As you've noticed, DevCentral is covering some new features of F5 BIG-IP version 13 this month. Today we'll review some core updates to Advanced Firewall Manager (AFM). Next week we'll dive deeper into AFM DoS service improvements. In BIG-IP v13, AFM looks to improve performance, expand configuration flexibility, and make your administrative life a bit easier; something we all need.
Per-Policy Compilation: YES!
Prior to v13, policy compiling could be a lengthy process. Compiling monolithic polices with large rule lists/rules resulted in high memory use and long waits (depending on the depth of the policy). BIG-IP v13 introduces a per-policy compilation variable designed to alleviate these symptoms.
This enables the Packet Correlation Classification Daemon (pccd) to detect changes, and recompile only changed policies. Unchanged policies will have results copied from the compiled policy objects. The above TMSH command displays the enabled variable but it can be turned off for various reasons if needed (talk to F5 support prior to screwing around with db variables).
Pccd received several other updates, honorable mentions below:
Increased memory usage statistic accuracy - useful for diagnostics
Compiler Speed Improvements
Improvements to HA handling - Active/Standby delays are reduced and stability improvements
Rule overlap check improvements now includes unused policies
Send To Virtual Server Enhancements
Prior to v13, users were limited to source/destination address and port when selecting virtual servers in rules. Now any attribute used to match firewall rules can be used to select the virtual server.
In the above image we are selecting GeoIP-based traffic and sending them to HADES, our honeypot virtual server. We can add additional conditions including:
VS & Policy based on Geolocation
VS & Policy for non-contiguous port ranges
VS & Policy combinations of full 5-tuple (and VLAN/Geo/FQDN)
We can expand our use cases with these enhanced conditions and create value add for other BIG-IP modules like AAM/LTM so only specific data classes proceed on to downstream services; think Geolocation/User based DNS/WAF/TCP options policies. These improvements should allow you to reduce firewall complexities and maybe even remove some of the patchworks implemented to get around the previous versions limitations.
As with new features, there are some caveats to be aware of (highlights):
Send to Virtual rules are applicable in global and route domain contexts
No recursive redirects (no re-redirects)
You cannot swap protocols with Send to Virtual
Traffic and the virtual server addressing must be in the same family (IPv4/IPv6)
Traffic and the virtual server must be in the same route domain
To review statistics for traffic handled by a Send to Virtual rule use:
BIG-IP's AFM's increased flexibility and performance is making firewall administration nearly enjoyable at this point. Not that I'd rather build rule sets over going Skiing, but it's a heck of a lot easier. As we investigate more AFM improvements next week, you'll start to see how big BIG-IP v13 really is. If you haven't downloaded an evaluation copy yet, what are you waiting for? Let us know if you want us to dive deeper on these and other changes. Thanks for reading!