Applies To:

Show Versions Show Versions

Manual Chapter: Configuring BIG-IP Network Firewall Policies
Manual Chapter
Table of Contents   |   << Previous Chapter

About firewall policies

The BIG-IP® Network Firewall policies combine one or more inline rules or rule lists, and apply them as a combined policy to one or more contexts. Such policies are applied to a context directly, and cannot coexist in that context with inline rules. You can configure a context to use either a specific firewall policy or inline rules, but not both. A firewall policy and inline rules are mutually exclusive of each other. However, firewall context precedence does apply, so inline rules at the global context, for example, apply even if they contradict rules applied at a lower precedence context; for example, at a virtual server.

You can apply a network firewall policy as a staged policy, while continuing to enforce existing inline rules, or you can apply one firewall policy while staging another policy. A staged policy allows you to evaluate the effect a policy has on traffic by analyzing the system logs, without actually modifying traffic based on the firewall rules.

Creating a Network Firewall policy

Use this procedure to create a BIG-IP® Network Firewall policy.
  1. On the Main tab, click Security > Network Firewall > Policies. The Policies screen opens.
  2. Click Create to create a new policy.
  3. Type a name and optional description for the firewall policy.
  4. Click Finished.
The Policies screen shows the new policy in the policy list.
Define firewall rules for the policy to make it function.

Creating a Network Firewall policy rule

If you are going to specify address lists or port lists to use with this rule, you must create these lists before creating the firewall policy rule, or add them after you save the policy rule.
Create a network firewall policy rule to manage access from an IP or web network address to a specified network location, server, or address behind a BIG-IP® system.
Note: You cannot add rules created with this task to a rule list at a later time. You must create rules for a rule list from within the rule list. Similarly, you cannot use the rules created in a policy to apply as inline rules in another context, though you can use rule lists in a policy rule.
  1. On the Main tab, click Security > Network Firewall > Policies. The Policies screen opens.
  2. Click the name of the network firewall policy to which you want to add rules.
  3. In the Active Network Firewall Rules area, click Add to add a firewall rule to the list.
  4. In the Name and Description fields, type the name and an optional description.
  5. From the Type list, select whether you are creating a standalone network firewall policy rule or creating the rule from a predefined rule list. If you create a firewall policy rule from a predefined rule list, most options for creating a firewall policy rule do not apply.
  6. From the State list, select the rule state.
    • Select Enabled to apply the firewall policy rule to the addresses and ports specified.
    • Select Disabled to set the firewall policy rule to not apply at all.
    • Select Scheduled to apply the firewall policy according to the selected schedule.
  7. From the Schedule list, select the schedule for the firewall policy rule. This schedule is applied when the firewall policy rule state is set to Scheduled.
  8. From the Protocol list, select the protocol to which the firewall rule applies.
    • Select Any to apply the firewall rule to any protocol.
    • Select the protocol name to apply the rule to a single protocol.
    Important: ICMP is handled by BIG-IP at the global or route domain level. Because of this, ICMP messages receive a response before they reach the virtual server context. You cannot create an inline rule for ICMP or ICMPv6 on a Self IP context. You can apply a rule list to a Self IP that includes a rule for ICMP or ICMPv6; however, such a rule will be ignored. To apply firewall actions to the ICMP protocol, create a rule with the global or route domain context. ICMP rules are evaluated only for ICMP forwarding requests, and not for the IP addresses of the BIG-IP itself.
    Note: Note that you must select a protocol if you specify ports.
  9. From the Source Address list, select the type of source address to which this rule applies.
    • Select Any to have the rule apply to any IP address outside the firewall.
    • Select Specify and click Address to specify one or more IP addresses outside the firewall to which the rule applies. When selected, you can type single IP addresses into the Address field, then click Add to add them to the address list.
    • Select Specify and click Address List to select a predefined list of addresses outside the firewall to which the rule applies. To use an address list with this rule, select the address list and click the Add button. Similarly, to remove the list from this rule, select the list and click the Delete button.
  10. From the Source Port list, select the type of source ports (outside the firewalled network) to which this rule applies.
    • Select Any to have the rule apply to any port outside the firewall.
    • Select Specify and click Port to specify one or more ports outside the firewall to which the rule applies. When selected, you can type single port numbers into the Port field, then click Add to add them to the port list.
    • Select Specify and click Port List to specify a list of contiguous port numbers outside the firewall to which the rule applies. When selected, you can type the start and end ports into the fields, then click Add to add the ports to the port list.
    • Select Specify and click Port List to select a predefined list of ports outside the firewall to which the rule applies. To use a port list with this rule, select the port list and click the Add button. Similarly, to remove the list from this rule, select the list and click the Delete button.
  11. From the Source VLAN list, select the VLAN on which this rule applies.
    • Select Any to have the rule apply to traffic on any VLAN through which traffic enters the firewall.
    • Select Specify to specify one or more VLANs on the firewall to which the rule applies. To use a VLAN with this rule, move the VLAN from the Available list to the Selected list by clicking the << button. Similarly, to remove the VLAN from this rule, click the >> button to move the VLAN from the Selected list to the Available list.
  12. From the Destination Address list, select the type of destination address, behind the firewall, to which this rule applies.
    • Select Any to have the rule apply to any IP address inside the firewall.
    • Select Specify and click Address to specify one or more IP addresses inside the firewall to which the rule applies. When selected, you can type single IP addresses into the Address field, then click Add to add them to the address list.
    • Select Specify and click Address List to select a predefined list of addresses inside the firewall to which the rule applies. To use an address list with this rule, select the address list and click the Add button. Similarly, to remove the list from this rule, select the list and click the Delete button.
  13. From the Destination Port list, select the type of destination ports, behind the firewall or inside the firewalled networks, to which this rule applies.
    • Select Any to have the rule apply to any port inside the firewall.
    • Select Specify and click Port to specify one or more ports inside the firewall to which the rule applies. When selected, you can type single port numbers into the Port field, then click Add to add them to the port list.
    • Select Specify and click Port List to specify a list of contiguous port numbers inside the firewall to which the rule applies. When selected, you can type the start and end ports into the fields, then click Add to add the ports to the port list.
    • Select Specify and click Port List to select a predefined list of ports inside the firewall to which the rule applies. To use a port list with this rule, select the port list and click the Add button. Similarly, to remove the list from this rule, select the list and click the Delete button.
  14. From the Action list, select the firewall action for traffic originating from the specified source address on the specified protocol. Choose from one of the these actions:
    Option Description
    Accept Allows packets with the specified source, destination, and protocol to pass through the firewall. Packets that match the rule, and are accepted, traverse the system as if the firewall is not present.
    Accept Decisively Allows packets with the specified source, destination, and protocol to pass through the firewall, and does not require any further processing by any of the further firewalls. Packets that match the rule, and are accepted, traverse the system as if the firewall is not present.
    Drop Drops packets with the specified source, destination, and protocol. Dropping a packet is a silent action with no notification to the source or destination systems. Dropping the packet causes the connection to be retried until the retry threshold is reached.
    Reject Rejects packets with the specified source, destination, and protocol. When a packet is rejected the firewall sends a destination unreachable message to the sender.
  15. From the Logging list, enable or disable logging for the firewall rule.
  16. Click Finished. The list screen is displayed, and the new item is displayed.
The new firewall policy rule is created.

