{"id":902,"date":"2015-02-23T23:59:28","date_gmt":"2015-02-23T23:59:28","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2015\/02\/23\/bigip-advanced-firewall-manager-afm\/"},"modified":"2021-08-01T20:05:29","modified_gmt":"2021-08-01T20:05:29","slug":"bigip-advanced-firewall-manager-afm","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html","title":{"rendered":"BIGIP &#8211; Advanced Firewall Manager (AFM)"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-662ef6b687006\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-662ef6b687006\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#What_is_AFM\" title=\"What is AFM ?\">What is AFM ?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Contexts\" title=\"Contexts\">Contexts<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Actions\" title=\"Actions\">Actions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Processing_Order\" title=\"Processing Order\">Processing Order<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Network_Firewall\" title=\"Network Firewall\">Network Firewall<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Security_Protocols\" title=\"Security Protocols\">Security Protocols<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#DoS_Protection\" title=\"DoS Protection\">DoS Protection<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#DoS_Profiles\" title=\"DoS Profiles\">DoS Profiles<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Device_Configuration\" title=\"Device Configuration\">Device Configuration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#White_Lists\" title=\"White Lists\">White Lists<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Logging\" title=\"Logging\">Logging<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Commands\" title=\"Commands\">Commands<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Caveats\" title=\"Caveats\">Caveats<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\/#Links_References\" title=\"Links \/ References\">Links \/ References<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_is_AFM\"><\/span>What is AFM ?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling along with reporting and DoS protection.<\/p>\n<p>Within this article we will look at AFMs key components and also how it processes traffic.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Contexts\"><\/span>Contexts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A context defines the scope of a firewall rule. In other words the category of object to which the rule applies. In total there are 6 contexts. They are,<\/p>\n<ul>\n<li>Global<\/li>\n<li>Route Domain<\/li>\n<li>Virtual Server<\/li>\n<li>Self IP<\/li>\n<li>Management IP<\/li>\n<li>Global Drop<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Actions\"><\/span>Actions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>When creating rules there are 4 main actions. However depending on the context the actions differ. The 4 actions are :<\/p>\n<ul>\n<li><strong>Accept<\/strong> &#8211; The packet is allowed to pass the rule, and is then passed to the next context for processing.<\/li>\n<li><strong>Drop<\/strong> &#8211; The packet is silently dropped.<\/li>\n<li><strong>Reject<\/strong> &#8211; A RST is sent back to the client if TCP is used. Otherwise an ICMP unreachable is sent.<\/li>\n<li><strong>Accept Decisively<\/strong> &#8211; The packet is permitted i.e no further context processing is performed.<\/li>\n<\/ul>\n<p>Each of the contexts allow for the actions <strong>Accept, Drop<\/strong> and <strong>Reject<\/strong>. However the Global and Route Domain contexts also include the <strong>Accept Decisively<\/strong> action.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Processing_Order\"><\/span>Processing Order<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>To understand the processing order there are some key points you must be aware of,<\/p>\n<ul>\n<li><strong>Each context<\/strong> has a order of preference when a packet is processed by the AFM.<\/li>\n<li>There are <strong>2 Deployment modes<\/strong>. This is configured via the &#8216;Default Firewall Action&#8217; option within &#8216;Security \/ Options \/ Network Firewall&#8217;.\u00a0 The settings are shown below,\n<ul>\n<li><strong>ADC<\/strong> &#8211; Virtual Server &amp; Self IP Contexts = Accept ; Global Context = Drop (Default)<\/li>\n<li><strong>Firewall<\/strong> &#8211; Virtual Server &amp; Self IP Contexts = Drop or Reject ; Global Context = Drop<\/li>\n<\/ul>\n<\/li>\n<li>The<strong> Global Context action<\/strong> is not configurable.<\/li>\n<li>If a packet <strong>hits a context<\/strong> with an action of Accept, the packet is then passed onto the next context and negates the Global Drop context.<\/li>\n<li>If a packet <strong>hits the Global or Route Domain context<\/strong> with an action of Accept Decisively the packet negates any further processing and is sent onto the destination.<\/li>\n<li>The <strong>Management IP context<\/strong> is processed independently of the other contexts including the Global and Global Drop contexts.