# Using BIG-IQ to Determine Differences Between Advanced WAF Policies

**URL:** <https://community.f5.com/t/using-big-iq-to-determine-differences-between-advanced-waf-policies/67583>\
**Category:** F5 Technical Articles\
**Tags:** asm-advanced-waf, series-visibility-and-orchestration-with-f5, security, application-delivery\
**Created:** [March 22, 2021, 3:17pm UTC](https://community.f5.com/t/using-big-iq-to-determine-differences-between-advanced-waf-policies/67583 "2021-03-22T15:17:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Romain](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@Romain](https://community.f5.com/u/Romain)\
**Post date:** [March 22, 2021, 3:17pm UTC](https://community.f5.com/t/using-big-iq-to-determine-differences-between-advanced-waf-policies/67583/1 "2021-03-22T15:17:56Z")

</div>

# Introduction

With BIG-IQ 8.0, F5 introduced a policy comparison feature.&nbsp;This allows you to bring up 2 web application firewall (WAF) policies and look at them side-by-side in a table format.&nbsp;The policies can be deployed on different BIG-IP’s or BIG-IP pairs, on virtual servers deployed for different applications.

This feature also allows the administrator to export report in PDF format for consumption outside of the BIG-IP/BIG-IQ.&nbsp;It also very useful to determine policy drift in cases where a policy is used to spawn other policies that, in turn, are tuned for the applications they protect.

This article will take you through the process of comparing 2 policies and exporting the report to PDF.

# Policy Comparison

The “Compare Policies” feature is available from the Configuration menu on BIG-IQ. Ensure that you login to BIG-IQ with sufficient privileges to access and view the Application Security Policies and their contents.

The figure below shows how to access the policy by

·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;selecting the _ **Configuration** _ tab,

·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;highlighting the _ **Security** _ menu,

·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;expanding the item labelled _ **Web Application Security** _,

·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Selecting the _ **Policies** _

 ![image_285451.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/b/ba40b2222c300a07e2057059b0ef606ab96410e1.jpeg)

Note that, selecting a policy in the window above provides valuable information about the policy and related configured items.&nbsp;In the example below, the _ **asm-lab3** _ is selected and the interface shows an overview of the policy content and the related items such as the virtual server the policy is associated with.

 ![image_285451.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/3X/e/3/e324247ab8b97723400bf537bcb671c8509328a8.jpeg)

Once on the Policies screen, you can select 2 and compare them as shown below:

 ![image_285451.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/6/618b1f4672ed5a673be879775e1065e9101a77c6.jpeg)

The two policies configuration now appear side-by-side for inspection

 ![image_285451.jpg](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/09fc41a8fef5780e37f94efc5e29ea7d85df1355.jpeg)

The two-column view can be exported in PDF format for external consumption by clicking on the _ **Export** _ button.

Also, you can get the comparison in JSON format through BIG-IQ’s REST API by following these main steps:

1.&nbsp;&nbsp;&nbsp;&nbsp;Obtain a token to access the API to use with all subsequent requests

2.&nbsp;&nbsp;&nbsp;&nbsp;List the policies and find the references to the policies of interest by issuing a GET request to the following end-point:

https://{{BIG-IQ}}/mgmt/cm/asm/working-config/policies

3.&nbsp;&nbsp;&nbsp;&nbsp;Create a policy compare task referencing the 2 policies of interest by posting a request to the following end-point:

https://{{BIG-IQ}}/mgmt/cm/asm/tasks/policy-diff

with a payload referencing the 2 policies (to and from):

```ql-syntax
  {
 "fromPolicyReference": {
        "link": ""
   },
  "toPolicyReference": {
    "link": ""
  }
 }

```

It will result in the creation of a task – the task information will be provided in the response in the form:

“selfLink”: “[https://localhost/mgmt/cm/asm/tasks/policy-diff/XXX](https://localhost/mgmt/cm/asm/tasks/policy-diff/XXX)”

Where XXX is a unique identifier.

4.&nbsp;The task generated in the step above will take some time – you can check on the status by sending a request to:

https://{{BIG-IQ}}/mgmt/cm/asm/tasks/policy-diff/XXX

Where XXX is the identifier gleaned from Step 3 above.

In the payload of the response, there will be a link to the results of the task in the form:

```ql-syntax
"diffReportReference": {
       "link": "https://localhost/mgmt/cm/asm/reports/policy-diff/YYY”
       },

```

5.&nbsp;&nbsp;&nbsp;&nbsp;Once the task is done (e.g. “currentStep”: “DONE”), the result of the comparison can be found in JSON format at:

https://{{BIG-IQ}}/mgmt/cm/asm/reports/policy-diff/YYY

Where YYY is the id referenced in Step 4 above.

# Conclusion

You have 2 options to get to a comparison between 2 policies deployed anywhere in your security infrastructure, enhancing your team’s visibility.