AFM
338 TopicsF5 object groups in AFM
Hello guys, In our infra F5 is internet facing and behind F5 we have palo alto firewall. So, we are blocking malicious Ips in F5 and palo alto to secure the network. Now, palo alto blocking group limit is exceeded, and they are not able to block more ips in palo alto. We need to use F5 for blocking ips in future. We have an internet to internal rule for blocking and now we are going to create a rule for internal to external (internal network to malicious IP group). I hope F5 network firewall will be able to block all these internal to internet and internet to internal communications using AFM. Thanks BilalSolved134Views0likes7CommentsUpgrade Path for BIG-IP 2000 – Out of Warranty and EoRMA Status
Hi Team, We are currently running BIG-IP LTM and AFM version 14.1.4.6 on a BIG-IP 2000 appliance. While reviewing our setup in iHealth, we received the following message: "Your hardware reached its End of Return to Manufacturing (EoRMA) date on April 1, 2025. Support options may be limited and an upgrade is recommended." As the platform is no longer under warranty and we’re running an older software version, we are planning to upgrade to the latest supported version on this hardware. Based on the compatibility matrix, it appears that BIG-IP 15.1.10.x is the latest version supported on the 2000 series. We understand that 15.1.x will reach End of Technical Support in December 2025, and we plan to use this upgrade as a short-term solution while we evaluate options for hardware replacement. Our questions are: Since we are out of warranty and do not currently have an active support contract, can we still upgrade to 15.1.10.x? If the device doesn’t have internet access, will collecting the license dossier and uploading it to the F5 licensing portal allow us to reactivate the existing license? Are there any limitations in upgrading or re-licensing in this scenario that we should be aware of? Any guidance or confirmation would be appreciated.110Views0likes3CommentsSSH Proxy Problem: Real Server Auth
Hi, while playing around with the SSH proxy feature, I'm encountering issues with the validation of the Real Server Auth key. I've configured the profile as described in https://support.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-12-1-0/13.html. Unfortunately I got an error message in /var/log/sshplugin: err : SSHPLUGIN: sshplugin_2|SSHPlugin|ssh_setup_serverside|Core|the backend ssh server does not have a public key that matches the configuration! (0) Erroring out of this connection. I've checked and doublechecked the host key using ssh-keyscan and copied the key string into the field "Real Server Auth". The format of the key looks exactly like the one from the manual, except that my key is a one-liner instead of the block view in the manual. The manual shows the key in block view AAAAB3NzaC1yc2EAAAADAQABAAABAQCziS6yavPpFuRjLP9hzRiEBcVgLDynoW qNMuwCrOREkSiDqWqFRrydFCGy6Z1WwwJuDMIw5h3sIuqtOo78zd6pBabXpj0Q LUyLtGx80Oe3vInpwxvG2/YX9KaGjofkasZJ+tOqoOe5QscnUYr7Iw6CEuo2dB VIZyL/o1IyTvDfL8+yXO4vPzadmL0gvV1F56feRVsCF0HUrhWwdrQ6CpIpX6ac sY0HayrhOGPmVF4qRz7fLySHJ5XQz5IKXJRNHJEbXx2tiV1TuQlhz8gOMqMp2I iSqyKDcUTk2Oy0fPYkNAWPlifq7GplYkit85EL5UCgtHf595rqibOQJWFAAzHF while mine looks like AAAAB3NzaC1yc2EAAAADAQABAAABAQCziS6yavPpFuRjLP9hzRiEBcVgLDynoWqNMuwCrOREkSiDqWqFRrydFCGy6Z1WwwJuDMIw5h3sIuqtOo78zd6pBabXpj0QLUyLtGx80Oe3vInpwxvG2/YX9KaGjofkasZJ+tOqoOe5QscnUYr7Iw6CEuo2dBVIZyL/o1IyTvDfL8+yXO4vPzadmL0gvV1F56feRVsCF0HUrhWwdrQ6CpIpX6acsY0HayrhOGPmVF4qRz7fLySHJ5XQz5IKXJRNHJEbXx2tiV1TuQlhz8gOMqMp2IiSqyKDcUTk2Oy0fPYkNAWPlifq7GplYkit85EL5UCgtHf595rqibOQJWFAAzHF Hopefully this doesn't make a difference. I even don't know how to turn on debug logging for sshplugin. Maybe this would help. Any ideas? Greets, svs483Views0likes2CommentsCan F5 be in Bridge Mode or a L2 DDOS to protect from L3-L4 DDOS attack
Hi F5 community, We just want to consult if F5 rSeries models ( Active-Standby HA setup ) with AFM license is capable to do bridge mode to cater L3-L4 DDOS protection before it goes to Internet Perimeter FW. We ask this so that there will be no re-architecture or change of config about the Public IP defined in the Internet Perimeter FW. If you have any document experience or KB article pertaining to this it will be a great help to us. Thank you in advance.Solved1.9KViews0likes7CommentsSizing for HW and SW based
I am looking for a data for dimensioning for r5800 / 6000 etc where I am deploying DNS+PEM+AFM+URL Filtering + some iRules on ONE rSeries The same witch I am looking for is for VE deployment Where I can find data about such figures I can only find for DNS QPS, but for the rest of the modules can't Are there any exact numbers? How can I combine and calculate this module and see if feet into rSeries and VE HP??209Views0likes2CommentsAFM / Configuring rules within a rule list through REST
Hey guys, Unfortunately I have to configure some AFM rule lists and rules, respectively. My first attempt was to add a new rule list with the whole rule set in one piece with a single POST request. I got this error message { "code": 400, "message": "Rule entries that are being added with the \"add\" option must specify either \"place-before\" or \"place-after\"", "errorStack": [], "apiError": 26214401 } I then tried to add new empty rule lists through REST which worked. After that I wanted to add several rules within that new rule list. That failed again with the error message mentioned above. Even POSTing a single rule in the this rule list fails with the same error message. It seems that the this message has been copied from the tmsh refrence documentation (see here: https://clouddocs.f5.com/cli/tmsh-reference/v15/modules/security/security_firewall_rule-list.html) . I am a bit confused now how to add rules to a list. However, I added "ruleNumber" in the JSON body and experimented with different numbers (i.e. 0) but it did not work. Configuring rules within rule lists and refrencing the list within a policy is the way to go here at my company. While writing this post I found out that it is possible to just configure rules within a policy (we rarely use the AFM module). So here are my questions: Do you have any ideas what I am doing wrong when using REST configuring rules within a rule list? The mentioned way to go seems odd to me. Is it enough for simple packet filtering ("look at the source and allow only port 443" for example) to configure rules within a policy? What is your good practice?Solved158Views0likes1CommentDefault global parameters in F5 LTM and AFM
Hi F5 Community, We would to like ask if there's a way in F5 thru TMSH command wherein we check or show all the default parameters or global variables set in F5? Which we will export to a notepad or excel so that we can made a comparison from one existing system to a new one. Thank you in advance who will be able to help us in our inquiry.Solved258Views0likes6CommentsLogging all AFM Rules
Hello, I have multiple AFM rules, more than 300 distributed in multiple "rule-lists". Some have the "logging" option enabled and others do not. I need to enable the "logging" option for all partition rules, is there a method for this? Or some script? Thank youSolved902Views0likes3Comments