F5 BIG-IP Advanced Firewall Manager (AFM) Basics

Before we dive into the actual REST API calls to interact with BIG-IP AFM it is helpful to review the basic concepts of how Advanced Firewall Manager works. It is best to understand the following:

Context: It is very common to hear abou BIG-IP AFM firewall contexts, but what exactly is a context? Context in BIG-IP AFM literature is the category of the object to which firewall rules apply. The context can be Global, Route Domain, Self IP or Virtual Server. Attaching firewall rules to a Global context implies that those rules should be applied to all traffic traversing the BIG-IP AFM firewall. The next sections will use the Global context as the context in the examples.

Firewall Rules can also be attached to Route Domain, Self IPs and Virtual Server Contexts. In such cases, those rules will be limited in scope to only a specific set of VLAN’s/interfaces, or only for specific destination IP subnets and ports.

Policy: A basic collection of firewall rules. Policies can be thought as books and rules as its pages. They can be standalone or be applied to contexts. When they’re standalone, they have no effect. The user creates policies, adds rules to them, and then applies to a context. They can be applied as enforced or staged. Enforced policies take action when there is a match. Staged policies don’t take action but they increase statistical counters so as to give the customer an idea about their possible effects. We will concentrate on enforced-policies as staged-policies are optional and enforced-policies are mostly the main method used.

Rules: Firewall rules are minimally composed of actions, a rule name and a relative place directive that specifies order among other rules.

Partition: A BIG-IP system term to define separate configuration locations. This offers granularity and security. For example, a firewall manager can access all partitions but if we wanted to limit a specific user from accessing some sensitive configuration, such configuration could be created in a new partition. Only users allowed access to that partition could see/change the configuration. All the policies can be simply put in Common partition (it’s the default partition where a policy created, so no action is needed other than knowing the concept itself). 

Action → Module → SubModule → Component → Objects

1. Create a policy <policy_name>\n          create security firewall policy <policy_name>\n2. Add/delete rules or modify existing rules\n          modify security firewall policy <policy_name>\n          modify security firewall policy rules →\n                                                  add {}\n                                                  modify {}\n                                                  delete {}\n3. Apply (aka “attach”) <policy_name> to global context\n        modify security firewall global-rules → enforced/staged-policy <policy_name>\n4. Show the contents of the policy <policy_name>\n        show security firewall policy <policy_name>\n5. Delete the policy <policy_name>\n        delete security\tfirewall policy\t<policy_name>\n6. List currently enforced/staged policy for global context\n        list security firewall\t global-rules → enforced/staged-policy\n

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X POST -d '{\"name\":\"restApiDemo\"}' https://localhost/mgmt/tm/security/firewall/policy | python -m json.tool\n{\n\"fullPath\": \"/Common/restApiDemo\",\n\"generation\": 1354,\n\"kind\": \"tm:security:firewall:policy:policystate\",\n\"name\": \"restApiDemo\",\n\"partition\": \"Common\",\n\"rulesReference\": {\n\"isSubcollection\": true,\n\"link\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules?ver=13.1.0.2\"\n},\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo?ver=13.1.0.2\"\n}\n\n

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X POST -d '{\"name\":\"myRule1\", \"action\":\"reject\", \"place-before\":\"first\"}' https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules | python -m json.tool\n{\n\"action\": \"reject\",\n\"destination\": {},\n\"fullPath\": \"myRule1\",\n\"generation\": 1360,\n\"ipProtocol\": \"any\",\n\"iruleSampleRate\": 1,\n\"kind\": \"tm:security:firewall:policy:rules:rulesstate\",\n\"log\": \"no\",\n\"name\": \"myRule1\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules/myRule1?ver=13.1.0.2\",\n\"source\": {\n\"identity\": {}\n},\n\"status\": \"enabled\"\n}

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X GET https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules | python -m json.tool\n{\n\"items\": [\n{\n\"action\": \"reject\",\n\"destination\": {},\n\"fullPath\": \"myRule1\",\n\"generation\": 1360,\n\"ipProtocol\": \"any\",\n\"iruleSampleRate\": 1,\n\"kind\": \"tm:security:firewall:policy:rules:rulesstate\",\n\"log\": \"no\",\n\"name\": \"myRule1\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules/myRule1?ver=13.1.0.2\",\n\"source\": {\n\"identity\": {}\n},\n\"status\": \"enabled\"\n}\n],\n\"kind\": \"tm:security:firewall:policy:rules:rulescollectionstate\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules?ver=13.1.0.2\"\n}

