Introduction to F5 BIG-IP Advanced Firewall Manager (AFM)

F5 Big IP Advanced Firewall Manager (AFM) Overview

Key Concepts:

• AFM (Advanced Firewall Manager): F5's high-performance, full proxy network security solution.
• Data Center Firewall: AFM's core function, providing perimeter protection.
• DoS/DDoS Protection: Mitigation of denial-of-service attacks.
• IP Intelligence: Dynamic allow/deny listing based on IP reputation.
• Intrusion Prevention System (IPS): High-performance, customizable IPS integrated within AFM.
• Protocol Inspection: Deep packet inspection for various protocols.
• Stateful Firewall: A firewall that keeps track of the state of network connections.
• Virtual Server Security Profiles: Security configurations applied to virtual servers.

1. Introduction to Big IP AFM

• Big IP AFM is a high-performance, full proxy network security solution designed to protect networks and data centers against incoming threats.
• It features an application-centric design for increased effectiveness against targeted network infrastructure-level attacks.

2. Core Firewall Capabilities

• Layer 3/4 Firewall: Policy-based firewall management with rules, address lists, port lists, and scheduling.
• Geolocation: Ability to create firewall rules based on the geographic location of IP addresses.
• Stale and Redundant Rule Notification: Alerts for inefficient or outdated firewall rules.
• Packet Tester: Tool for testing firewall rule configurations.
• DoS/DDoS Protection:
  • Protection against Layer 2-4 attacks.
  • Rate limiting.
  • Per-virtual server security profiles.
  • DoS allow lists.
  • DoS sweep and flood protection.
  • Automatic thresholds and dynamic signatures.
• IP Intelligence:
  • Dynamic custom deny/allow lists based on the BrightCloud IP reputation database.
  • Dynamic IP shunning.
  • Upstream router notifications.
• Reporting and Logs:
  • Firewall and DoS event logs.
  • Local and remote syslog streaming.
  • Monitoring via SNMP.

3. Data Center Firewall Features

• Perimeter protection.
• Stateful rules.
• Dynamic allow/deny listing with IP intelligence.
• Zone or VIP-based policy.
• High programmability.

4. Intrusion Prevention System (IPS) Integration

• High-performance IPS.
• Highly customizable.
• Consolidation of controls.
• Compliance checking.
• Learning engine.
• High-speed logging.

5. Key Use Cases

• Securing data centers.
• Combining firewall capabilities, DoS mitigation, DNS security, and application IPS.
• Protecting networks against incoming threats on widely deployed protocols.
• Mitigating aggressive volumetric DoS attacks before they reach the data center.
• Enhancing data center visibility with customizable reports and analytics.
• Offering high-speed logging for near real-time traffic visibility.

6. Demonstration of AFM in Action

• Licensing: The AFM module must be licensed and provisioned.
• Resource Provisioning: The "Advanced Firewall" or "AFM" option must be enabled.
• Firewall Policies:
  • Policies consist of rules (e.g., allow, deny).
  • Rules can be enabled, disabled, or scheduled.
  • Schedules allow for time-based rule activation (time of day, days of the week).
  • Protocols can be selected for each rule (TCP, UDP, etc.).
  • Actions: accept, drop, reject, or accept decisively.
  • Protocol inspection policies can be specified.
  • Logging can be enabled.
• Rule Lists: Customizable lists of rules.
• Schedules: Define time-based enforcement policies.
• IP Intelligence: Various categories for dynamic allow/deny listing.
• Protocol Security:
  • Fully customizable options.
  • Customizable blocking pages.
• DoS Protection: Crucial for maintaining firewall health and protecting assets.
• Network Address Translation (NAT): Standard networking functionality.
• Inspection Profiles:
  • Define what is or isn't inspected for different protocols.
  • Focus on HTTP-type attacks.

7. Conclusion

Big IP AFM provides a comprehensive network security solution with advanced firewall capabilities, DoS/DDoS protection, IP intelligence, and IPS integration. It offers granular control over network traffic and customizable security policies to protect data centers and applications from a wide range of threats. The demonstration highlights the flexibility and configurability of AFM through its various features and options.