Setting a global firewall policy

You can create a virtual server with a firewall policy, to provide policy-based network firewall actions at the virtual server.
  1. On the Main tab, click Security > Network Firewall > Active Rules. The Active Rules screen opens.
  2. Under Active Network Firewall Rules, click the Global link. The Global Firewall Rules screen opens.
  3. To enforce rules from a firewall policy in the selected context, in the Network Firewall area, from the Enforcement list, select Policy Rules, then select the firewall policy to enforce from the Policy list.
  4. To stage rules from a firewall policy in the selected context, in the Network Firewall area, from the Staging list, select Enabled, then select the firewall policy to stage from the Policy list.
The policy rules you selected are enforced at the global level. If you chose to stage policy rules, the results of those rules are logged, but not enforced.

Configuring a route domain with a firewall policy

This task requires a pre-existing route domain.
On a route domain, you can set firewall policies for enforcement and staging. Use this task to set firewall policies on an existing route domain. You create a route domain on BIG-IP® system to segment (isolate) traffic on your network. Route domains are useful for multi-tenant configurations.
  1. On the Main tab, click Network > Route Domains. The Route Domain List screen opens.
  2. Click the name of the route domain to show the route domain configuration.
  3. Click on the Security tab.
  4. To enforce rules from a firewall policy on the route domain, in the Network Firewall area, from the Enforcement list, select Policy Rules, then select the firewall policy to enforce from the Policy list.
  5. To stage rules from a firewall policy on the route domain, in the Network Firewall area, from the Staging list, select Enabled, then select the firewall policy to stage from the Policy list.
  6. To enforce any inline rules that apply to the route domain, and not apply a firewall policy, in the Network Firewall area, from the Enforcement list, select Inline Rules.
  7. Click Update to save the changes to the route domain.
You now have configured a route domain on the BIG-IP system, with either firewall policies or inline rules enforced at the route domain context.