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X PATCH -d '{\"action\":\"accept\"}' https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules/myRule1 | python -m json.tool\n{\n\"action\": \"accept\",\n\"destination\": {},\n\"fullPath\": \"myRule1\",\n\"generation\": 1364,\n\"ipProtocol\": \"any\",\n\"iruleSampleRate\": 1,\n\"kind\": \"tm:security:firewall:policy:rules:rulesstate\",\n\"log\": \"no\",\n\"name\": \"myRule1\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules/myRule1?ver=13.1.0.2\",\n\"source\": {\n\"identity\": {}\n},\n\"status\": \"enabled\"\n}

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X DELETE https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo/rules/myRule1 | python -m json.tool\nNo JSON object could be decoded\n\n

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X PATCH -d '{\"enforcedPolicy\":\"restApiDemo\"}' https://localhost/mgmt/tm/security/firewall/globalRules/ | python -m json.tool\n{\n\"enforcedPolicy\": \"/Common/restApiDemo\",\n\"enforcedPolicyReference\": {\n\"link\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo?ver=13.1.0.2\"\n},\n\"kind\": \"tm:security:firewall:global-rules:global-rulesstate\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/global-rules?ver=13.1.0.2\"\n}\n\n

[root@C2629643-bigip1:FIREWALL RULES DEPLOY IN-PROGRESS:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X GET https://localhost/mgmt/tm/security/firewall/globalRules | python -m json.tool\n{\n\"enforcedPolicy\": \"/Common/restApiDemo\",\n\"enforcedPolicyReference\": {\n\"link\": \"https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo?ver=13.1.0.2\"\n},\n\"kind\": \"tm:security:firewall:global-rules:global-rulesstate\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/global-rules?ver=13.1.0.2\"\n}\n\n

[root@C2629643-bigip1:Active:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X PATCH -d '{\"enforcedPolicy\":\"\"}' https://localhost/mgmt/tm/security/firewall/globalRules/ | python -m json.tool\n{\n\"kind\": \"tm:security:firewall:global-rules:global-rulesstate\",\n\"selfLink\": \"https://localhost/mgmt/tm/security/firewall/global-rules?ver=13.1.0.2\"\n}\n[root@C2629643-bigip1:FIREWALL RULES DEPLOY IN-PROGRESS:Standalone] config # curl -sk -u admin:admin -H \"Content-Type: application/json\" -X DELETE https://localhost/mgmt/tm/security/firewall/policy/~Common~restApiDemo | python -m json.tool\nNo JSON object could be decoded

F5 BIG-IP Advanced Firewall Manager (AFM) Basics

Before we dive into the actual REST API calls to interact with BIG-IP AFM it is helpful to review the basic concepts of how Advanced Firewall Manager works. It is best to understand the following:

Context: It is very common to hear abou BIG-IP AFM firewall contexts, but what exactly is a context? Context in BIG-IP AFM literature is the category of the object to which firewall rules apply. The context can be Global, Route Domain, Self IP or Virtual Server. Attaching firewall rules to a Global context implies that those rules should be applied to all traffic traversing the BIG-IP AFM firewall. The next sections will use the Global context as the context in the examples.

Firewall Rules can also be attached to Route Domain, Self IPs and Virtual Server Contexts. In such cases, those rules will be limited in scope to only a specific set of VLAN’s/interfaces, or only for specific destination IP subnets and ports.

Policy: A basic collection of firewall rules. Policies can be thought as books and rules as its pages. They can be standalone or be applied to contexts. When they’re standalone, they have no effect. The user creates policies, adds rules to them, and then applies to a context. They can be applied as enforced or staged. Enforced policies take action when there is a match. Staged policies don’t take action but they increase statistical counters so as to give the customer an idea about their possible effects. We will concentrate on enforced-policies as staged-policies are optional and enforced-policies are mostly the main method used.

Rules: Firewall rules are minimally composed of actions, a rule name and a relative place directive that specifies order among other rules.

Partition: A BIG-IP system term to define separate configuration locations. This offers granularity and security. For example, a firewall manager can access all partitions but if we wanted to limit a specific user from accessing some sensitive configuration, such configuration could be created in a new partition. Only users allowed access to that partition could see/change the configuration. All the policies can be simply put in Common partition (it’s the default partition where a policy created, so no action is needed other than knowing the concept itself).