F5 firewall

Manages F5 firewall rules.

Network Security · F5 firewall

Details

IDF5 firewall
ProviderF5
CategoryNetwork Security
From Version5.0.0
Supported ModulesAgentix XSIAM

README

Use the F5 Firewall integration to manage your F5 firewall rules.

Configure F5 Firewall in Cortex

Parameter Description Required
url URL True
port Port True
credentials Credentials True
advancedLogin Advanced login - set to true to authenticate via LDAP, AD etc False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Create a firewall policy


Creates an F5 firewall policy.

Base Command

f5-create-policy

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

##### Human Readable Output

### f5-create-rule

***
Creates a rule in a specific policy

##### Base Command

`f5-create-rule`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The policy name the rule will be associated with | Required |

##### Context Output

There is no context output for this command.

##### Command Example

Human Readable Output

List all rules for a policy


Lists all the rules of a specific policy

Base Command

f5-list-rules

Input
Argument Name Description Required
policy-name The policy name that the rules displayed are associated with. Required
Context Output

There is no context output for this command.

Command Example

### Modify the rule for a policy

***
Modifies an F5 rule in a specific policy.

##### Base Command

`f5-modify-rule`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The policy name the rule is associated with. | Required |
| rule-name | The rule name to modify. | Required |

##### Context Output

There is no context output for this command.

##### Command Example

Human Readable Output

Delete a rule


Delete an F5 rule.

Base Command

f5-del-rule

Input
Argument Name Description Required
policy-name The policy name the rule is associated with. Required
rule-name The name of the rule to delete. Required
Context Output

There is no context output for this command.

Command Example

### Add a policy to a global policy

***
Adds the specified policy to a global policy.

##### Base Command

`f5-modify-global-policy`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| enforcedPolicy | The new enforced policy to add to the global policy. | Required |

##### Context Output

There is no context output for this command.

##### Command Example

Human Readable Output

Get a global policy


Display global policy.

Base Command

f5-show-global-policy

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

### Delete a policy

***
Deletes a policy.

##### Base Command

`f5-del-policy`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The name of the policy to delete. | Required |

##### Context Output

There is no context output for this command.

##### Command Example

Human Readable Output

Get a list of all user sessions


Lists all the sessions with client IP for the given username.

Base Command

f5-list-all-user-sessions

Input
Argument Name Description Required
resource-ip Client IP address. Required
Context Output

There is no context output for this command.

Command Example

``````

Configuration parameters

  • url — URL (required)
  • port — Port (required)
  • credentials — Credentials (required)
  • advancedLogin — Advanced login - set to true to authenticate via LDAP, AD etc
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (9)

  • f5-create-policy

    Creates an F5 firewall policy.

  • f5-create-rule

    Creates a rule in a specific policy

  • f5-del-policy

    Delete a policy.

  • f5-del-rule

    Delete an F5 firewall rule.

  • f5-list-all-user-sessions

    Lists all the sessions with client IP for the given username.

  • f5-list-rules

    Lists all the rules of a specific policy.

  • f5-modify-global-policy

    Adds the specific policy to a global policy.

  • f5-modify-rule

    Modifies an F5 rule in a specific policy

  • f5-show-global-policy

    Display global policy.

// The command input arg holds the command sent from the user.
var testUrl = 'mgmt/shared/echo';
var loginReferenceUrl = 'mgmt/shared/authn/login';

var serverUrl = params.url.replace(/[\/]+$/, '') + ':' + params.port + '/';
var proxy = params.proxy;
var insecure = params.insecure;

var getF5SecurityToken = function() {
    var url = serverUrl + loginReferenceUrl;
    var httpParams = {
            Method: 'POST',
            Body: JSON.stringify({
                'username': params.credentials.identifier,
                'password': params.credentials.password,
                'loginProviderName': 'tmos'
            })
        };
    var res = http(url, httpParams, insecure, proxy);
    if (res.StatusCode !== 200) {
        throw 'Failed getting token from F5';
    }
    return JSON.parse(res.Body).token.token;
};

var sendRequest = function(method, uri, body) {
    var url = serverUrl + uri;
    var httpParams = {
            Method: method,
            Body: body
        };
    if (params.advancedLogin) {
        httpParams.Headers = {
            'X-F5-Auth-Token': [getF5SecurityToken()]
        };
    } else {
        httpParams.Username = params.credentials.identifier;
        httpParams.Password = params.credentials.password;
    }
    res = http(url, httpParams, insecure, proxy);
    if (res.StatusCode < 200 || res.StatusCode >= 300) {
        throw 'Failed getting ' + url + ' from F5, status code ' + res.StatusCode + ' and body ' + res.Body;
    }
    return JSON.parse(res.Body);
};

var methodDictionary = {
    show: 'GET',
    list: 'GET',
    del: 'DELETE',
    modify: 'PATCH',
    create: 'POST'
};

var uriDictionary = {
    'f5-create-policy': 'security/firewall/policy',
    'f5-create-rule': 'security/firewall/policy/~Common~%policy-name%/rules',
    'f5-list-rules': 'security/firewall/policy/~Common~%policy-name%/rules',
    'f5-modify-rule': 'security/firewall/policy/~Common~%policy-name%/rules/%rule-name%',
    'f5-delete-rule': 'security/firewall/policy/~Common~%policy-name%/rules/%rule-name%',
    'f5-modify-global-policy': 'security/firewall/globalRules/',
    'f5-show-global-policy': 'security/firewall/globalRules',
    'f5-del-policy': 'security/firewall/policy/~Common~%policy-name%',
    'f5-list-all-user-sessions': 'apm/access-info/stats?ver=13.0.0&options=logon-user,%resource-ip%'
};

var getMethod = function(command) {
    return methodDictionary[command.split('-')[1]];
}

var getUrl = function(command, args) {
    return 'mgmt/tm/' + replaceInTemplatesAndRemove(uriDictionary[command], args);
}

var buildBody = function(command, args) {
    switch (getMethod(command)) {
        case 'PATCH':
        case 'POST':
            break;
        default:
            return undefined;
    }
    return JSON.stringify(args);
}
switch (command) {
    case 'test-module':
        if (sendRequest('GET', testUrl)) {
            return 'ok';
        }
        return 'Gevald!!';
    default:
        return sendRequest(getMethod(command), getUrl(command, args), buildBody(command, args));
}