Each BIG-IP^® local traffic policy requires a matching strategy to determine which rule applies if more than one rule matches.

The BIG-IP local traffic policies provide three predefined policy matching strategies: a first-match, best-match, and all-match strategy. Each policy matching strategy prioritizes rules according to the rule's position within the Rules list.

As needed, you can create a user-defined best-match strategy to customize the precedence (order of preference) of added operands and selectors. For example, to meet your preferred operand and selector combinations, you might create a user-defined best-match strategy that changes the precedence of added operands and selectors, compared to the predefined best-match strategy.

Classification signatures are added as rules in the local traffic policy. The classification signatures can be used for many standard categories and applications. In addition, you can create custom categories and applications. When you use Policy Enforcement Manager™ (PEM™), you can create a policy and attach it to traffic policy presets (ce_pem). In the LTM profiles classification (classification_pem), the preset should be ce_pem. The virtual server should have classification profile and SPM profile.

Local traffic policies can include multiple rules. Each rule defines the signature and consists of a condition. Actions are to be performed if the condition holds. Multiple signatures can be assigned to one policy, so you can create a local traffic policy that works with PEM and includes multiple rules that do different things depending on the conditions you set up. In this type of CE policy, each rule can include an application or category or both. The application and category can either be custom or defined applications and categories.

1. On the Main tab, click Local Traffic > Policies .
   For more information about local traffic policies, refer to BIG-IP^® Local Traffic Manager™: Implementations.
   The Policy List screen opens.
2. Click create.
   The New Policy List screen opens.
3. In the Policy Name field, type a unique name for the policy, for example companyA.
4. In the Description field, type descriptive text that identifies the policy definition.
5. From the Strategy list, select the action that is executed when there are multiple rules that match.

   Rule	Description
   All	Uses the first or best strategy to resolve the conflict of rule match.
   Best	Applies the actions of the rule specified in the list of defined strategies for the associated policy.
   First	Applies the actions of only the first rule. This implies that the rule with the lowest ordinal,highest priority or first in the list is executed.

6. From the Type list, select the Traffic Policy to create a custom signature.
7. Click Create Policy to create a policy that manages traffic assigned to a virtual server.
8. Click the down arrow for Save Draft. Select Save Draft Policy to save the policy as a draft or Save and Publish policy to publish a policy and assign it to a virtual server.
   You should be able to create a rule for the Draft Policies list.
9. Click the name of the draft policy you just created.
   The Draft Policy screen opens.
10. From the Rules list, select Create.
    The New Rule screen opens.
11. In the Name field, type a unique name for the rule.
12. In the Description field, type descriptive text that identifies the rule definition.
13. In Match all of the following conditions, click + and specify the conditions.
    For example, select Client SSL, cipher, contains and type COMPAT:AES128-GCM-SHA256, request
14. Click Add.
15. In Do the following when the traffic is matched, click + and specify the actions:
    For example, select Enable, cache, at request.
16. Click Save.

1. On the Main tab, click Local Traffic > Policies > Strategy List .
   The Strategy List screen opens.
2. Click Create.
   The New Strategy List screen opens.
3. In the Name field, type a unique name for the strategy definition.
4. In the Operands area, define the application traffic to which this rule applies. Specify these values and use default values for the remainder.
   1. From the Operand list, select http-host.
   2. From the Event list, select request.
   3. From the Selector list, select all.
   4. From the Condition list, select ends-with.
   5. Type the value; for example, f5.com.
   6. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. For a network, in the Destination Address field, type an IPv4 or IPv6 address in CIDR format to allow all traffic to be translated.
   The supported format is address/prefix, where the prefix length is in bits. For example, an IPv4 address/prefix is 0.0.0.0/0, and an IPv6 address/prefix is ::/0.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. From the Configuration list, select Advanced.
7. From the Classification list, select Enabled, for the BIG-IP system to enable classification for virtual servers when a policy enforcement listener is created.
8. From the Policy Enforcement Profile list, select the name of the policy enforcement profile that you previously created.
9. Click Finished.
10. From the Default Persistence Profile list, select ssl.
    This implements simple persistence, using the default ssl profile.
11. In the Policies area, click the Manage button.
12. For the Policies setting, from the Available list, select the name of the iRule that you want to assign, and use the buttons to move the name into the Enabled list.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. On the menu bar, click Resources.
4. In the Policies area, click the Manage button.
5. For the Policies setting, select the local traffic policy you created from the Available list and move it to the Enabled list.
6. Click Finished.

1. On the Main tab, click Local Traffic > Policies .
   For more information about local traffic policies, refer to BIG-IP^® Local Traffic Manager™: Implementations.
   The Policy List screen opens.
2. Click create.
   The New Policy List screen opens.
3. In the Policy Name field, type a unique name for the policy, for example companyA.
4. In the Description field, type descriptive text that identifies the policy definition.
5. From the Strategy list, select the action that is executed when there are multiple rules that match.

   Rule	Description
   All	Uses the first or best strategy to resolve the conflict of rule match.
   Best	Applies the actions of the rule specified in the list of defined strategies for the associated policy.
   First	Applies the actions of only the first rule. This implies that the rule with the lowest ordinal,highest priority or first in the list is executed.

6. From the Type list, select the CE Profile to create a custom signature.
7. Click Create Policy to create a policy that manages traffic assigned to a virtual server.
8. Click the down arrow for Save Draft. Select Save Draft Policy to save the policy as a draft or Save and Publish policy to publish a policy and assign it to a virtual server.
   You should be able to create a rule for the Draft Policies list.
9. Click the name of the draft policy you just created.
   The Draft Policy screen opens.
10. From the Rules list, select Create.
    The New Rule screen opens.
11. In the Name field, type a unique name for the rule.
12. In the Description field, type descriptive text that identifies the rule definition.
13. In Match all of the following conditions, click + and specify the conditions.
    For example, select Client SSL, cipher, contains and type COMPAT:AES128-GCM-SHA256, request
14. Click Add.
15. In Do the following when the traffic is matched, click + and specify the actions:
    For example, select Enable, cache, at request.
16. Click Save.