AFM Enhancements in BIG-IP v13

As you've noticed, DevCentral is covering some new features of F5 BIG-IP version 13 this month.  Today we'll review some core updates to Advanced Firewall Manager (AFM). Next week we'll dive deeper into AFM DoS service improvements. In BIG-IP v13, AFM looks to improve performance, expand configuration flexibility, and make your administrative life a bit easier; something we all need.

Per-Policy Compilation: YES!

Prior to v13, policy compiling could be a lengthy process. Compiling monolithic polices with large rule lists/rules resulted in high memory use and long waits (depending on the depth of the policy).  BIG-IP v13 introduces a per-policy compilation variable designed to alleviate these symptoms.

(tmos)# show security firewall container-stat field-fmt
security firewall security {
    activation-time-fmt Mar 17 2017 09:44:46-0700
    compile-duration-fmt 0:0:0
    container-size 14.3K
    context-name vs_kielbasa
    context-type virtual
    ovrlpck-duration-fmt 0:0:0
    per-policy-compilation Yes
    policy-name afm_policy_a
    policy-type Staged
    process-mem 54.3M
    rule-count 5
    slot-id 0
}

This enables the Packet Correlation Classification Daemon (pccd) to detect changes, and recompile only changed policies.  Unchanged policies will have results copied from the compiled policy objects.  The above TMSH command displays the enabled variable but it can be turned off for various reasons if needed (talk to F5 support prior to screwing around with db variables).

Pccd received several other updates, honorable mentions below:

• Increased memory usage statistic accuracy - useful for diagnostics
• Compiler Speed Improvements
• Improvements to HA handling - Active/Standby delays are reduced and stability improvements
• Rule overlap check improvements now includes unused policies

Send To Virtual Server Enhancements

Prior to v13, users were limited to source/destination address and port when selecting virtual servers in rules. Now any attribute used to match firewall rules can be used to select the virtual server.

In the above image we are selecting GeoIP-based traffic and sending them to HADES, our honeypot virtual server. We can add additional conditions including:

• VS & Policy based on Geolocation
• VS & Policy for non-contiguous port ranges
• VS & Policy combinations of full 5-tuple (and VLAN/Geo/FQDN)

We can expand our use cases with these enhanced conditions and create value add for other BIG-IP modules like AAM/LTM so only specific data classes proceed on to downstream services; think Geolocation/User based DNS/WAF/TCP options policies.  These improvements should allow you to reduce firewall complexities and maybe even remove some of the patchworks implemented to get around the previous versions limitations.

As with new features, there are some caveats to be aware of (highlights):

• Send to Virtual rules are applicable in global and route domain contexts
• No recursive redirects (no re-redirects)
• You cannot swap protocols with Send to Virtual
• Traffic and the virtual server addressing must be in the same family (IPv4/IPv6)
• Traffic and the virtual server must be in the same route domain

To review statistics for traffic handled by a Send to Virtual rule use:

tmctl fw_sendtovirtual_stats

 

BIG-IP's AFM's increased flexibility and performance is making firewall administration nearly enjoyable at this point.  Not that I'd rather build rule sets over going Skiing, but it's a heck of a lot easier.  As we investigate more AFM improvements next week, you'll start to see how big BIG-IP v13 really is.  If you haven't downloaded an evaluation copy yet, what are you waiting for?  Let us know if you want us to dive deeper on these and other changes.  Thanks for reading!