<\/li>\n<\/ul>\n<p><picture><source srcset=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2.avif 876w,https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-300x156.avif 300w,https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-768x400.avif 768w\" sizes=\"(max-width: 876px) 100vw, 876px\" type=\"image\/avif\"><source srcset=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2.webp 876w,https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-300x156.webp 300w,https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-768x400.webp 768w\" sizes=\"(max-width: 876px) 100vw, 876px\" type=\"image\/webp\"><img src=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2.png\" height=\"456\" width=\"876\" srcset=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2.png 876w, https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-300x156.png 300w, https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_AFM-Contexts-Processing_2-768x400.png 768w\" sizes=\"(max-width: 876px) 100vw, 876px\" class=\" size-full wp-image-901 sp-no-webp\" alt=\"AFM-Contexts-Processing 2\" loading=\"lazy\" decoding=\"async\" style=\"display: block; margin-left: auto; margin-right: auto;\"  > <\/picture><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Network_Firewall\"><\/span>Network Firewall<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The AFM&#8217;s key feature is its ability to act as a network based (stateful) firewall. In order to understand the various options available we will describe the functions and key components within the AFM Network Firewall.<\/p>\n<ul>\n<li><strong>Active Rules \/ Policies<\/strong> &#8211; To permit or deny traffic you can either use Active Rules or Policies. Below shows the differences,\n<ul>\n<li><strong>Active Rules<\/strong> &#8211; Can be assigned across all contexts.<\/li>\n<li><strong>Policies<\/strong> &#8211; Can be assigned across all contexts. However Policies can also be assigned to a Virtual Server and applied in staging mode only (i.e do not perform an action only log).<\/li>\n<\/ul>\n<\/li>\n<li><strong>Rule Lists<\/strong> &#8211; A Rule list, as the name suggests. Is a collection of rules.<\/li>\n<li><strong>IP Intelligence<\/strong> &#8211; IP Intelligence allows you block traffic based on an IP black list. This list is retrieved either directly from F5 (an additional license is required) or you can use your own custom feed.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Security_Protocols\"><\/span>Security Protocols<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Where as the Network Firewall allows you to block (or permit traffic) at the transport layer (i.e layer 4). Security protocols allow you block traffic based on certain conditions within the protocol itself. There are 2 protocols that can be configured. They are,\u00a0 DNS and HTTP.<\/p>\n<p>To configure &#8216;Security Profiles&#8217; a security profile is configured which is then assigned to the Virtual Server.\u00a0 Here are the steps,<\/p>\n<ul>\n<li>Create a &#8216;Security Profile&#8217; via &#8216;Security \/ Security Protocols \/ DNS or HTTP&#8217;.\n<ul>\n<li><strong>HTTP<\/strong> &#8211; Within the Virtual Server. Assign the Security Profile within the Security tab.<\/li>\n<li><strong>DNS<\/strong> &#8211; Create a DNS. Enable DNS Security and assign the Security Profile within this profile. Assign the DNS profile to the Virtual Server.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"DoS_Protection\"><\/span>DoS Protection<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>DoS Protection can both alert and block network based attacks. Within DoS Protection there are 3 key components &#8211; DoS Profiles, Device Configuration and White Lists.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DoS_Profiles\"><\/span>DoS Profiles<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DoS Profiles act to only alert should the thresholds within the DoS Profile be reached. These thresholds can be configured for either DNS or SIP. Once the DoS Profile is configured it is assigned on a per Virtual Server basis from within &#8216;Local Traffic \/ Virtual Servers \/ Virtual Server List \/ Security Profiles \/ DoS Protection Profiles&#8217;.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Device_Configuration\"><\/span>Device Configuration<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>AFM, by default, blocks common network based attacks such as ARP Floods, Fragmentation attacks etc. Within AFM each of these attacks have a set of thresholds that can be adjusted. These thresholds define the point at which the AFM should either alert or block the attack. These thresholds are located within &#8216;Security \/ DoS Protection \/ Device Configuration&#8217;.<\/p>\n<p>The descriptions of the thresholds are shown below,<\/p>\n<ul>\n<li><strong>Detection Threshold PPS<\/strong> &#8211; Defines the threshold (Packets Per Second) for when the AFM detects an attack.<\/li>\n<li><strong>Detection Threshold Percent<\/strong> &#8211; Defines the percentage of &#8216;Detection Threshold PPS&#8217;. Once reached AFM drops all packets exceeding this threshold percentage.<\/li>\n<li><strong>Default Internal Rate Limit<\/strong> &#8211; Defines the total packets per second allowed. Any packets above this are dropped.<\/li>\n<\/ul>\n<p><strong>Single Endpoint Attack<\/strong><\/p>\n<p>Within the DoS Device Configuration there is an option to configure the thresholds for Single EndPoint Attacks. In my opinion these are 2 most useful mitigation options.<\/p>\n<p>The 2 options that can be configured are,<\/p>\n<ul>\n<li><strong>Sweep<\/strong> &#8211; Protects against a sweep attack from a single Source IP.<\/li>\n<li><strong>Flood<\/strong> &#8211; Protects against a flood attack from multiple Source IPs.