AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF.
The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer 7 traffic.
Outer Firewall --> WAF --> HTTP Proxy ---> Internal Network / Public zone DMZ
Any machine on the internal network / public facing DMZ then would divert all traffic through the Reverse proxy, and then back out through the WAF. Yes.
My question is - is this the best way to deploy a WAF with the HTTPS reverse proxy, so do I need to go back to studying?