Applies To:
Show VersionsBIG-IQ Centralized Management
- 5.3.0
About rules and rule lists
Rule lists are containers for rules, which are run in the order they appear in their assigned rule list. A rule list can contain thousands of ordered rules, but cannot be nested inside another rule list. You can reorder rules in a given rule list at any time.
With BIG-IQ® Network Security, you can manage rules and rule lists from the Rule Lists option (Policy Editor > Rule Lists). You can also create rules and add rule lists from the Contexts and the Policies options. You can import and manage rules (and/or rule lists) from BIG-IP® devices. Furthermore, you can define rules and rule lists within BIG-IQ Network Security, and then deploy back to the BIG-IP device.
You can define a list of rules for a specific firewall and/or refer to one or more shared rule lists by name from other firewalls.
Network firewalls use rules and rule lists to specify traffic-handling actions. The network software compares IP packets to the criteria specified in rules. If a packet matches the criteria, then the system takes the action specified by the rule. If a packet does not match any rule from the list, the software accepts the packet or passes it to the next rule or rule list. For example, the system compares the packet to self IP rules if the packet is destined for a network associated with a self IP address that has firewall rules defined.
A packet must pass all tests to match successfully. For example, to match against a source subnet and several destination ports, a packet must originate from the given subnet and also have one of the specified destination ports.
Rules and rule lists can be applied to all firewall types, such as:
- Global
- Route domain
- Virtual server
- Self IP
- Management IP (rules only, no iRule or geolocation support)
Enabling, disabling and scheduling rules and rule lists
Once a rule or a rule list is created, you can set the state of that rule or rule list to enable it, disable it, or schedule when it is enabled. By default, a rule or rule list is enabled. Settings on a rule list take precedence over those on a rule. For example, if a rule has a state of enabled, but is contained within a rule list that has a state of disabled, the rule used in that rule list will be disabled. The process differs for setting the state of a rule and setting the state of a rule list.
- To set the state for a rule, edit the rule and choose enabled, disabled or scheduled in the State column.
- To set the state for a rule list, edit the rule list, and right click the rule list name and select Edit Rule List Reference. The state can now be set by choosing enabled, disabled or scheduled in the State column.
Filtering rule lists
To filter the system interface to display only those objects related to a selected rule list, hover over the rule list name, right-click and then click Filter 'related to'. The interface is filtered and a count appears to the right of each object type. The frame to the right provides its own filter field where you can enter text and click on the filter icon to constrain the display to those items that match the filter.
Creating rules
Reorder rules in rule lists
Removing rules
-
You remove a rule based on the object that you remove it from:
Option Description From a rule list In the left pane, expand Rules Lists and click the name of the rule list containing the rule that you want to delete. This opens the Rule List frame that provides access to Properties and Rules options. From a firewall context In the left pane, expand Contexts, click the name of the context containing the rule that you want to delete. This opens the Properties frame which contains the Enforced Policy row and the Staged Policy row, either of which may contain a policy. Click the policy name containing the rule to delete and then click Rules & Rule Lists. From a policy In the left pane, expand Policies, click the name of the policy containing the rule that you want to delete. The Policy frame opens and provides access to Properties and Rules & Rule Lists options. Select Rules & Rule Lists. - Hover over the row containing the rule, and right-click.
- Select Delete rule and, if prompted, confirm the deletion.
- Click Save to save your changes.
Creating and adding rule lists
Editing rule lists
Clearing fields in rules
- Log in to BIG-IQ® Network Security.
- Click Policy Editor.
- Expand Rule Lists and click the name of a rule list that you want to edit.
- On the left, click Rules to ensure that it is selected.
- Click the name of the rule containing the fields whose contents you want to remove.
-
Not all fields can be cleared, but you can remove the contents of these fields
as follows:
Option Description Address (source or destination) Click the X to the right of the field. Port (source or destination) Click the X to the right of the field. VLAN Click the X to the right of the field. iRule Click the X to the right of the field. Description Click the X to the right of the field. - Click Save to save your changes.
- When you are finished, click Save & Close to save your edits, clear the lock, and exit the panel.
Cloning rule lists
Removing rule lists
Rule properties
This table lists and describes the properties required when you are configuring network firewall rules.
Property | Description |
---|---|
Name | Unique, user-provided name for the rule. If the name is a rule list name, it is preceded by: referenceTo_ when moved to a firewall or policy. For example: referenceTo_sys_self_allow_all. |
Address (Source or Destination) | There are many ways to construct an IPv4 or IPv6 address, address range, or
address list. The following methods and examples are not meant to be exhaustive.
When you are finished, save your work. |
Port (Source or Destination) | Ports, port ranges, or port lists. From the list, select:
When you are finished, save your work. |
VLAN | Name of the VLAN physically present on the device (Internal, External, or Any). If you specify a VLAN in a rule without also specifying the VLAN's partition, the deployment task will fail when you attempt to deploy that rule to a firewall. Use the format partition/VLAN or /partition/VLAN. For example: Common/external or /Common/external. When you are finished, click Save or Add. |
Action | Click in the column and select one of the following:
|
iRule | Click in the column and enter the iRule name, including partition. For example: /Common/_sys_AXX_Support_OA_BasicAuth. You can also set sampling rates on iRules® by supplying a number in the Sampling Rate field. iRules® use syntax based on the industry-standard Tools Command Language (Tcl). For complete and detailed information on iRules syntax, see the F5 Networks DevCentral web site, http://devcentral.f5.com. Note that iRules must conform to standard Tcl grammar rules. For more information on Tcl syntax, see http://tmml.sourceforge.net/doc/tcl/index.html. Note that iRules are not supported on the management IP context. |
Description | Optional description for the current rule. To add a description, click in the column, type text, and click Save or Add. |
Protocol | IP protocol to compare against the packet. Select the appropriate protocol from
the list and click Save or Add. If you
select ICMP, IPv6-ICMP, or
Other, a popup dialog box opens where you can specify
Type and Code combinations. The
default type is Any and the default code is
Any.
Note: The type and code combinations are too numerous to document here. For
details, consult the F5 Networks DevCentral site,
http://devcentral.f5.com or the documentation for the
specific BIG-IP® platform.
|
State | Click in the column and select an option from the list to specify whether the rule is enabled, disabled, or scheduled. The field is updated. Click Save or Add when you are ready to save your changes. If you select scheduled from the list, the Select Schedule list is displayed in the screen. Select a schedule and click OK. If you have assigned a schedule, then a gear icon appears to the right of the State setting in the State column. To make changes to the State setting, click the gear icon to open the Select Schedule popup screen. If you have no pre-defined schedules, you cannot assign the scheduled state to the rule. |
Log | Click in the column and select an option from the list to specify whether or not the firewall software should write a log entry for any packets that match this rule. From the list, select true (log an entry) or false (do not log an entry). When your are finished, click Save or Add. |