
  group edge(f5-brand:security-firewall-shield)[Security Edge]
  group origins(carbon:cloud-services)[Cloud Origins]

  service waf(f5-brand:security-firewall)[WAF] in edge
  service shield(f5-brand:security-shield-checkmark)[Shield Verify] in edge
  service appshield(f5-brand:security-shield-app-code)[App Shield] in edge
  service aws(hashicorp-flight:aws-color)[AWS Origin] in origins
  service azure(hashicorp-flight:azure-color)[Azure Origin] in origins

  waf:R --> L:shield
  shield:R --> L:appshield
  appshield:R --> L:aws
  appshield:B --> T:azure

带速率限制的 API 保护

API 请求验证流水线，在流量到达 API 端点之前依次经过防火墙、速率限制和 Schema 校验。

flowchart LR
  client@{ icon: 'lucide:globe', label: 'API Client' }
  fw@{ icon: 'f5-brand:security-firewall-shield', label: 'Firewall' }
  rate@{ icon: 'f5-brand:network-api-gateway', label: 'API Gateway' }
  schema@{ icon: 'f5-brand:security-shield-checkmark', label: 'Schema Validation' }
  api@{ icon: 'carbon:api', label: 'API Service' }
  db@{ icon: 'carbon:data-base', label: 'Database' }

  client --> fw
  fw --> rate
  rate --> schema
  schema --> api
  api --> db

机器人防御

机器人检测流水线

多阶段机器人检测，依次通过 JavaScript 挑战、设备指纹识别、行为分析和决策引擎。

flowchart LR
  req@{ icon: 'lucide:globe', label: 'Request' }
  js@{ icon: 'f5-brand:security-bot', label: 'JS Challenge' }
  fp@{ icon: 'f5-brand:security-fingerprint', label: 'Fingerprinting' }
  behavior@{ icon: 'f5-brand:security-pattern-matching', label: 'Behavior Analysis' }
  decision@{ icon: 'f5-brand:security-bot-defence', label: 'Decision Engine' }
  allow@{ icon: 'carbon:application', label: 'Application' }
  block@{ icon: 'f5-brand:security-firewall-bot', label: 'Block' }

  req --> js
  js --> fp
  fp --> behavior
  behavior --> decision
  decision -->|Human| allow
  decision -->|Bot| block

机器人防御层次

分层机器人防御架构，包含凭证情报、机器人检测和设备状态分析。

architecture-beta
  group defense(f5-brand:security-bot-defence)[Bot Defense Layers]
  group app(carbon:cloud-services)[Application]

  service botfw(f5-brand:security-firewall-bot)[Bot Firewall] in defense
  service botdef(f5-brand:security-bot-defence)[Bot Defence] in defense
  service intel(f5-brand:security-password-bot)[Credential Intel] in defense
  service login(carbon:application)[Login Service] in app
  service account(carbon:security)[Account Service] in app
  service db(carbon:data-base)[User Store] in app

  botfw:R --> L:botdef
  botdef:R --> L:intel
  intel:R --> L:login
  login:R --> L:account
  account:B --> T:db

客户端防御

客户端防御流水线，包含设备状态验证、笔记本机器人检测和 Magecart 防护。

flowchart TD
  user@{ icon: 'lucide:user', label: 'End Users' }
  attacker@{ icon: 'f5-brand:security-laptop-bot', label: 'Compromised Client' }
  posture@{ icon: 'f5-brand:device-laptop-lock-arrows', label: 'Device Posture' }
  botcheck@{ icon: 'f5-brand:security-bot-defence', label: 'Bot Check' }
  shield@{ icon: 'f5-brand:security-shield-checkmark', label: 'Verified Clean' }
  app@{ icon: 'carbon:application', label: 'Application' }

  user --> posture
  attacker --> posture
  posture --> botcheck
  botcheck --> shield
  shield --> app

