F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IQ Security
  4. BIG-IQ Security: Administration
  5. Managing Firewall Policies in BIG-IQ Network Security
Manual Chapter : Managing Firewall Policies in BIG-IQ Network Security

Applies To:

Show Versions Show Versions

BIG-IQ Security

  • 4.5.0
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

About firewall policies in BIG-IQ Network Security

A firewall policy is a set of rules and/or rule lists. BIG-IP network firewalls use policies to specify traffic-handling actions and to define the parameters for filtering network traffic. You can assign inline rules, rule lists, or a policy to a firewall. Policies facilitate the assigning of a common collection of rules consistently across multiple firewalls.

The network software compares IP packets to the criteria specified in policies. If a packet matches the criteria, then the system takes the action specified by the policy. If a packet does not match any rule in the policy, the software accepts the packet or passes it to the next policy, rule, or rule list.

In BIG-IQ Network Security, the Policies list displays the policies available for assignment to firewalls.

You can configure firewall policies as enforced or staged:

  • An enforced policy refers to a policy whose actions are executed. Actions include: accept, accept decisively, drop, and reject.

    You are restricted to assigning a single, enforced policy on any specific firewall. If you have an enforced policy on a firewall, you cannot also have inline rules and rule lists on that firewall.

  • A staged policy refers to a policy that is evaluated but policy actions are not enforced. All activity is logged.

    You are restricted to assigning a single, staged policy on any specific firewall. You can have inline rules and rule lists assigned to a firewall (in the enforced area) and have a configured staged policy on that firewall. You cannot have inline rules/rule lists in the staged area.

Thus, you can stage a firewall policy first and then examine logs to determine how the policy has affected traffic. Then you can determine the timing for turning the policy from staged to enforced.

Firewall policies can contain any combination of rules and rule lists. Policies cannot contain other policies. You can re-order rules within a policy.

Note: The BIG-IQ Network Security system is aware of functionality implemented in one BIG-IP version but not in another. In terms of firewall policies, this means that you are prohibited from dropping a policy onto a firewall on a BIG-IP device that does not have the software version required to support it.

Filtering policies

To filter the system interface to display only those objects related to a selected policy, hover over the policy name, right-click and then click Filter 'related to'. The interface is filtered and a count appears to the right of each object type. The frame to the right provides its own filter field where you can enter text and click on the filter icon to constrain the display to those items that match the filter.

Adding firewall policies

To fine tune your network firewalls, you can configure policies and assign them to firewalls using the Policies screen Rules & Rule Lists settings.
  1. In the screen header, below Network Security, click Object Editor.
  2. On the left, hover over Policies and click the + icon to open the New Policy screen.
  3. Click Properties and complete the properties fields as required. All boxes outlined in gold are required fields.
    Option Description
    Name User-provided name for the policy. This field is editable when creating or cloning a policy, and read-only when editing a policy.
    Description Optional description for the policy.
    Partition Although it is pre-populated with Common (default), you can set the partition when creating or cloning policies by typing a unique partition name.
    Note: The partition with that name must already exist on the BIG-IP device.
    No whitespace is allowed in the partition name. No editing of the partition is allowed.
  4. Click Rules & Rule Lists, and then click either:
    • Create Rule to createg rules.
    • Add Rule List to add rule lists.
  5. When finished, click Add.
A new policy is added under Policies in the left pane, in the correct order alphabetically.

You can drag-and-drop a policy to add it to a firewall. To configure the same policy consistently across many firewalls, drag-and-drop the policy to multiple firewalls.

Managing firewall policies

To fine tune your network firewalls, you can edit policies, create/edit rules, and add rule lists. You can also reorder rules in firewall policies. You cannot edit rule lists or reorder rules within rule lists.

  1. In the screen header, below Network Security, click Object Editor.
  2. Expand Policies.
  3. Click the policy you want to edit.
  4. Click Edit to lock the policy while you work on it.
  5. Select Properties. The only editable field is the (optional) description.
  6. Click Rules & Rule Lists, and edit the existing rule list or click either:
    • Create Rule to add rules.
    • Add Rule List to add rule lists.
  7. Click Save to save your changes.
  8. When you are finished, click Save and Close to save your edits, clear the lock, and exit.
The edited firewall policy appears under Policies in the left pane, in the correct order alphabetically.

