Rule lists are containers for rules, which are run in the order they appear in their assigned rule list. A rule list can contain thousands of ordered rules, but cannot be nested inside another rule list. You can reorder rules in a given rule list at any time.

With BIG-IQ Network Security, you can manage rules and rule lists from the Rule Lists option (Object Editor > Rule Lists). You can also create rules and add rule lists from the Contexts and the Polices options. You can import and manage rules (and/or rule lists) from BIG-IP devices. Furthermore, you can define rules and rule lists within BIG-IQ Network Security, and then deploy back to the BIG-IP device.

You can define a list of rules for a specific firewall and/or refer to one or more shared rule lists by name from other firewalls.

Network firewalls use rules and rule lists to specify traffic-handling actions. The network software compares IP packets to the criteria specified in rules. If a packet matches the criteria, then the system takes the action specified by the rule. If a packet does not match any rule from the list, the software accepts the packet or passes it to the next rule or rule list. For example, the system compares the packet to self IP rules if the packet is destined for a network associated with a self IP address that has firewall rules defined.

A packet must pass all tests to match successfully. For example, to match against a source subnet and several destination ports, a packet must originate from the given subnet and also have one of the specified destination ports.

Rules and rule lists can be applied to all firewall types, such as:

• Global
• Route domain
• Virtual server
• Self IP
• Management IP (rules only, no iRule or geolocation support)

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. Select the object that you want to add the rule to:

   Option	Description
   Rule list	In the left pane, hover over Rule Lists and click the + icon to display the New Rule List frame, which provides access to Properties and Rules options.
   Context	In the left pane, expand Contexts and click the name of the specific firewall context to gain access to Properties, Enforced, and Staged options.
   Policy	In the left pane, hover over Policies, and click the + icon to display New Policy frame, which provides access to Properties and Rules & Rule Lists options.

4. Click Properties and complete the properties fields as required.

   Option	Description
   Name	Unique name. The field is read-only field unless creating or cloning the rule list.
   Description	Optional description.
   Partition	Although pre-populated with Common (default), you can set the partition name by typing a unique name for the partition. Note: The partition with that name must already exist on the BIG-IP device. No whitespace is allowed in the partition name. The firewall partition itself is not editable.

5. Click Rules or Enforced, and then click Create Rule. A new row appears in the table. The row contains a rule template, including defaults, for the new rule.
6. Complete the fields as appropriate. You can also add rules by right-clicking in the Rules table, or by right-clicking any row in the Rules table and choosing add rule before or add rule after.
7. When you are finished, click Add or Save, as appropriate.

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. Expand Rule Lists and click the specific rule list you want to edit.
4. Click the Rules tab to ensure it is selected.
5. Click Edit to lock for editing.
6. Drag-and-drop the rules until they are in the correct order. If the list of rules expands beyond the editing frame, drag-and-drop will not work. Instead, copy the rule by right-clicking and selecting Copy rule. Then, navigate to the new location for the rule, right-click, and select Paste rule before or Paste rule after as appropriate. After the copy, delete the rule that you copied.
7. When you are finished, click Save and Close to save your edits, clear the lock, and exit the panel.

1. You remove a rule based on the object that you remove it from:

   Option	Description
   From a rule list	In the left pane, expand Rules Lists and click the name of the rule list containing the rule that you want to delete. This opens the Rule List frame that provides access to Propertiesand Rules options.
   From a firewall context	In the left pane, expand Contexts, click the name of the context containing the rule that you want to delete.This opens the Properties frame and provides access to Properties, Enforced and Staged options. Then, select Enforced or Staged as appropriate.
   From a policy	In the left pane, expand Policies, click the name of the policy containing the rule that you want to delete. The Policy frame opens and provides access to Properties and Rules & Rule Lists options. Select Rules & Rule Lists.

2. Click Edit to lock for editing.
3. Hover over the row containing the rule, and right-click.
4. Select Delete Rule and confirm the deletion.
5. Click Save to save your changes.

1. Click Object Editor.
2. Select the object that you want to add the rule list to:

   Option	Description
   Rule list	In the left pane, hover over Rule Lists and click the + icon to display the New Rule List frame, which provides access to Properties and Rules options.
   Context	In the left pane, expand Contexts and click the name of the specific firewall context to gain access to Properties, Enforced, and Staged options.
   Policy	In the left pane, hover over Policies, and click the + icon to display New Policy frame, which provides access to Properties and Rules & Rule Lists options.