Setting network firewall policies for a self IP address

Ensure that you have created a self IP address.
You can configure network firewall rules at a self IP address by inline rule, or you can enforce a firewall policy. You can also stage a firewall policy to check the effect without affecting traffic.
  1. On the Main tab, click Network > Self IPs. The Self IPs screen opens.
  2. Click on the self IP address to which you want to add a network firewall policy.
  3. Click the Security tab.
  4. To enforce rules from a firewall policy on the self IP, in the Network Firewall area, from the Enforcement list, select Policy Rules, then select the firewall policy to enforce from the Policy list.
  5. To stage rules from a firewall policy on the self IP, in the Network Firewall area, from the Staging list, select Enabled, then select the firewall policy to stage from the Policy list.
  6. To enforce any inline rules that apply to the self IP, and not apply a firewall policy, in the Network Firewall area, from the Enforcement list, select Inline Rules.
  7. Click Update to save the changes to the self IP.
The selected self IP now enforces or stages rules according to your selections.

Creating a virtual server with a firewall policy

You can create a virtual server with a firewall policy, to provide policy-based network firewall actions at the virtual server.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, in the Address field, type the IP address you want to use for the virtual server. The IP address you type must be available and not in the loopback network.
  5. In the Service Port field, type * or select * All Ports from the list.
  6. Click Finished.
  7. Click the name of the virtual server you want to modify.
  8. On the menu bar, click Security > Policies. The screen displays Policy Settings and Inline Rules settings.
  9. To enforce rules from a firewall policy on the virtual server, in the Network Firewall area, from the Enforcement list, select Policy Rules, then select the firewall policy to enforce from the Policy list.
  10. To stage rules from a firewall policy on the virtual server, in the Network Firewall area, from the Staging list, select Enabled, then select the firewall policy to stage from the Policy list.
  11. Click Update to save the changes.
The policy rules you selected are enforced on the virtual server. If you chose to stage policy rules, the results of those rules are logged, but not enforced.

Viewing enforced and staged policy rule logs

With BIG-IP® Advanced Firewall Manager™, you can choose to enforce either inline firewall rules or a firewall policy for a specific context. You can also choose to stage policies for a specific context. Staged policies apply all of the specified firewall rules to the policy context, but do not enforce the firewall action. Therefore, the result of a staged policy is informational only, and the result can be analyzed in the firewall logs. This topic describes how to view and search for enforced and staged policy rules in the local network firewall logs.

Viewing Network Firewall enforced policy events on the local BIG-IP system

Ensure that the BIG-IP® system is configured to log the types of events you want to view, and to store the log messages locally on the BIG-IP system.
When the BIG-IP system is configured to log events locally, you can view those events using the Configuration utility.
  1. On the Main tab, click Security > Event Logs > Network > Firewall. The Network Firewall event log displays.
  2. To search for enforced policy events, in the search field, type Enforced, then click Search.
  3. To narrow your search for enforced events, click Custom Search. Drag the Enforced text from the Policy Type column to the custom search table. Narrow your search further by dragging other items from the log display, for example, from the action, policy, or rule columns. the event data that you want to search for from the Event Log table into the Custom Search table, and then click Search.

Viewing Network Firewall staged policy events on the local BIG-IP system

Ensure that the BIG-IP® system is configured to log the types of events you want to view, and to store the log messages locally on the BIG-IP system.
When the BIG-IP system is configured to log events locally, you can view those events using the Configuration utility.
  1. On the Main tab, click Security > Event Logs > Network > Firewall. The Network Firewall event log displays.
  2. To search for staged policy events, in the search field, type Staged, then click Search.
  3. To narrow your search for staged policy events, click Custom Search. Drag the Staged text from the Policy Type column to the custom search table. Narrow your search further by dragging other items from the log display, for example, from the action, policy, or rule columns. the event data that you want to search for from the Event Log table into the Custom Search table, and then click Search.
Table of Contents   |   << Previous Chapter

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)