多云网络

多云应用互联

跨 AWS、Azure 和 GCP 的多云应用连接，通过集中式应用交付网络实现互通。

architecture-beta
  group xc(f5-brand:cloud-multi)[F5 Multi-Cloud]
  group aws(hashicorp-flight:aws-color)[AWS]
  group azure(hashicorp-flight:azure-color)[Azure]
  group gcp(hashicorp-flight:gcp-color)[GCP]

  service fabric(f5-brand:app-delivery-fabric)[App Delivery Fabric] in xc
  service connect(f5-brand:cloud-multi-app-container)[App Connect] in xc
  service eks(hashicorp-flight:kubernetes-color)[EKS] in aws
  service rds(carbon:data-base)[RDS] in aws
  service aks(hashicorp-flight:azure-aks-color)[AKS] in azure
  service gke(hashicorp-flight:kubernetes-color)[GKE] in gcp

  fabric:R --> L:connect
  connect:B --> T:eks
  eks:R --> L:rds
  connect:B --> T:aks
  connect:B --> T:gke

带站点网格的网络连接

多云网络连接，采用站点网格拓扑和传输网关连接各云区域。

architecture-beta
  group net(f5-brand:cloud-network-connect)[Network Connect]
  group region1(hashicorp-flight:aws-color)[AWS Region]
  group region2(hashicorp-flight:azure-color)[Azure Region]

  service mesh(f5-brand:cloud-multi-network)[Site Mesh] in net
  service gw(f5-brand:network-gateway)[Transit Gateway] in net
  service web1(carbon:virtual-machine)[Web Tier] in region1
  service db1(carbon:data-base)[Database] in region1
  service web2(carbon:virtual-machine)[Web Tier] in region2
  service db2(carbon:data-base)[Database] in region2

  mesh:R --> L:gw
  gw:B --> T:web1
  web1:R --> L:db1
  gw:B --> T:web2
  web2:R --> L:db2

多云应用交付

端到端多云应用交付，包含全局负载均衡、安全防护和分布式工作负载。

flowchart TD
  user@{ icon: 'lucide:globe', label: 'Global Users' }
  glb@{ icon: 'f5-brand:network-globe-load-balance', label: 'Global LB' }
  shield@{ icon: 'f5-brand:security-firewall-shield', label: 'Security' }
  fabric@{ icon: 'f5-brand:app-delivery-fabric', label: 'App Fabric' }
  aws@{ icon: 'hashicorp-flight:aws-color', label: 'AWS Workloads' }
  azure@{ icon: 'hashicorp-flight:azure-color', label: 'Azure Workloads' }
  gcp@{ icon: 'hashicorp-flight:gcp-color', label: 'GCP Workloads' }

  user --> glb
  glb --> shield
  shield --> fabric
  fabric --> aws
  fabric --> azure
  fabric --> gcp

DDoS 与边缘服务

DDoS 清洗架构

DDoS 清洗中心，包含网络层保护、站点清洗和干净流量到源站的传输。

architecture-beta
  group scrub(f5-brand:network-ddos-protection)[Scrubbing Center]
  group origin(carbon:cloud-services)[Origin DC]

  service ddos(f5-brand:network-ddos-protection)[DDoS Protection] in scrub
  service sitescrub(f5-brand:security-site-scrubbing)[Site Scrubbing] in scrub
  service clean(f5-brand:network-globe-load-balance)[Clean Pipe] in scrub
  service lb(carbon:load-balancer-application)[Load Balancer] in origin
  service app(carbon:application)[Application] in origin
  service db(carbon:data-base)[Database] in origin

  ddos:R --> L:sitescrub
  sitescrub:R --> L:clean
  clean:R --> L:lb
  lb:R --> L:app
  app:B --> T:db

大流量攻击缓解

攻击流量路径，展示大流量 DDoS 在边缘被吸收和缓解，流量到达源站之前完成处理。

flowchart LR
  attacker@{ icon: 'lucide:bug', label: 'Attack Traffic' }
  legit@{ icon: 'lucide:user', label: 'Legitimate Users' }
  edge@{ icon: 'f5-brand:network-ddos-protection', label: 'DDoS Edge' }
  scrub@{ icon: 'f5-brand:security-site-scrubbing', label: 'Scrubbing' }
  drop@{ icon: 'f5-brand:security-firewall', label: 'Drop Malicious' }
  origin@{ icon: 'carbon:application', label: 'Origin' }

  attacker --> edge
  legit --> edge
  edge --> scrub
  scrub --> drop
  scrub --> origin

