Manual Chapter :
About AFM Network Firewall Active Rules
Applies To:
Show Versions
BIG-IP AFM
- 17.1.0, 17.0.0, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0
About AFM Network Firewall Active Rules
About Active AFM Network Firewall Rules
You can use the AFM Network Firewall Active Rules page to view deployed network firewall rule or rule list statistics. Before viewing the Active Rules page, you should be familiar with the following Context Filters:
- Policy Type
- SelectEnforcedto view enforced rules that apply to traffic traversing the AFM system. SelectStagedto view staged rules, allowing you to view the rule's match statics, evaluating the rule's affect on traffic.
- Context
- Specifies which rule context appears in the active rules list. Select a context to apply it. The default isGlobal.Globallist the rules that apply to all traffic traversing the firewall.Route Domainlists the rules that apply to a selected route domain only.Virtual Serverlists the rules that apply to the selected virtual server only.Self IPlists the rules that apply to the selected self IP address of the BIG-IP device.Management Portlists the rules that apply to the BIG-IP device management port.
Once you choose a Context Filter, you can view the following rules statistics:
- ID
- The order of the network firewall rule.
- Name
- The name of the network firewall rule.
- State
- The state of the network firewall rule: Enabled, Disabled, Scheduled, Enabled (Redundant) or Enabled (Conflict)
- Protocol
- The protocol to which the rule applies.
- Source
- The packet source to which the rule applies.
- Destination
- The packet destination to which the rule applies.
- Action
- Specifies the following actions: Accept, Drop or Reject,
- Logging
- Specifies whether logging is enabled or disabled.
- Count
- The total number of time the rule has matched a packet.
- Latest Match
- Specifies the most recent match to the rule. Used to determine how often a rule is being used.
View AFM Network Firewall Active Rules
You must have staged or enforced rules configured on your AFM Network Firewall system.
Use the AFM Network Firewall Active Rules page to view both enforced and staged active firewall rule statistics.
- On the Main tab, click .
- From thePolicy Typelist select eitherEnforcedorStaged.
- From theContextlist select one of the following contexts:
- Management Port
- Global
- Route Domain
- Virtual server
- Self IP
A second context list appears. - From the second context list, select a specific rule or rule list object.
- View the statistics in theActive Rule Listarea.
About redundant, conflicting and stale rules
When you create rules on the network firewall, it is possible that a rule can either overlap or conflict
with an existing rule.
- Redundant rule
- A firewall rule that completely overlaps with another rule, including the same firewall action. In the case of a redundant rule, the rule can be removed with no net change in packet processing.
- Conflicting rule
- A firewall rule that completely overlaps with another rule, but the rules have different firewall actions. A rule might be called conflicting even if the result of each rule is the same. For example, a rule that applies to a specific IP address is considered in conflict with another rule that applies to the same IP address, if one has anAcceptaction and the other has an action ofAccept Decisively, even though the two rules accept packets.
- Stale rule
- A firewall rule that is infrequently or never used. A stale rule is one that has an extremely low or 0 hit count.
On a rule list page, redundant or conflicting rules are indicated in the
State
column with either (Redundant)
or (Conflicting)
. View and remove redundant or conflicting rules
You must have staged or enforced rules configured on your system that are redundant or
conflicting.
View and remove redundant or conflicting rules to simplify your configuration and ensure that
your system takes the correct actions on packets.
- On the Main tab, click .The Active Rules screen opens.
- From thePolicy Typelist, select whether you want to viewEnforcedorStagedpolicies.If you select to viewStagedpolicies, you can not view management port rules, as they cannot be staged.
- View the firewall rule states in theStatecolumn.Each rule is listed as Enabled, Disabled, or Scheduled. In addition, a rule can have one of the following states. View and adjust rules with these states, if necessary.
- (Redundant)
- The rule is enabled, disabled, or scheduled, and redundant. All the functionality of this rule is provided by a previous rule or rules. Hover over theStatecolumn to see why the rule is considered redundant, and possible solutions. Typically you can disable or delete a redundant rule with no net effect on the system.
- (Conflicting)
- The rule is enabled, disabled, or scheduled, and conflicting. All the match criteria of this rule is covered by another rule or rules, but this rule has a different action. Hover over theStatecolumn to see why the rule is considered conflicting, and possible solutions. Typically you should disable or delete a conflicting rule. Because the rule criteria is matched prior to the conflicting rule, there it typically no net change in processing. Note that theAcceptandAccept Decisivelyactions are treated as conflicting by the system.
- (Conflicting & Redundant)
- The rule is enabled, disabled, or scheduled, and conflicting or redundant with the actions of more than one other rule. Typically you should disable or delete a conflicting and redundant rule.
- Resolve conflicting or redundant rules by editing, deleting, or disabling them. Click a rule name to edit, delete, or disable it, and complete the required action.
The firewall rule list is adjusted.
View and remove stale rules
You must have staged or enforced
rules configured on your system, and the system must be processing traffic, to determine
whether rules are hit.
View and remove infrequently used or
unused rules to reduce firewall processing and simplify your rules, rule lists, and
policies.
Before
you remove a rule that is infrequently hit, or never hit, make sure that doing so
will not create a security issue. A rule might be hit infrequently, but might still
be a required part of your security stance for a specific or rare
attack.
- On the Main tab, click .The Active Rules screen opens.
- From thePolicy Typelist, select whether you want to viewEnforcedorStagedpolicies.If you select to viewStagedpolicies, you can not view management port rules, as they cannot be staged.
- View the rule hit count in theCountcolumn.The rule hit count shows how many total times a rule hit has occurred. A very low number indicates that the rule is infrequently hit. A count of0indicates the rule has never been hit.
- View the latest match date in theLatest Matchcolumn.The latest match column lists the last time the rule was hit. An old date indicates that the rule has not been hit in a long time.Neverindicates that the rule has never been hit.
- Resolve infrequently hit rules by editing, deleting, or disabling them. Click a rule name to edit, delete, or disable it, and complete the required action.
The firewall rule list is adjusted.