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"White_Lists\"><\/span>White Lists<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>As the name suggests While Lists provide the ability to negate DoS protection for certain traffic.<br \/>\nWhite lists are applied to all traffic except for traffic tranversing the management interface and can be processed in in either software or hardware. Non ePVA platforms process whitelists in software whereas ePVA platforms process the whitelists in hardware. However because of this hardware implementation there is a maximum limit of 8 white list entries.<\/p>\n<p>To configure a white list goto &#8216;Security \/ DoS Protection \/ White Lists&#8217;<\/p>\n<div dir=\"ltr\">\n<h2><span class=\"ez-toc-section\" id=\"Logging\"><\/span>Logging<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>AFM can be configured to either log locally or to send logs to a remote log server. There are 3 main components to logging. They are,<\/p>\n<ul>\n<li><strong>Logging Profile<\/strong> &#8211; Defines what to log. Configured via &#8216;Security \/ Event Logs \/ Logging Profiles&#8217;<\/li>\n<li><strong>Log Publisher<\/strong> &#8211; Is a container for &#8216;Log Destinations&#8217;, shown below. Configured via &#8216;System \/ Logs \/ Configuration \/ Log Publisher&#8217;<\/li>\n<li><strong>Log Destination<\/strong> &#8211; Defines where to send the logs. Configured via &#8216;System \/ Logs \/ Configuration \/ Log Destination&#8217;<\/li>\n<\/ul>\n<p>In order to configure logging the <strong>Log Destination<\/strong> is assigned to the <strong>Log Publisher<\/strong>. The <strong>Log Publisher<\/strong> is then assigned to a <strong>Logging Profile<\/strong>. This Logging Profile can then be assigned to contexts (i.e Virtual Servers). Otherwise you can simply turn the profile on or off from within a global rule.<\/p>\n<\/div>\n<h2 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Commands\"><\/span>Commands<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table class=\"table\">\n<tbody>\n<tr>\n<td><strong>Command<\/strong><\/td>\n<td><strong>Details<\/strong><\/td>\n<\/tr>\n<tr>\n<td>show security dos device-config all<\/td>\n<td>shows hit counts for dos device configuration<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div dir=\"ltr\"><\/div>\n<div dir=\"ltr\">\n<h2><span class=\"ez-toc-section\" id=\"Caveats\"><\/span>Caveats<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Packet Filters<\/strong> &#8211; In the event of both packet filters and AFM being enabled. Packet filters will be processed first.<\/li>\n<li><strong>iRules<\/strong> &#8211; If an iRule is assigned to a global rule then the rest of the global rule will not be processed.<\/li>\n<\/ul>\n<\/div>\n<h2 dir=\"ltr\"><span class=\"ez-toc-section\" id=\"Links_References\"><\/span>Links \/ References<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<div dir=\"ltr\">AFM Deamons &#8211; <a>https:\/\/support.f5.com\/kb\/en-us\/solutions\/public\/14000\/300\/sol14387.html<\/a><\/div>\n<div dir=\"ltr\">Firewall Rules and Contexts &#8211; <a>https:\/\/support.f5.com\/kb\/en-us\/products\/big-ip-afm\/manuals\/product\/network-firewall-policies-implementations-11-3-0\/2.html<\/a><\/div>\n<div dir=\"ltr\">Sweep and Flood Attacks &#8211;<a href=\"https:\/\/support.f5.com\/kb\/en-us\/products\/big-ip-afm\/manuals\/product\/dns-dos-firewall-implementations-11-5-0\/3.html\">\u00a0 https:\/\/support.f5.com\/kb\/en-us\/products\/big-ip-afm\/manuals\/product\/dns-dos-firewall-implementations-11-5-0\/3.html<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling along with reporting and DoS protection. Within this article we will look at AFMs key components and also how it processes traffic. Contexts A context defines the scope of a firewall rule. &#8230; <a title=\"BIGIP &#8211; Advanced Firewall Manager (AFM)\" class=\"read-more\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\" aria-label=\"Read more about BIGIP &#8211; Advanced Firewall Manager (AFM)\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":900,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>BIGIP - Advanced Firewall Manager (AFM) - Fir3net<\/title>\n<meta name=\"description\" content=\"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BIGIP - Advanced Firewall Manager (AFM) - Fir3net\" \/>\n<meta property=\"og:description\" content=\"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\" \/>\n<meta property=\"og:site_name\" content=\"Fir3net\" \/>\n<meta property=\"article:published_time\" content=\"2015-02-23T23:59:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-01T20:05:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"450\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Rick Donato\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rick Donato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\"},\"author\":{\"name\":\"Rick Donato\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\"},\"headline\":\"BIGIP &#8211; Advanced Firewall Manager (AFM)\",\"datePublished\":\"2015-02-23T23:59:28+00:00\",\"dateModified\":\"2021-08-01T20:05:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\"},\"wordCount\":1210,\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg\",\"articleSection\":[\"F5 Loadbalancers\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\",\"url\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\",\"name\":\"BIGIP - Advanced Firewall Manager (AFM) - Fir3net\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg\",\"datePublished\":\"2015-02-23T23:59:28+00:00\",\"dateModified\":\"2021-08-01T20:05:29+00:00\",\"description\":\"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling\",\"breadcrumb\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg\",\"width\":450,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.fir3net.