You can then drag-and-drop a policy to add it to a firewall. To configure the same policy consistently across many firewalls, drag-and-drop the policy to multiple firewalls.

Cloning firewall policies

Cloning creates an exact copy with a different name. It enables you to quickly and easily create policies tailored to address any unique aspects of your network firewall environment. When you clone a firewall policy, you create an exact copy of the policy which you can then edit to address any special considerations.

Users with the roles of Network_Security_View or Network_Security_Deploy cannot clone policies.

  1. In the screen header, below Network Security, click Object Editor.
  2. Expand Policies.
  3. Click the policy you want to clone.
  4. Click Clone.
  5. Click Properties and complete the properties fields as required. All boxes outlined in gold are required fields.
    Option Description
    Name User-provided name for the policy. This field is editable when creating or cloning a policy, and read-only when editing a policy.
    Description Optional description for the policy.
    Partition Although it is pre-populated with Common (default), you can set the partition when creating or cloning policies by typing a unique partition name.
    Note: The partition with that name must already exist on the BIG-IP device.
    No whitespace is allowed in the partition name. No editing of the partition is allowed.
  6. Click Rules & Rule Lists, and then click either:
    • Create Rule to createg rules.
    • Add Rule List to add rule lists.
  7. When finished, click Add. If you then click Cancel, the policy is not cloned.
The cloned policy appears in Policies in the correct order alphabetically. In an HA configuration, the cloned policy appears on the standby BIG-IQ system as soon as it is saved.

Reordering rules in firewall policies

Using the Policies screen, you can reorder rules in firewall policies to optimize your network firewall policies. You cannot edit rule lists or reorder rules inside rule lists.
  1. In the screen header, below Network Security, click Object Editor.
  2. Click the policy you want to edit.
  3. Click Edit to lock the policy while you work on it.
  4. Click Rules & Rule Lists.
  5. To reorder rule lists or rules, simply drag-and-drop them until they are in the correct order. You can also right-click a rule name and select among the ordering options.
  6. Click Save to save your changes.
  7. When you are finished, click Save and Close to save your edits, clear the lock, and exit.

Removing firewall policies

You can remove firewall policies to keep network firewalls up-to-date.

If a firewall policy is in use or if any objects inside that policy are in use, you cannot remove it.

To see where a policy is used, click the policy and the name appears in the Filter field. Then, click Apply. The system interface filters on that policy name and displays only the instances where the policy is used.

  1. In the screen header, below Network Security, click Object Editor.
  2. Click the policy you want to remove.
  3. Click Remove and then confirm the permanent removal in the popup dialog box.
The policy is permanently removed and the panel is closed.

About managing firewall policies using snapshots

It is possible to introduce errors during the editing of the working-configuration set. In some cases, you might not detect these errors immediately. When you discover these errors, you might want to roll back to a previous state as quickly as possible to restore service. Then, you can triage to discover the root causes of any errors.

In one scenario, you might perform multiple emergency deployments in an attempt to fix a problem. If such attempts did not fix the issue, you might want to roll back to the most stable state prior to where you first saw the problem.

In another scenario, you might want to roll back after importing a device. For example, an administrator might import a device and as part of the import process, decide to overwrite the objects stored in the BIG-IQ database. Subsequently, the administrator decides that the import was a mistake and wants to roll back to the state of the objects before the import.

You can address all of these scenarios by restoring from a snapshot.

BIG-IQ Network Security provides the ability to create snapshots in these ways:

  • During discovery, BIG-IQ Network Security takes a snapshot of the working-configuration set on the device. This is the default behavior (retain the check box selection).
  • During a restore operation, you can take a snapshot of the working-configuration set on the device before the restore. This is the default behavior (retain the check box selection).
  • During deployment, BIG-IQ Network Security takes a snapshot when you click Evaluate.
  • At any time, you can create a user-defined snapshot from the Add Snapshot panel.
Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information