Applies To:
Show Versions
BIG-IQ Security
- 4.5.0
About objects in BIG-IQ Network Security
In BIG-IQ Network Security, the objects that you can view and manage include:
- Contexts (firewall)
- Category of object to which a rule applies. In this case, category refers to Global, Route Domain, Virtual Server, Self IP, or Management. Within each context, rules can be viewed and reorganized separately. It is possible to have multiple layers of firewalls on a single BIG-IP device. These layers constitute the firewall hierarchy. Within the firewall hierarchy, rules progress from Global, to Route Domain, and then to either Virtual Server or Self IP.
- Policies (firewall)
- Set of rules and/or rule lists that specify traffic-handling actions and define the parameters for filtering network traffic. You can assign inline rules, rule lists, or a policy to a firewall. Policies facilitate the assigning of a common collection of rules consistently across multiple firewalls.
- Rule lists
- Containers for rules; rules are run in the order they appear in their assigned rule list. A rule list can contain thousands of ordered rules, but cannot be nested inside another rule list.
- Address lists
- Collections of IPv4 or IPv6 addresses, address ranges, and subnets. These collections are saved on a server and used by policies, rule lists, and rules to allow or deny access to specific IP addresses in IP packets. Firewall rules compare all addresses or address ranges in a given address list to either the source or the destination IP address, depending on how the list is applied. If there is a match, the rule takes an action, such as accepting or dropping the packet.
- Port lists
- Collections of ports and port ranges. These collections are saved on a server and used by policies, rule lists, and rules to allow or deny access to specific IP addresses in IP packets. As with address lists, firewall rules compare all ports and port ranges in a given port list to either the source or the destination port, depending on how the list is applied. If there is a match, the rule takes an action, such as accepting or dropping the packet.
- Schedules
- Schedules are assigned to firewall rules, rule lists, and policies to control when rules, rule lists, and policies are active on the firewall. In the Shared Objects panel, you can hover over schedule names to see the name displayed in a tooltip. This feature is useful if the schedule name is longer than the panel.
About the policy editor in BIG-IQ Network Security
BIG-IQ Network Security provides users with an editor that enables the ability to respond rapidly to firewall configuration change requests. The Policy Editor optimizes the use of screen real estate for firewall rule editing workflows. Information is presented on the screen so that relevant objects are more readily available for rule editing workflows.
Adding new objects
Hover over the header of the object you want to add (Policies, Rule Lists, Address Lists, Port Lists, or Schedules) and when the + icon appears, click it to open a frame for adding the object.
Viewing and editing objects
To view and/or edit objects:
- Click the object type to expand it and display the list of individual objects.
- Click the name of the object you want to view or edit. The object details are then displayed in the frame to the right. Help for that object type is then available by clicking the ? in the upper right corner. The help includes instructions for cloning, editing, and removing the object.
Filtering in the Objects panel
You can filter the contents of panels within the Policy Editor frame to reduce the set of data that is visible in the system interface. Filtering techniques can be important for troubleshooting.
- In the filter text field (under Objects), type the text you want to filter on and
press Enter.
Filtering works by performing a wildcard search of the underlying JSON, not just the name of the object. For example, if you type a 1 (the number one) in the filter, the system will display any object with a 1 in its JSON.
You can clear the filter field by clicking the X to the right of the text under the filter field.
Objects are filtered on the text entered and a count for each appears to the right of each object type.
Adding objects
Editing objects
Filtering the Policy Editor frame
You can filter the contents of panels within the Policy Editor frame to reduce the set of data that is visible in the system interface. Filtering techniques can be important for troubleshooting.
Adding objects to firewall contexts and rules
About the toolbox in BIG-IQ Network Security
BIG-IQ Network Security provides users with a toolbox that can be used to quickly add objects. The toolbox is located in the bottom half of the Policy Editor frame.
Adding new objects
To add an object quickly, select the object type from the dropdown list and click Add. Fill in the properties that appear in the popup box and click Add.
Filtering in the toolbox
You can filter the contents of panels within the Policy Editor frame to reduce the set of data that is visible in the system interface. Filtering techniques can be important for troubleshooting.