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Networking\",\"item\":\"https:\/\/www.fir3net.com\/networking\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Loadbalancers\",\"item\":\"https:\/\/www.fir3net.com\/networking\/loadbalancers\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"F5 Loadbalancers\",\"item\":\"https:\/\/www.fir3net.com\/networking\/loadbalancers\/f5-big-ip\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"BIGIP &#8211; Advanced Firewall Manager (AFM)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.fir3net.com\/#website\",\"url\":\"https:\/\/www.fir3net.com\/\",\"name\":\"Fir3net\",\"description\":\"Keeping you in the know\",\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.fir3net.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.fir3net.com\/#organization\",\"name\":\"Fir3net\",\"url\":\"https:\/\/www.fir3net.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"width\":390,\"height\":88,\"caption\":\"Fir3net\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\",\"name\":\"Rick Donato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"caption\":\"Rick Donato\"},\"description\":\"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"BIGIP - Advanced Firewall Manager (AFM) - Fir3net","description":"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html","og_locale":"en_US","og_type":"article","og_title":"BIGIP - Advanced Firewall Manager (AFM) - Fir3net","og_description":"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling","og_url":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html","og_site_name":"Fir3net","article_published_time":"2015-02-23T23:59:28+00:00","article_modified_time":"2021-08-01T20:05:29+00:00","og_image":[{"width":450,"height":450,"url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg","type":"image\/jpeg"}],"author":"Rick Donato","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rick Donato","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#article","isPartOf":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html"},"author":{"name":"Rick Donato","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037"},"headline":"BIGIP &#8211; Advanced Firewall Manager (AFM)","datePublished":"2015-02-23T23:59:28+00:00","dateModified":"2021-08-01T20:05:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html"},"wordCount":1210,"publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"image":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg","articleSection":["F5 Loadbalancers"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html","url":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html","name":"BIGIP - Advanced Firewall Manager (AFM) - Fir3net","isPartOf":{"@id":"https:\/\/www.fir3net.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage"},"image":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg","datePublished":"2015-02-23T23:59:28+00:00","dateModified":"2021-08-01T20:05:29+00:00","description":"What is AFM ? Introduced within 11.3, AFM (Advanced Firewall Manager) is a licensed module for the BIGIP appliance that provides stateful firewalling","breadcrumb":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#primaryimage","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2015\/02\/images_7923497_s.jpg","width":450,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/www.fir3net.com\/Firewalls\/F5-BIG-IP\/bigip-advanced-firewall-manager-afm.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fir3net.com\/"},{"@type":"ListItem","position":2,"name":"Networking","item":"https:\/\/www.fir3net.com\/networking"},{"@type":"ListItem","position":3,"name":"Loadbalancers","item":"https:\/\/www.fir3net.com\/networking\/loadbalancers"},{"@type":"ListItem","position":4,"name":"F5 Loadbalancers","item":"https:\/\/www.fir3net.com\/networking\/loadbalancers\/f5-big-ip"},{"@type":"ListItem","position":5,"name":"BIGIP &#8211; Advanced Firewall Manager (AFM)"}]},{"@type":"WebSite","@id":"https:\/\/www.fir3net.com\/#website","url":"https:\/\/www.fir3net.com\/","name":"Fir3net","description":"Keeping you in the know","publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fir3net.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.fir3net.com\/#organization","name":"Fir3net","url":"https:\/\/www.fir3net.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","width":390,"height":88,"caption":"Fir3net"},"image":{"@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037","name":"Rick Donato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","caption":"Rick Donato"},"description":"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders."}]}},"_links":{"self":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/902"}],"collection":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/comments?post=902"}],"version-history":[{"count":0,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/902\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media\/900"}],"wp:attachment":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media?parent=902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/categories?post=902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/tags?post=902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}