The BIG-IP^® Network Firewall provides policy-based access control to and from address and port pairs inside and outside of your network. By default, the network firewall is configured in ADC mode, which is a default allow configuration, in which all traffic is allowed through the firewall, and any traffic you want to block must be explicitly specified.

To understand this firewall scenario, imagine that your prerequisite system load-balances all traffic from the Internet to several internal servers. The internal servers are:

The system does not have a separate route domain configured, however you can use Route Domain 0, which is essentially the same as a global rule.

In order for traffic from the internal application virtual server to reach the external network virtual server, you must create a VLAN and enable both internal and external virtual servers on it. In this scenario, these VLANs are specified:

In addition, in this firewall configuration, there are three external networks that must be firewalled:

1. On the Main tab, click Security > Options > Network Firewall .
   The Network Firewall screen opens to Firewall Options.
2. From the Virtual Server & Self IP Contexts list, select the default action Accept for the self IP and virtual server contexts.
3. Click Update.
   The virtual server and self IP contexts for the firewall are changed.

1. On the Main tab, click Network > VLANs .
   The VLAN List screen opens.
2. Click Create.
   The New VLAN screen opens.
3. In the Name field, type a unique name for the VLAN.
   For purposes of this implementation, name the VLAN net_ext.
4. For the Interfaces setting:
   1. From the Interface list, select an interface number.
   2. From the Tagging list, select Tagged.
   3. Click Add.
5. If you want the system to verify that the return route to an initial packet is the same VLAN from which the packet originated, select the Source Check check box.
6. From the Configuration list, select Advanced.
7. In the MTU field, retain the default number of bytes (1500).
8. For the Hardware SYN Cookie setting, select or clear the check box.
   When you enable this setting, the BIG-IP system triggers hardware SYN cookie protection for this VLAN.
   Enabling this setting causes additional settings to appear. These settings appear on specific BIG-IP platforms only.
9. For the Syncache Threshold setting, retain the default value or change it to suit your needs.
   The Syncache Threshold value represents the number of outstanding SYN flood packets on the VLAN that will trigger the hardware SYN cookie protection feature.

   When the Hardware SYN Cookie setting is enabled, the BIG-IP system triggers SYN cookie protection in either of these cases, whichever occurs first:

   • The number of TCP half-open connections defined in the LTM^® setting Global SYN Check Threshold is reached.
   • The number of SYN flood packets defined in this Syncache Threshold setting is reached.
10. For the SYN Flood Rate Limit setting, retain the default value or change it to suit your needs.
    The SYN Flood Rate Limit value represents the maximum number of SYN flood packets per second received on this VLAN before the BIG-IP system triggers hardware SYN cookie protection for the VLAN.
11. Click Finished.
    The screen refreshes, and displays the new VLAN in the list.

1. On the Main tab, click Security > Network Firewall > Active Rules .
   The Active Rules screen opens.
2. In the Rules area, click Add to add a firewall rule to the list.
3. From the Context list, select the Global context.
4. In the Name field, type deny_icmp.
5. From the Type list, select Rule.
6. From the State list, select Enabled.
7. From the Protocol list, select ICMP.
8. In the ICMP Message area, from the Type list, select Any, and click the Add button.
   Tip: You can optionally deny only ICMP ping requests, by selecting Echo (8) from the Type list, and clicking Add.
9. Leave the Source area configured to allow Any address, port, and VLAN.
10. Leave the Destination area configured to allow Any address or port.
11. From the Action list, select Drop or Reject.
    These options either drop ICMP packets from any source and port to any port and address, or send a reject message and reset the the connection.
12. From the Logging list, enable or disable logging for the firewall rule.
    A logging profile must be enabled to capture logging info for the firewall rule.
13. Click Finished.
    The list screen and the new item are displayed.

1. On the Main tab, click Security > Network Firewall > Address Lists .
   The Address Lists screen opens.
2. Click Create to create a new address list.
3. In the name field, type ADDR_LIST1.
4. In the Addresses area, add the following addresses: 48.63.32.0/24 and 60.63.10.0/24. Click Add after you type each address.
5. Click Finished.
   The list screen and the new item are displayed.

1. On the Main tab, click Security > Network Firewall > Active Rules .
   The Active Rules screen opens.
2. In the Rules area, click Add to add a firewall rule to the list.
3. Select the Virtual Server context, then select the external network virtual server (in this example, 70.168.15.0/24).
4. In the Name field, type allow_addr_list.
5. From the Type list, select Rule.
6. From the State list, select Enabled.
7. From the Protocol list, select Any.
8. In the Source area, from the Address list, select List.
9. From the Source Available list, select ADDR_LIST1, then click the << button to move ADDR_LIST1 to the Selected list.
10. Leave the Destination area configured with the default Any / Any settings.
11. From the Action list, select Accept.
    This allows packets from any source on the address list to any destination and port on any protocol on the DMZ network.
12. From the Logging list, enable or disable logging for the firewall rule.
    A logging profile must be enabled to capture logging info for the firewall rule.
13. Click the Repeat button.
    The rule is saved, and a new rule creation page opens, with the same information, so you can create a similar rule.
14. In the Name field, type deny_all.
15. In the Source area, in the Address list, select Any.
16. Leave the Destination area configured to deny access to Any address or port.
17. From the Action list, select Reject.
    This creates a deny all rule for the virtual server.
18. From the Logging list, enable or disable logging for the firewall rule.
    A logging profile must be enabled to capture logging info for the firewall rule.
19. Click Finished.
    The list screen and the new item are displayed.
20. From the Context list, select Virtual Server.
21. From the Virtual Server list, select the network virtual server.
22. Click the Filter button.

1. On the Main tab, click Security > Network Firewall > Active Rules .
   The Active Rules screen opens.
2. In the Rules area, click Add to add a firewall rule to the list.
3. Select the Virtual Server context, then select the application virtual server (in this example, 192.168.15.101).
4. In the Name field, type deny_network_48
5. From the Type list, select Rule.
6. From the State list, select Enabled.
7. From the Schedule list, select None.
8. From the Protocol list, select Any.
9. In the Source area, from the Address list, select Specify.
10. In the address field, type 48.64.32.0/24.
11. Leave the Destination area configured to deny access to Any address or port.
12. From the Action list, select Drop or Reject.
    This drops packets from the 48.64.32.0 network to any source.
13. From the Logging list, enable or disable logging for the firewall rule.
    A logging profile must be enabled to capture logging info for the firewall rule.
14. Click Finished.
    The list screen and the new item are displayed.
15. From the Context list, select Virtual Server.
16. From the Virtual Server list, select the application virtual server.
17. Click the Filter button.