The visual policy editor is a screen on which to configure a per-session policy (also known as an access policy) or a per-request policy using visual elements.

This table provides a visual dictionary for the visual policy editor.

Visual element	Element type	Description
	Initial access policy and initial per-request policy	When an access profile is created, usually an initial access policy is also created. A per-request policy starts with similar initial elements.
	Start	Every access policy and per-request policy contains a start.
	Branch	A branch connects an action to another action or to an ending.
	Add an action	Clicking this icon causes a screen to open with available actions for selection.
	Action	Clicking the name of an action, such as Logon Page, opens a screen with properties and rules for the action. Clicking the x deletes the action from the access policy.
	Action that requires some configuration	The red asterisk indicates that some properties must be configured. Clicking the name opens a screen with properties for the action.
	Ending	Each branch has an ending. An access policy includes Allow or Deny endings. A per-request policy includes Allow or Reject endings.
	Configure ending	Clicking the name of an ending opens a popup screen.
	Add a macro for use in the access policy	Opens a screen for macro template selection. After addition, the macro is available for configuration and for use as an action item.
	Macro added for use	Added macros display under the access policy. Clicking the plus (+) sign expands the macro for configuration of the actions in it.
	Macrocall in an access policy	Clicking the macrocall name expands the macro in the area below the access policy.
	Apply Access Policy	Clicking it commits changes. The visual policy editor displays this link when any changes remain uncommitted.

The actions that are available on any given tab of the add item screen depend on the access profile type, such as LTM-APM (for web access) or SSL-VPN (for remote access), and so on. Only actions that are appropriate for the access profile type will display.

Add action item screen

The Macrocalls tab displays when one or more macros has been added for use in the access policy. When adding an access policy item to a macro, the Macrocalls tab displays unless adding a macrocall would create a misconfiguration, such as causing a macro loop or causing a series of macrocalls to exceed a depth of three.

Macrocalls tab on the add item screen

A macro is a collection of access policy actions that provide common access policy functions. For example, AD auth and resources is a preconfigured macro template. It supplies a logon page, an Active Directory authentication action, and a resource assignment action. The properties and rules for the actions are configurable.

After a macro is configured, it can be placed into the access policy by adding a macrocall. A macrocall is an action that performs the functions defined in a macro.

A macro contains actions and terminals and can include macrocalls.

Access policy actions

Any available action or series of actions.

Macrocalls

Calls to other macros (nested macros).

Terminals

An endpoint in a macro. Default terminals are Successful and Failure. Terminals are configurable and can be added and deleted.

Terminals defined in the macro display as the branches that follow the macrocall after it has been added to the access policy.

In an access policy, a macro can make a macrocall to another macro until up to three macros have been called in series.

The maximum depth of macrocalls

An ending provides a result for an access policy branch. An ending for an access policy branch is one of three types.

Allow

Starts the SSL VPN session and loads assigned resources and a webtop, if assigned, for the user. Typically, you assign this when the user passes specific checks.

Deny

Disallows the SSL VPN session and shows the user an access denied web page. Typically, you assign this when the user does not have access to resources, or fails authentication. Alternatively after a session starts, shows a URL filter denied web page after a per-request policy rejects a request for a URL.

Redirect

Redirects the client to the URL specified in the ending configuration. You can define a redirect URL for each redirect ending. Typically, you can assign a redirect when the user requires remediation, or a separate resource. For example, a user who fails the antivirus check because virus definitions are out of date can be redirected to the software manufacturer's site to get an antivirus update.

The maximum size for an expression in the visual policy editor is 64 KB. The visual policy editor cannot save an expression that exceeds this limit.

Access Policy Manager^® (APM^®) provides two types of policies.

Per-session policy

The per-session policy runs when a client initiates a session. (A per-session policy is also known as an access policy.) Depending on the actions you include in the access policy, it can authenticate the user and perform other actions that populate session variables with data for use throughout the session.

Per-request policy

After a session starts, a per-request policy runs each time the client makes an HTTP or HTTPS request. A per-request policy can include a subroutine, which starts a subsession. Multiple subsessions can exist at one time.

One access policy and one per-request policy are specified in a virtual server.

You can access all of the following BIG-IP^® system documentation from the AskF5™ Knowledge Base located at http://support.f5.com/.