Forum Discussion

Renato_166638's avatar
Renato_166638
Icon for Nimbostratus rankNimbostratus
Sep 21, 2017
Solved

Invert match in AFM policy

Hi!

 

Is it possible to invert the match sense in AFM parameters like we do using ! with iptables?

 

Thanks!

 

AFM
security
  • Richard_Karon_7's avatar
    Richard_Karon_7
    Jul 01, 2018

    if you would like to change a single allowed address such as this one

     

    1. accept all traffic to 10.1.1.1/32

    you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

     

    for example assuming the rest of the network is a 24 bit subnet mask,

     

    1. drop/reject all traffic for 10.1.1.1/32
    2. accept all traffic to 10.1.1.0/24

    or vice-versa if you want to allow your specific ip address on a blocked subnet.

     

5 Replies

Sort By
  • Richard_Karon's avatar
    Richard_Karon
    Icon for Employee rankEmployee
    Jul 01, 2018

    if you would like to change a single allowed address such as this one

     

    1. accept all traffic to 10.1.1.1/32

    you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

     

    for example assuming the rest of the network is a 24 bit subnet mask,

     

    1. drop/reject all traffic for 10.1.1.1/32
    2. accept all traffic to 10.1.1.0/24

    or vice-versa if you want to allow your specific ip address on a blocked subnet.

     

    • Renato_166638's avatar
      Renato_166638
      Icon for Nimbostratus rankNimbostratus
      Jul 18, 2018

      Richard, that was a long time ago, but you suggestion is probably what I did. I was migrating some policies from PaloAlto to AFM and also trying to make it the more similar I could at same time for the customer.

       

  • Richard_Karon_7's avatar
    Richard_Karon_7
    Historic F5 Account
    Jul 01, 2018

    if you would like to change a single allowed address such as this one

     

    1. accept all traffic to 10.1.1.1/32

    you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

     

    for example assuming the rest of the network is a 24 bit subnet mask,

     

    1. drop/reject all traffic for 10.1.1.1/32
    2. accept all traffic to 10.1.1.0/24

    or vice-versa if you want to allow your specific ip address on a blocked subnet.

     

    • Renato_166638's avatar
      Renato_166638
      Icon for Nimbostratus rankNimbostratus
      Jul 18, 2018

      Richard, that was a long time ago, but you suggestion is probably what I did. I was migrating some policies from PaloAlto to AFM and also trying to make it the more similar I could at same time for the customer.