A service policy allows you to associate network idle timers on firewall contexts and rules.

You can discover a service policy on a BIG-IP^® device version 12.0 or later, or create one on a BIG-IQ^® system using the Network Security Policy Editor and then deploy it to a BIG-IP device version 12.0 or later.

A service policy contains a timer policy, also known as a firewall idle timer, which contains timer rules that can be associated with firewall contexts and rules. A service policy can be applied to the global, self IP address, or route domain context. It can also be added to a rule in a rule list, or a rule on a security policy. Service policies and timer policies are created separately, and then the timer policies are added to service policies.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then in the list on the left, click Timer Policies.
4. Click Create.
   The Timer Policies - New Item screen opens.
5. In the Name field, type a name for the timer policy.
6. In the Description field, type an optional description for the timer policy.
7. If needed, change the default Common partition in the Partition field.
8. To add timer rules, click the Timer Rules tab and click Create Timer Rule.
   A new rule is displayed with default name and values.
9. Click the name of the new rule to enable editing for the rule fields.
10. In the Name field, you may specify a more meaningful name than the default.
11. From the Protocol list, select the protocol to be used. Select all-other as the protocol to have the rule apply to all other protocols not specified in another timer rule in the policy.
12. From the Destination Ports list, specify the one or more ports to use, if necessary. The default is to use any port.
    • Select Port to specify an individual port: type the port in the field provided, and then click +. You can enter multiple individual ports, one at a time.

      Enter 0 as the port value to specify all other ports that have not been specified using Port or Port Range.

    • Select Port Range to specify a range of ports: type the beginning port in the first field, and the ending port of the range in the second field provided, and then click +. You can enter multiple ports ranges, one at a time.
    • Select All Other to specify all other ports that have not been specified using Port or Port Range.
13. From the Idle Timeout list, select the timeout option for the selected protocol.
    • Select Specify to specify the timeout for this protocol, in seconds. Type the number of seconds in the field provided.
    • Select Immediate to immediately apply this timeout to the protocol.
    • Select Indefinite to specify that this protocol never times out.
    • Select Unspecified to specify no timeout for the protocol. When this is selected, the system uses the default timeout for the protocol.
14. Save your changes in one of two ways:
    • Click Save to save the timer policy rule.
    • Click Save & Close to save the timer policy rule and return to the Timer Policies screen.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then in the list on the left click Service Policies.
4. Click Create.
   The Service Policies - New Item screen opens.
5. In the Name field type a name for the service policy.
6. If needed, change the default Common partition in the Partition field.
7. In the Description field, type an optional description for the service policy.
8. Select a timer policy from those listed in the Timer Policy list.
   If no timer policy is listed, you need to create one and then assign it to the service policy.
9. In the Pin Policy to Device(s) area, select the BIG-IP devices to be pinned to this policy, if needed. Pinning a BIG-IP device to a policy enables the policy to be deployed even if it is not associated with a firewall context for that device. You select the BIG-IP device to use by moving it from the Available list to the Selected list using the arrow buttons. You can filter the list of available BIG-IP devices using the filter field at the top of the Available list. Moving a BIG-IP device that is part of a cluster to the Selected list will cause the other member of the cluster to move to that list as well.
   If you have a self IP context with a static (non-floating) IP address, you may be required to assign the device depending on you cluster deployment settings. For example, this property must be set for a peer BIG-IP device that is part of a DSC cluster managed by the BIG-IQ system. You may be directed to set this property as a result of an evaluation critical error.
10. Save your changes in one of two ways:
    • Click Save to save the service policy.
    • Click Save & Close to save the service policy and return to the Service Policies screen.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor.
4. Display the list of rules from a rule list or from a firewall security policy in the policy editor.

   Option	Description
   If the rule is in a rule list:	On the left, click Rule Lists, and then click the name of the rule list containing the rule. The rules are listed on the Rules tab.
   If the rule is associated with a policy:	On the left, click Firewall Policies, and then click the name of the policy containing the rule. The rules are listed on the Rules & Rule Lists tab.

5. To make it editable, click the name of the rule to which you want to add the service policy.
6. Add the service policy to the rule.

   Option	Description
   Add the service policy by typing.	Type the name of the service policy in the Service Policy column for the rule. The system completes name of the service policy once you begin typing the name.
   Add the service policy by drag and drop.	In the Shared Resources area, select Service Policies, and then drag the service policy from that list and drop it into the Service Policy column for the rule.

7. Save your changes in one of two ways:
   • Click Save to save your changes and still be able to edit.
   • Click Close to save your changes and stop editing.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then from the list on the left, click Global .
4. Click the name of the global context to open it for editing.
5. Add the service policy to the Service Policy row:
   1. Click Add Service Policy.
   2. From the popup screen select the service policy to add.
   3. Click Select.
   You can also add a service policy by selecting Service Policies in the Shared Resources list, and then dragging one of the displayed service policies and dropping it onto the Service Policy row. To remove a service policy, click the X to the right of the service policy name in the Service Policy row.
6. Save your changes in one of two ways:
   • Click Save to save the global context.
   • Click Save & Close to save the global context and return to the Global page.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor and then Route Domain from the list on the left.
   If the Route Domain context is not displayed, click Contexts in the list to expand the list of contexts and display it.
4. Click the name of the route domain to open it for editing.
5. Add the service policy to the Service Policy row:
   1. Click Add Service Policy.
   2. From the popup screen select the service policy to add.
   3. Click Select.
   You can also add a service policy by selecting Service Policies in the Shared Resources list, and then dragging one of the displayed service policies onto the Service Policy row. To remove a service policy, click the X to the right of the service policy name in the Service Policy row.
6. Save your changes in one of two ways:
   • Click Save to save the route domain context.
   • Click Save & Close to save the route domain context and return to the Route Domain page.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then in the list on the left click Self IP.
4. Click the name of the self IP address to open it for editing.
5. Add the service policy to the Service Policy row:
   1. Click Add Service Policy.
   2. From the popup screen select the service policy to add.
   3. Click Select.
   You can also add a service policy by selecting Service Policies in the Shared Resources list, and then drag one of the displayed service policies and drop it onto the Service Policy row. To remove a service policy, click the X to the right of the service policy name in the Service Policy row.
6. Save your changes in one of two ways:
   • Click Save to save the self IP address context.
   • Click Save & Close to save the self IP address context and return to the Self IP screen.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then in the list on the left, click Timer Policies.
4. Select the check box to the left of any timer policy that you want to remove.
5. Click Delete.
6. Confirm that you want to remove the timer policy by clicking Delete in the confirmation dialog box.

1. Log in to the BIG-IQ^® system with your user name and password.
2. At the top left of the screen, select Network Security from the BIG-IQ menu.
3. Click Policy Editor, and then in the list on the left click Service Policies.
4. Select the check box to the left of any service policy you want to remove.
5. Click Delete.
6. Confirm that you want to remove the service policy by clicking Delete in the confirmation dialog box.