Details
| ID | F5 firewall |
|---|---|
| Provider | F5 |
| Category | Network Security |
| From Version | 5.0.0 |
| Supported Modules | Agentix XSIAM |
README
Use the F5 Firewall integration to manage your F5 firewall rules.
Configure F5 Firewall in Cortex
| Parameter | Description | Required |
|---|---|---|
| url | URL | True |
| port | Port | True |
| credentials | Credentials | True |
| advancedLogin | Advanced login - set to true to authenticate via LDAP, AD etc | False |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
Create a firewall policy
Creates an F5 firewall policy.
Base Command
f5-create-policy
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
There is no context output for this command.
Command Example
##### Human Readable Output
### f5-create-rule
***
Creates a rule in a specific policy
##### Base Command
`f5-create-rule`
##### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The policy name the rule will be associated with | Required |
##### Context Output
There is no context output for this command.
##### Command Example
Human Readable Output
List all rules for a policy
Lists all the rules of a specific policy
Base Command
f5-list-rules
Input
| Argument Name | Description | Required |
|---|---|---|
| policy-name | The policy name that the rules displayed are associated with. | Required |
Context Output
There is no context output for this command.
Command Example
### Modify the rule for a policy
***
Modifies an F5 rule in a specific policy.
##### Base Command
`f5-modify-rule`
##### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The policy name the rule is associated with. | Required |
| rule-name | The rule name to modify. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
Human Readable Output
Delete a rule
Delete an F5 rule.
Base Command
f5-del-rule
Input
| Argument Name | Description | Required |
|---|---|---|
| policy-name | The policy name the rule is associated with. | Required |
| rule-name | The name of the rule to delete. | Required |
Context Output
There is no context output for this command.
Command Example
### Add a policy to a global policy
***
Adds the specified policy to a global policy.
##### Base Command
`f5-modify-global-policy`
##### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| enforcedPolicy | The new enforced policy to add to the global policy. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
Human Readable Output
Get a global policy
Display global policy.
Base Command
f5-show-global-policy
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
Command Example
### Delete a policy
***
Deletes a policy.
##### Base Command
`f5-del-policy`
##### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| policy-name | The name of the policy to delete. | Required |
##### Context Output
There is no context output for this command.
##### Command Example
Human Readable Output
Get a list of all user sessions
Lists all the sessions with client IP for the given username.
Base Command
f5-list-all-user-sessions
Input
| Argument Name | Description | Required |
|---|---|---|
| resource-ip | Client IP address. | Required |
Context Output
There is no context output for this command.
Command Example
``````
Configuration parameters
url— URL (required)port— Port (required)credentials— Credentials (required)advancedLogin— Advanced login - set to true to authenticate via LDAP, AD etcinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (9)
-
f5-create-policyCreates an F5 firewall policy.
-
f5-create-ruleCreates a rule in a specific policy
-
f5-del-policyDelete a policy.
-
f5-del-ruleDelete an F5 firewall rule.
-
f5-list-all-user-sessionsLists all the sessions with client IP for the given username.
-
f5-list-rulesLists all the rules of a specific policy.
-
f5-modify-global-policyAdds the specific policy to a global policy.
-
f5-modify-ruleModifies an F5 rule in a specific policy
-
f5-show-global-policyDisplay global policy.
// The command input arg holds the command sent from the user. var testUrl = 'mgmt/shared/echo'; var loginReferenceUrl = 'mgmt/shared/authn/login'; var serverUrl = params.url.replace(/[\/]+$/, '') + ':' + params.port + '/'; var proxy = params.proxy; var insecure = params.insecure; var getF5SecurityToken = function() { var url = serverUrl + loginReferenceUrl; var httpParams = { Method: 'POST', Body: JSON.stringify({ 'username': params.credentials.identifier, 'password': params.credentials.password, 'loginProviderName': 'tmos' }) }; var res = http(url, httpParams, insecure, proxy); if (res.StatusCode !== 200) { throw 'Failed getting token from F5'; } return JSON.parse(res.Body).token.token; }; var sendRequest = function(method, uri, body) { var url = serverUrl + uri; var httpParams = { Method: method, Body: body }; if (params.advancedLogin) { httpParams.Headers = { 'X-F5-Auth-Token': [getF5SecurityToken()] }; } else { httpParams.Username = params.credentials.identifier; httpParams.Password = params.credentials.password; } res = http(url, httpParams, insecure, proxy); if (res.StatusCode < 200 || res.StatusCode >= 300) { throw 'Failed getting ' + url + ' from F5, status code ' + res.StatusCode + ' and body ' + res.Body; } return JSON.parse(res.Body); }; var methodDictionary = { show: 'GET', list: 'GET', del: 'DELETE', modify: 'PATCH', create: 'POST' }; var uriDictionary = { 'f5-create-policy': 'security/firewall/policy', 'f5-create-rule': 'security/firewall/policy/~Common~%policy-name%/rules', 'f5-list-rules': 'security/firewall/policy/~Common~%policy-name%/rules', 'f5-modify-rule': 'security/firewall/policy/~Common~%policy-name%/rules/%rule-name%', 'f5-delete-rule': 'security/firewall/policy/~Common~%policy-name%/rules/%rule-name%', 'f5-modify-global-policy': 'security/firewall/globalRules/', 'f5-show-global-policy': 'security/firewall/globalRules', 'f5-del-policy': 'security/firewall/policy/~Common~%policy-name%', 'f5-list-all-user-sessions': 'apm/access-info/stats?ver=13.0.0&options=logon-user,%resource-ip%' }; var getMethod = function(command) { return methodDictionary[command.split('-')[1]]; } var getUrl = function(command, args) { return 'mgmt/tm/' + replaceInTemplatesAndRemove(uriDictionary[command], args); } var buildBody = function(command, args) { switch (getMethod(command)) { case 'PATCH': case 'POST': break; default: return undefined; } return JSON.stringify(args); } switch (command) { case 'test-module': if (sendRequest('GET', testUrl)) { return 'ok'; } return 'Gevald!!'; default: return sendRequest(getMethod(command), getUrl(command, args), buildBody(command, args)); }