bigip_firewall_rule – Manage AFM Firewall rules
bigip_firewall_rule – Manage AFM Firewall rules
New in version 2.7.
Synopsis
- Manages firewall rules in an AFM firewall policy. New rules will always be added to the end of the policy. Rules can be re-ordered using the
bigip_security_policy
module. Rules can also be pre-ordered using thebigip_security_policy
module and then later updated using thebigip_firewall_rule
module.
Requirements
The below requirements are needed on the host that executes this module.
- f5-sdk >= 3.0.16
Parameters
Parameter | Choices/Defaults | Comments | |
---|---|---|---|
action - |
|
Specifies the action for the firewall rule. When When When When When creating a new rule, if this parameter is not provided, the default is | |
description - |
The rule description. | ||
destination - |
Specifies packet destinations to which the rule applies. Leaving this field blank applies the rule to all addresses and all ports. You can specify the following destination items. An IPv4 or IPv6 address, an IPv4 or IPv6 address range, geographic location, VLAN, address list, port, port range, port list or address list. You can specify a mix of different types of items for the source address. | ||
address - |
Specifies a specific IP address. | ||
address_list - |
Specifies an existing address list. | ||
address_range - |
Specifies an address range. | ||
country - |
Specifies a country code. | ||
port - |
Specifies a single numeric port. This option is only valid when | ||
port_list - |
Specifes an existing port list. This option is only valid when | ||
port_range - |
Specifies a range of ports, which is two port values separated by a hyphen. The port to the left of the hyphen should be less than the port to the right. This option is only valid when | ||
icmp_message - |
Specifies the Internet Control Message Protocol (ICMP) or ICMPv6 message This parameter is only relevant when | ||
code - |
Specifies the code returned in response to the specified ICMP message type. You can specify codes, each set appropriate to the associated type, such as No Code (0) (associated with Echo Reply (0)) and Host Unreachable (1) (associated with Destination Unreachable (3)), or you can specify You can also specify an arbitrary code. The ICMP protocol contains definitions for the existing message code and number pairs. | ||
type - |
Specifies the type of ICMP message. You can specify control messages, such as Echo Reply (0) and Destination Unreachable (3), or you can specify You can also specify an arbitrary ICMP message. The ICMP protocol contains definitions for the existing message type and number pairs. | ||
irule - |
Specifies an iRule that is applied to the rule. An iRule can be started when the firewall rule matches traffic. | ||
logging boolean |
|
Specifies whether logging is enabled or disabled for the firewall rule. When creating a new rule, if this parameter is not specified, the default if | |
name - / required |
Specifies the name of the rule. | ||
parent_policy - |
The policy which contains the rule to be managed. One of either | ||
parent_rule_list - |
The rule list which contains the rule to be managed. One of either | ||
partition - |
Default: "Common" |
Device partition to manage resources on. | |
password - / required |
The password for the user account used to connect to the BIG-IP. You may omit this option by setting the environment variable
| ||
protocol - |
Specifies the protocol to which the rule applies. Protocols may be specified by either their name or numeric value. A special protocol value | ||
provider - added in 2.5 |
Default: null |
A dict object containing connection details. | |
password - / required |
The password for the user account used to connect to the BIG-IP. You may omit this option by setting the environment variable
| ||
server - / required |
The BIG-IP host. You may omit this option by setting the environment variable | ||
server_port - |
Default: 443 |
The BIG-IP server port. You may omit this option by setting the environment variable | |
ssh_keyfile - |
Specifies the SSH keyfile to use to authenticate the connection to the remote device. This argument is only used for cli transports. You may omit this option by setting the environment variable | ||
timeout - |
Default: 10 |
Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands. If the timeout is exceeded before the operation is completed, the module will error. | |
transport - / required |
|
Configures the transport connection to use when connecting to the remote device. | |
user - / required |
The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You may omit this option by setting the environment variable | ||
validate_certs boolean |
|
If You may omit this option by setting the environment variable | |
rule_list - |
Specifies an existing rule list to use in the rule. This parameter is mutually exclusive with many of the other individual-rule specific settings. This includes | ||
schedule - |
Specifies a schedule for the firewall rule. You configure schedules to define days and times when the firewall rule is made active. | ||
server - / required |
The BIG-IP host. You may omit this option by setting the environment variable | ||
server_port - added in 2.2 |
Default: 443 |
The BIG-IP server port. You may omit this option by setting the environment variable | |
source - |
Specifies packet sources to which the rule applies. Leaving this field blank applies the rule to all addresses and all ports. You can specify the following source items. An IPv4 or IPv6 address, an IPv4 or IPv6 address range, geographic location, VLAN, address list, port, port range, port list or address list. You can specify a mix of different types of items for the source address. | ||
address - |
Specifies a specific IP address. | ||
address_list - |
Specifies an existing address list. | ||
address_range - |
Specifies an address range. | ||
country - |
Specifies a country code. | ||
port - |
Specifies a single numeric port. This option is only valid when | ||
port_list - |
Specifes an existing port list. This option is only valid when | ||
port_range - |
Specifies a range of ports, which is two port values separated by a hyphen. The port to the left of the hyphen should be less than the port to the right. This option is only valid when | ||
state - |
|
When When | |
status - |
|
Indicates the activity state of the rule or rule list. When When When When creating a new rule, if this parameter is not provided, the default is | |
user - / required |
The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You may omit this option by setting the environment variable | ||
validate_certs boolean added in 2.0 |
|
If You may omit this option by setting the environment variable |
Notes
Note
- For more information on using Ansible to manage F5 Networks devices see https://www.ansible.com/integrations/networks/f5.
- Requires the f5-sdk Python package on the host. This is as easy as
pip install f5-sdk
. - Requires BIG-IP software version >= 12.
- The F5 modules only manipulate the running configuration of the F5 product. To ensure that BIG-IP specific configuration persists to disk, be sure to include at least one task that uses the bigip_config module to save the running configuration. Refer to the module’s documentation for the correct usage of the module to save your running configuration.
Examples
- name: Create a new rule in the foo firewall policy
bigip_firewall_rule:
name: foo
parent_policy: policy1
protocol: tcp
source:
- address: 1.2.3.4
- address: "::1"
- address_list: foo-list1
- address_range: 1.1.1.1-2.2.2.2
- vlan: vlan1
- country: US
- port: 22
- port_list: port-list1
- port_range: 80-443
destination:
- address: 1.2.3.4
- address: "::1"
- address_list: foo-list1
- address_range: 1.1.1.1-2.2.2.2
- country: US
- port: 22
- port_list: port-list1
- port_range: 80-443
irule: irule1
action: accept
logging: yes
provider:
password: secret
server: lb.mydomain.com
user: admin
delegate_to: localhost
- name: Create an ICMP specific rule
bigip_firewall_rule:
name: foo
protocol: icmp
icmp_message:
type: 0
source:
- country: US
action: drop
logging: yes
provider:
password: secret
server: lb.mydomain.com
user: admin
delegate_to: localhost
- name: Add a new rule that is uses an existing rule list
bigip_firewall_rule:
name: foo
rule_list: rule-list1
provider:
password: secret
server: lb.mydomain.com
user: admin
delegate_to: localhost
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key | Returned | Description |
---|---|---|
param1 boolean |
changed |
The new param1 value of the resource.
Sample: True |
param2 string |
changed |
The new param2 value of the resource.
Sample: Foo is bar |
Status
- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by an Ansible Partner. [certified]
Authors
- Tim Rupp (@caphrim007)
© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.7/modules/bigip_firewall_rule_module.html