3. Click Properties and complete the properties fields as required.

   Option	Description
   Name	Unique name. The field is read-only field unless creating or cloning the rule list.
   Description	Optional description.
   Partition	Although pre-populated with Common (default), you can set the partition name by typing a unique name for the partition. Note: The partition with that name must already exist on the BIG-IP device. No whitespace is allowed in the partition name. The firewall partition itself is not editable.

4. Continue with the configuration:

   Option	Description
   New Rule List screen	Click Rules, and click Create Rule.
   Firewall context	Click Enforced, and click Edit to lock the firewall for editing. Then, click Add Rule List and select from the rule lists that appear in the popup dialog.
   Policy	Click Rules & Rule Lists, then click Add Rule List.

5. Complete the fields as appropriate. You can also add rules by right-clicking in the Rules table, or by right-clicking any row in the Rules table and choosing add rule before or add rule after.
6. When you are finished, click Add or Save, as appropriate.
7. If you are editing a firewall context to add the rule list, you must, when finished, click Save and Close to save your edits, clear the lock, and exit the panel.

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. Expand Rule Lists and click the specific rule list you want to edit.
4. Click Edit to lock for editing.
5. Click Properties.

   Option	Description
   Name	Informational, read-only field set when creating or cloning the rule list.
   Description	Optional description.
   Partition	Informational, read-only field set when creating or cloning the rule list.

6. Select Rules , and click the row of the rule you want to edit.
7. Complete the fields as appropriate. You can also add rules by right-clicking in the Rules table, or by right-clicking any row in the Rules table and choosing add rule before or add rule after.
8. Complete fields as appropriate. To reorder rules, simply drag-and-drop the rules until they are in the correct order. If the list of rules expands beyond the editing frame, drag-and-drop will not work. Instead, copy the rule by right-clicking and selecting Copy rule. Then, navigate to the new location for the rule, right-click, and select Paste rule before or Paste rule after as appropriate. After the copy, delete the rule that you copied.
9. Click Save to save your changes.

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. Expand Rule Lists and click the name of a rule list that you want to edit.
4. Click Edit to lock for editing.
5. Click the Rules tab to ensure it is selected.
6. Locate the rule containing the fields whose contents you want to remove.
7. Not all fields can be cleared, but you can remove the contents of these fields as follows:

   Option	Description
   Address (source or destination)	Hover over the text in the field. Right-click and select Remove item.
   Port (source or destination)	Hover over the text in the field. Right-click and select Remove item.
   VLAN	Hover over the text in the field. Right-click and select Remove item.
   iRule	Hover over the text in the field. Right-click and select Remove item.
   Description	Hover over the text in the field. Right-click and select Remove item.

8. Click Save to save your changes.
9. When you are finished, click Save and Close to save your edits, clear the lock, and exit the panel.

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. Expand Rule Lists and click the specific rule list you want to clone.
4. Click Clone.
5. Click Properties and complete the properties fields as required.

   Option	Description
   Name	Unique name. The field is read-only field unless creating or cloning the rule list.
   Description	Optional description.
   Partition	Although pre-populated with Common (default), you can set the partition name by typing a unique name for the partition. Note: The partition with that name must already exist on the BIG-IP device. No whitespace is allowed in the partition name. The firewall partition itself is not editable.

6. Click Rules, edit the rules as required to configure the clone. You can also click Create Rule to add a new rule.
7. When you are finished, click Add. If you click Cancel, the rule list is not cloned.

1. Log in to BIG-IQ Network Security.
2. Click Object Editor.
3. In the left pane, expand Rule Lists, and click the list that you want to remove.
4. At the top of the screen, click Remove.
5. If it is safe to remove the rule list, a confirmation dialog box opens; click Remove to confirm. If the rule list is in use, you cannot complete the removal. A popup screen opens informing you that you cannot remove the rule list because it is in use. Click Close to acknowledge this message, and then click Cancel in the Remove popup screen. To see where a rule list is used, click the rule list and the name appears in the search field. Then click Apply. The system interface displays only those objects related to the search. To clear the search, click the x icon to the right of the search string.

The following table lists and describes the properties required when configuring network firewall rules.