Lab 1.6 - Implement Rate Limiting

The API Protection Profile allows a BIG-IP administrator to throttle the amount of connections to an API through the use of Key Names.

Task 1 - Test access pre-ratelimiting

1. From Postman, Select the request GET-Retrieve User Attributes-JWT-Pass

2. Click Save, so the current token is saved as part of the API request.

8. Click Runner located in the left corner

9. Expand the API Protection collection

10. Deselect all requests except GET-Retrieve User Attributes-JWT-Pass
11. Set the iterations to 100
12. Click Run API Protection

13. You receive a 200 OK for every request. Leave Runner open

Task 2 - Define the rate limiting keys

1. Navigate to API Protection >> Profile. Click Profile to modify the previously created API protection Profile. Not the + Plus symbol.

2. Click api-protection

3. Click Rate Limiting from the top ribbon

Note

The API protection profile default settings contains five Key Names created, but their values are empty. Additional Keys can be created if necessary

4. Click api-protection_auto_rate_limiting_key1

5. Enter the Key Value %{subsession.oauth.scope.last.jwt.user}
6. Click Edit

7. Click api-protection_auto_rate_limiting_key2
8. Enter the Key Value %{subsession.oauth.scope.last.jwt.groupid}
9. Click Edit

10. Click api-protection_auto_rate_limiting_key3
11. Enter the Key Value %{subsession.oauth.scope.last.jwt.client}
12. Click Edit

13. Click api-protection_auto_rate_limiting_key4
14. Enter the Key Value %{subsession.oauth.scope.last.jwt.tier}
15. Click Edit

16. Click api-protection_auto_rate_limiting_key5
17. Enter the Key Value %{subsession.oauth.scope.last.jwt.org }
18. Click Edit

19. Click Save

Task 3 - Create a Rate Limiting Policy

1. Click Create in the rate limiting section

2. Enter the Name acme-rate-limits
3. Move all five keys under Selected Keys
4. Enter 10 for the number of requests per minute
5. Enter 5 for the number requests per second
6. Click Add.

7. Click Save

Task 4 - Apply the Rate Limiting Policy

1. Click Rate Limiting from the ribbon

2. Click Edit Per Request Policy

3. Click the + (Plus Symbol) on the Out branch of the OAuth Scope Check AuthZ Macro

4. Click the Traffic Management tab
5. Select API Rate Limiting
6. Click Add Item

7. Click Add new entry
8. Select acme-rate-limits
9. Click Save

10. Verify the Rate Limiting agent now appears in the appropriate location

Task 5 - Test Rate Limiting

1. From Postman, return to Runner

2. Click Retry to rerun the request an additional 100 times.

3. On the 6th request you begin to receive a 429 Too Many Requests response status code