For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Renato_166638's avatar
Renato_166638
Icon for Nimbostratus rankNimbostratus
Sep 21, 2017
Solved

Invert match in AFM policy

Hi!   Is it possible to invert the match sense in AFM parameters like we do using ! with iptables?   Thanks!  
AFM
security
  • Richard_Karon_7's avatar
    Richard_Karon_7
    Jul 01, 2018

    if you would like to change a single allowed address such as this one

     

    1. accept all traffic to 10.1.1.1/32

    you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

     

    for example assuming the rest of the network is a 24 bit subnet mask,

     

    1. drop/reject all traffic for 10.1.1.1/32
    2. accept all traffic to 10.1.1.0/24

    or vice-versa if you want to allow your specific ip address on a blocked subnet.

     

Richard_Karon_7's avatar
Richard_Karon_7
Historic F5 Account
Jul 01, 2018

if you would like to change a single allowed address such as this one

 

  1. accept all traffic to 10.1.1.1/32

you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

 

for example assuming the rest of the network is a 24 bit subnet mask,

 

  1. drop/reject all traffic for 10.1.1.1/32
  2. accept all traffic to 10.1.1.0/24

or vice-versa if you want to allow your specific ip address on a blocked subnet.

 

  • Renato_166638's avatar
    Renato_166638
    Icon for Nimbostratus rankNimbostratus
    Jul 18, 2018

    Richard, that was a long time ago, but you suggestion is probably what I did. I was migrating some policies from PaloAlto to AFM and also trying to make it the more similar I could at same time for the customer.