- In the filter text field, type the text you want to filter on and click the filter
icon.
Filtering works by performing a wildcard search of the underlying JSON, not just the name of the object. For example, if you type a 1 (the number one) in the filter, the system will display any object with a 1 in its JSON.
You can clear the filter field by clicking the red X to the left of the filter field.
Renaming objects
As an alternative to renaming it, you can create a new object and replace the original object where it is in use.
Cloning objects
About address lists
Address lists are collections of IPv4 or IPv6 addresses, address ranges, nested address lists, or subnets saved on a server and available for use in firewall rules, rule lists, and policies.
Firewall rules refer to address lists to allow or deny access to specific IP addresses in IP packets. Firewall rules compare all addresses from the list to either the source or the destination IP address (in IP packets), depending on how the list is applied. If there is a match, the rule takes an action, such as accepting or dropping the packet.
Where address lists are visible in the screens for Firewall Contexts, Policies, and Rule Lists, you can hover over nested address lists to see the first-level content displayed in a tooltip. The content (addresses, ranges, and nested address lists) is displayed whether or not the address list is locked for editing.
If a policy, rule list, or rule is locked for editing, you can right-click an address, address range, or address list in the locked object and remove that address, address range, or address list.
To view address list names that are longer than the display field, hover over the name to see the full name displayed in the tooltip.
You can add geolocation awareness to address lists, which enables you to specify source or destination IP addresses by geographic location. Thus, you can specify firewall behavior for traffic to/from entire geographic regions by defining rules based on where the source or destination system is, rather than on its IP address (source or destination). BIG-IQ Network Security supports specifying geolocation in rules and address lists. The geolocation is validated when the rule or address list is saved.
Adding address types to address lists
Removing entries from address lists
- Navigate to the Address Lists area.
- Click Address Lists to expand the section, and then click the address list that you want to edit.
- In the resulting screen, click Edit to lock the object.
- Click the X icon to the right of the address, address range, address list, or geolocation spec that you want to remove.
- When you are finished, click Save to save your edits, or click Save and Close to save and release the lock.
Address list properties and addresses
About port lists
Port lists are collections of ports, port ranges, or port lists saved on a server and available for use in firewall rules, rule lists, and policies.
Firewall rules refer to port lists to allow or deny access to specific ports in IP packets. They compare a packet's source port and/or destination port with the ports in a port list. If there is a match, the rule takes an action, such as accepting or dropping the packet.
Port lists are containers and must contain at least one entry. You cannot create an empty port list; you cannot remove an entry in a port list if it is the only one.
Where port lists are visible in the screens for Firewall Contexts, Policies, and Rule Lists, you can hover over port lists to see the first-level content displayed in a tooltip. The content is displayed whether or not the port list is locked for editing.
If a policy, rule list, or rule is locked for editing, you can right-click a port, port range, or port list in the locked object and remove that port, port range, or port list.
To view port list names that are longer than the display field, hover over the name to see the full name displayed in the tooltip.
Adding port types to port lists
Removing entries from port lists
- Navigate to the port list that you want to remove an entry from.
- Click Port Lists to expand the section, and then click the port list that you want to edit.
- In the resulting screen, click Edit to lock the object.
- Click the X icon to the right of the port, port range, or port list that you want to remove.
- When you are finished, click Save to save your edits, or click Save and Close to save and release the lock.
Port list properties and ports
Property | Description |
---|---|
Name | Unique name used to identify the port list. |
Description | Optional description for the port list. |
Partition | Field pre-populated with Common (the default). This field is editable when creating or cloning port lists. |
Type | After locking the port list for editing, select one of the following:
|
Ports | Port, port range, or port list. Valid port numbers are 1-65535. |
Description | Optional text field used to describe the port, port range, or nested port list. |
About schedules
Schedules are assigned to rules, rule lists, and policies to control when these shared objects are actively evaluated.
By default, all rules, rule lists, and policies are on a continuously active schedule. Schedules are continuously active if they are created without any scheduling specifics (such as the hour that the schedule starts). If you apply a schedule to a rule, rule list, or policy, you can reduce the time that the rule, rule list, or policy is active.