BIG-IP ASM Automation with Ansible

My Background

Back in September I started my Ansible journey, coming from no knowledge about Ansible and its automation capabilities I was asked to develop some code/playbooks to automate some of the BIG-IP's ASM functions for AnsibleFest 2019. 

I was pleasantly surprised on how easy it was to install Ansible, build playbooks and deliver the correct end-state for the BIG-IP. The playbooks and automation took me back down memory lane to when I was creating a universal network bootable Norton Ghost CD in DOS for all of the different models of PCs my work owned.

The team I work for (Business Development) has been working hard at making sure our code is easily accessible to customers through GitHub. Our goal is to provide the necessary tools such as F5 Automation Sandbox and use-cases so that even if you are new to Ansible, or a die-hard coder with Ansible that there is a place for you to test, consume and bring life to the code.

What is BIG-IP ASM?

F5 BIG-IP® Application Security Manager™ (ASM) is a flexible web application firewall that secures web applications in traditional, virtual, and private cloud environments. BIG-IP ASM helps secure applications against unknown vulnerabilities, and enables compliance for key regulatory mandates. BIG-IP ASM is a key part of the F5 application delivery firewall solution, which consolidates traffic management, network firewall, application access, DDoS protection, SSL inspection, and DNS security.

What is Ansible?

Ansible is a radically simple IT automation engine that automates cloud provisioning, configuration management, application deployment, intra-service orchestration, and many other IT needs. Designed for multi-tier deployments since day one, Ansible models your IT infrastructure by describing how all of your systems inter-relate, rather than just managing one system at a time. It uses no agents and no additional custom security infrastructure, so it's easy to deploy - and most importantly, it uses a very simple language (YAML, in the form of Ansible Playbooks) that allow you to describe your automation jobs in a way that approaches plain English.

What does the Code Do?

IP Blocking - In ASM, there is a feature called IP address intelligence that can allow or block IP addresses from being able to access protected applications. This code creates a Virtual IP (VIP) and a blank ASM policy attached to that VIP. After the creation the code exports the ASM Policy into an XML format and is then modified by the code snip-it below to add blocked IP addresses and re-import that policy over the existing one. Prior to this snip-it we have code that checks to see if the IP address already exists for things like re-runs of the code and blocks duplicate IP addresses from being added to the XML.

This is a snip-it of the Code where it modifies the ASM Policy XML File (this was exported in previous steps in the code)

#Import Additional Disallowed IPs
	  - name: Add Disallowed IPs
	    xml:
	      path: "{{ ASM_Policy_File }}"
	      pretty_print: yes
	      input_type: xml
	      insertafter: yes
	      xpath: /policy/geolocation
	      add_children: "<whitelist><ip_address>{{ item.item }}</ip_address><subnet_mask>255.255.255.255</subnet_mask><policy_builder_trusted>false</policy_builder_trusted><ignore_anomalies>false</ignore_anomalies><never_log>false</never_log><block_ip>Always</block_ip><never_learn>false</never_learn><description>blocked</description><ignore_ip_reputation>false</ignore_ip_reputation></whitelist>"
	    with_items: "{{ Blocked_IP_Valid.results }}"
	    when: Blocked_IPs is defined and item.rc == 1

Here is a demonstration of an IP being blocked and unblocked by the BIG-IP ASM Policy.

Disallowed URL Filtering - Another feature of ASM is the ability to disallowed URLs, this can be useful when working internally vs. externally and there are other reasons to why a specific URL would be blocked or protected by BIG-IP ASM. This code can be used independently, cooperatively, or not at all with this playbook. Since this playbook is merged with the IP Blocking code it follows the same flow (exporting/importing XML and error checking) as previously mentioned in the IP Blocking to ensure no duplicates are made in the XML.

This is a snip-it of the Code where it modifies the ASM Policy XML File (this was exported in previous steps in the code)

#Import Additional Disallowed URLs
	  - name: Add Disallowed URLs
	    xml:
	      path: "{{ ASM_Policy_File }}"
	      input_type: xml
	      pretty_print: yes
	      xpath: /policy/urls/disallowed_urls
	      add_children:
	        - "<url protocol=\"HTTP\" type=\"explicit\" name=\"{{ item.item }}\"/>"
	        - "<url protocol=\"HTTPS\" type=\"explicit\" name=\"{{ item.item }}\"/>"
	    with_items: "{{ Blocked_URLs_Valid.results }}"
	    when: Blocked_URLs is defined and item.rc == 1

Here is a demonstration of specific URLs being blocked by the BIG-IP ASM Policy. (Note: the File Name in the repo has been changed but does the same use-case )

Where can you access the Playbook for this integration?

https://github.com/f5devcentral/f5-bd-ansible-usecases/tree/master/03-F5-WAF-Policy-Management

How to get all of the use-cases currently available.

https://github.com/f5devcentral/f5-bd-ansible-usecases

Want to try it out but need a Lab to work in? Try out our F5 Automation Sandbox built for AWS!

https://clouddocs.f5.com/training/automation-sandbox/