CDN + DDoS + WAF 分层保护

分层边缘保护，在统一流水线中结合 CDN 缓存、DDoS 缓解和 WAF 检测。

architecture-beta
  group edge(f5-brand:cloud-performance-arrow)[Edge Services]
  group security(f5-brand:security-firewall-shield)[Security Layer]
  group app(carbon:cloud-services)[Application]

  service cdn(f5-brand:cloud-performance-arrow)[CDN] in edge
  service ddos(f5-brand:network-ddos-protection)[DDoS Protection] in edge
  service waf(f5-brand:security-firewall-shield)[WAF] in security
  service shield(f5-brand:security-shield-checkmark)[Shield] in security
  service web(carbon:application)[Web App] in app
  service api(carbon:api)[API Service] in app

  cdn:R --> L:ddos
  ddos:R --> L:waf
  waf:R --> L:shield
  shield:R --> L:web
  shield:B --> T:api

DNS 与流量管理

基于 DNS 的 GSLB 与健康监测

基于 DNS 的全局服务器负载均衡，对多云端点进行健康监测。

flowchart TD
  user@{ icon: 'lucide:globe', label: 'End Users' }
  dns@{ icon: 'f5-brand:network-dns-1', label: 'DNS Management' }
  health@{ icon: 'f5-brand:other-site-metrics', label: 'Health Monitor' }
  aws@{ icon: 'hashicorp-flight:aws-color', label: 'AWS Origin' }
  azure@{ icon: 'hashicorp-flight:azure-color', label: 'Azure Origin' }
  gcp@{ icon: 'hashicorp-flight:gcp-color', label: 'GCP Origin' }

  user --> dns
  dns --> health
  health --> aws
  health --> azure
  health --> gcp
  dns --> aws
  dns --> azure
  dns --> gcp

DNS 管理架构

DNS 管理基础设施，包含 DNS 负载均衡和跨云区域的盾牌 DNS 保护。

architecture-beta
  group dnsinfra(f5-brand:network-dns-1)[DNS Infrastructure]
  group region1(hashicorp-flight:aws-color)[US East]
  group region2(hashicorp-flight:azure-color)[EU West]

  service dns(f5-brand:network-dns-load-balance)[DNS Load Balance] in dnsinfra
  service shielddns(f5-brand:security-shield-dns)[Shield DNS] in dnsinfra
  service lb1(carbon:load-balancer-application)[Regional LB] in region1
  service app1(carbon:virtual-machine)[App Servers] in region1
  service lb2(carbon:load-balancer-application)[Regional LB] in region2
  service app2(carbon:virtual-machine)[App Servers] in region2

  dns:R --> L:shielddns
  dns:B --> T:lb1
  lb1:R --> L:app1
  dns:B --> T:lb2
  lb2:R --> L:app2

带故障转移的智能 DNS 负载均衡

智能 DNS 负载均衡，集成云 DNS、性能路由和自动故障转移。

flowchart LR
  client@{ icon: 'lucide:globe', label: 'Client' }
  dns@{ icon: 'f5-brand:network-dns-load-balance', label: 'DNS Load Balance' }
  cloud@{ icon: 'f5-brand:cloud-dns-load-balance', label: 'Cloud DNS LB' }
  primary@{ icon: 'carbon:virtual-machine', label: 'Primary' }
  secondary@{ icon: 'carbon:virtual-machine', label: 'Secondary' }
  health@{ icon: 'f5-brand:other-site-metrics', label: 'Health Check' }

  client --> dns
  dns --> cloud
  cloud --> primary
  cloud -->|Failover| secondary
  dns --> health
  health --> primary
  health --> secondary

API 安全与发现

影子 API 发现流水线

影子 API 发现流水线，通过流量分析和库存管理检测未知 API。

flowchart LR
  traffic@{ icon: 'lucide:globe', label: 'API Traffic' }
  gw@{ icon: 'f5-brand:network-api-gateway', label: 'API Gateway' }
  shadow@{ icon: 'f5-brand:network-shadow-api', label: 'Shadow API Discovery' }
  inventory@{ icon: 'f5-brand:network-api-inventory', label: 'API Inventory' }
  alert@{ icon: 'f5-brand:other-visibility-eye', label: 'Visibility' }

  traffic --> gw
  gw --> shadow
  shadow --> inventory
  inventory --> alert

API 网关架构

API 网关包含身份验证、速率限制和安全校验，保护后端 API 服务。

architecture-beta
  group gateway(f5-brand:network-api-gateway)[API Gateway]
  group backend(carbon:cloud-services)[Backend Services]

  service apigw(f5-brand:network-api-gateway)[API Gateway] in gateway
  service auth(f5-brand:security-key-lock)[Authentication] in gateway
  service rate(f5-brand:network-api)[Rate Limiter] in gateway
  service shield(f5-brand:security-shield-checkmark)[Schema Check] in gateway
  service api1(carbon:api)[Users API] in backend
  service api2(carbon:api)[Orders API] in backend

  apigw:R --> L:auth
  auth:R --> L:rate
  rate:R --> L:shield
  shield:R --> L:api1
  shield:B --> T:api2

