In BIG-IQ^® Network Security, a firewall context is a BIG-IP^® network object to which a firewall policy can be attached. In BIG-IQ Network Security, these network objects are called Global (global), Route Domain (rd), Virtual Server (vip), Self IP (sip), or Management (mgmt).

Firewall contexts provide policy-based access control to and from address and port pairs, inside and outside the network. Using a combination of contexts, a firewall can apply rules in a number of different ways, including at a global level, per virtual server, per route domain, and even for the management port or a self IP address.

Firewall properties include the firewall name, an (optional) description, its partition, its type, and its parent device on the partition in which it resides. Note that an administrative partition is a part of the BIG-IP configuration that is accessible only to a particular group of administrators. The default partition for all BIG-IP configurations, /Common, is accessible to all administrators. A sufficiently-privileged administrator can make additional partitions on the BIG-IP device. Each partition corresponds to a folder (with the same name) to hold its configuration objects.

You can use the Policy Editor to view and configure enforced policies or rules whose actions (accept, accept decisively, drop, reject) are in force. You are restricted to a single, enforced policy on any specific firewall. You can edit all other firewall shared objects only from within the object's screen.

A firewall context is the category of object to which a rule applies. In this case, category refers to Global, Route Domain, Virtual Server, Self IP, or Management. Rules can be viewed and reorganized separately within each context.

It is possible to have multiple layers of firewalls on a single BIG-IP^® device. These layers constitute the firewall hierarchy. Within the firewall hierarchy, rules progress from Global, to Route Domain, and then to either Virtual Server or Self IP.

If a packet matches a firewall rule within a given context, that action is applied to the packet, and the packet then moves to the next context for further processing. If the packet is accepted, it travels on to the next context. If the packet is accepted decisively, it goes directly to its destination. If the packet is dropped or rejected, all processing stops for that packet; it travels no further.

On each firewall, you can have rules, rule lists, or policies that are enforced or staged. Rules, rule lists, or policies are processed in order within their context and within the context hierarchy.

Rules for the Management interface are processed separately and not as part of the context hierarchy.

In BIG-IQ^® Network Security, you can add the following firewall policy types:

Enforced

An enforced firewall policy modifies network traffic based on a set of firewall rules.

Staged

A staged firewall policy allows you to evaluate the effect a policy has on traffic without actually modifying the traffic based on the firewall rules.

1. Log in to BIG-IQ^® Network Security.
2. Click Policy Editor.
3. Click Contexts in the list on the left to expand the contents and click one of the context types.
4. Click the name of the context to edit. The context properties are displayed.
5. Click Add Enforced Firewall Policy in the Enforced Firewall Policy row and in the resulting popup, click the policy to use and click Add. Alternatively, drag-and-drop a policy from those listed in the Policy Editor toolbox at the bottom of the page to the Enforced Firewall Policy row.
   Adding an enforced policy results in the removal of all existing rules.
6. Click the name of the enforced policy to display the policy properties.
7. Click Create Rule to add a rule by editing the fields in the template.
   You can also add rules by right-clicking in the last rule in the table and selecting Add rule before or Add rule after. If you right-click after the bottom row in the Rules table, you can select the option Add rule. You can then reorder rules by dragging and dropping them until they are in the correct order for execution. You can also reorder rules by right-clicking in the row and selecting among the ordering options.
8. Add a rule list by clicking Add Rule List.
9. In the popup screen that opens, select the name of the rule list that you want to add and then click Add.
10. Click Save to save changes.
    To clear a lock without saving changes, click the Unlock link.
11. When finished, click Save & Close to save your edits, clear the lock, and exit.

1. Log in to BIG-IQ^® Network Security.
2. Click Policy Editor.
3. Click Contexts in the list on the left to expand the contents and click one of the context types.
4. Click the name of the context to edit. The context properties are displayed.
5. Click Add Staged Firewall Policy in the Staged Firewall Policy row and in the resulting popup, click the policy to use and click Add. Alternatively, drag-and-drop a policy from those listed in the Policy Editor toolbox at the bottom of the page to the Staged Firewall Policy row.
   Adding an enforced policy results in the removal of all existing rules and rule lists.
6. Click Save to save changes.
   To clear a lock without saving changes, click the Unlock link.
7. When finished, click Save & Close to save your edits, clear the lock, and exit.