API 生命周期：从发现到保护

API 生命周期流水线，从影子 API 发现经库存编目到主动防护。

flowchart TD
  apps@{ icon: 'carbon:application', label: 'Applications' }
  discover@{ icon: 'f5-brand:network-shadow-api', label: 'Shadow API Discovery' }
  inventory@{ icon: 'f5-brand:network-api-inventory', label: 'API Inventory' }
  gateway@{ icon: 'f5-brand:network-api-gateway', label: 'API Gateway' }
  shield@{ icon: 'f5-brand:security-shield-app-code', label: 'API Protection' }
  monitor@{ icon: 'f5-brand:other-site-metrics', label: 'API Metrics' }

  apps --> discover
  discover --> inventory
  inventory --> gateway
  gateway --> shield
  shield --> monitor

平台与可观测性

基于 NGINX One 的分布式应用

分布式应用平台，包含 NGINX One 管理、Kubernetes 工作负载和集中控制。

architecture-beta
  group platform(f5-brand:service-f5)[F5 Platform]
  group compute(carbon:cloud-services)[Compute]

  service nginx(f5-brand:service-nginx)[NGINX One] in platform
  service netng(f5-brand:network-nginx)[NGINX Network] in platform
  service f5svc(f5-brand:service-f5)[F5 Service] in platform
  service k8s(f5-brand:app-kubernetes)[Kubernetes] in compute
  service dist(f5-brand:cloud-distributed)[Distributed App] in compute
  service container(f5-brand:cloud-container-app)[Container App] in compute

  nginx:R --> L:netng
  netng:R --> L:f5svc
  nginx:B --> T:k8s
  netng:B --> T:dist
  f5svc:B --> T:container

可观测性流水线

可观测性流水线，从应用采集指标并生成洞察报告、告警和仪表板。

flowchart LR
  app1@{ icon: 'carbon:application', label: 'Web App' }
  app2@{ icon: 'carbon:api', label: 'API Service' }
  metrics@{ icon: 'f5-brand:other-site-metrics', label: 'Metrics Collection' }
  eye@{ icon: 'f5-brand:other-visibility-eye', label: 'Visibility' }
  llmobs@{ icon: 'f5-brand:ai-llm-observability', label: 'LLM Observability' }
  alert@{ icon: 'f5-brand:other-bell', label: 'Alerts' }

  app1 --> metrics
  app2 --> metrics
  metrics --> eye
  eye --> llmobs
  llmobs --> alert

完整平台视图

F5 完整平台视图，在统一服务下连接安全、网络和应用交付。

architecture-beta
  group f5(f5-brand:service-f5)[F5 Service Platform]
  group security(f5-brand:security-firewall-shield)[Security]
  group networking(f5-brand:cloud-network-connect)[Networking]

  service svcf5(f5-brand:service-f5)[F5 Service] in f5
  service bigip(f5-brand:service-big-ip-next)[BIG-IP Next] in f5
  service obs(f5-brand:other-site-metrics)[Observability] in f5
  service fw(f5-brand:security-firewall-shield)[WAF] in security
  service botd(f5-brand:security-bot-defence)[Bot Defence] in security
  service ddos(f5-brand:network-ddos-protection)[DDoS] in security
  service multi(f5-brand:cloud-multi-network)[Multi-Cloud Net] in networking
  service fabric(f5-brand:app-delivery-fabric)[App Fabric] in networking
  service nginx(f5-brand:service-nginx)[NGINX One] in networking

  svcf5:B --> T:fw
  svcf5:B --> T:multi
  bigip:B --> T:botd
  bigip:B --> T:fabric
  obs:B --> T:ddos
  obs:B --> T:nginx