F5BigFwPolicy

The F5BigFwPolicy Custom Resource (CR) applies industry-standard firewall rules to the Traffic Management Microkernel (TMM), ensuring that only connections initiated by trusted clients will be accepted. When applying a new F5BigFwPolicy CR configuration, firewall rules are first sent to the Application Firewall Management (AFM) Pod to be compiled into a binary large object (BLOB), improving processing performance. Once the firewall BLOB is compiled, it is sent to the TMM Pod to begin inspecting and filtering network packets.

CR parameters

The tables below describe the F5BigFwPolicy CR parameters

metadata

Parameter	Description
name	The name of the Firewall Policy. This value is referenced by BIG-IP Next for Kubernetes Traffic Management CRs.
namespace	The namespace of Kubernetes in with firewall policy is installed.

spec

Parameter	Description	Default
rule.name string	The name of the firewall rule. A policy can contain multiple firewall rules. Note: You must specify this field.
rule.ipProtocol string	Specifies the IP protocol against which the packet will be compared. The F5BigFwPolicy IP Protocols document contains the full list of supported protocols.	any
rule.action string	Specifies the action that will be applied to packet that matches ACL rule: “accept”, “drop”, “reject” or “accept-decisively”
rule.logging boolean	Enables ACL rule match logging	false
rule.source.addresses	Specifies a list of IPv4 or IPv6 source addresses against which the packet will be compared: host 2002::10:10:10:1, subnet 2002::10:10:0:0/96, or range 2002::10:10:10:1-2002::10:10:10:20.
rule.source.addressLists array	Specifies the F5BigCneAddressList by metadata.name against which the packet will be compared. See the Address and Port Lists section in this guide. The ACL/NAT rule is disabled internally and is not used for matching traffic while: - This attribute is specifying one or more addressLists and - All of these addressLists are empty or do not exist (soft-reference case) and - The rule does not specify any direct source address	[]
rule.source.ports array	Specifies a list of source service ports or port ranges against which the packet will be compared. Port 0 is a valid value, that functions as a service port, not as a wildcard.	[]
rule.source.portLists array	Specifies the F5BigCnePortList by metadata.name against which the packet will be compared. See the Address and Port Lists section in this guide. The ACL/NAT rule is disabled internally and is not used for matching traffic while: - This attribute is specifying one or more portLists and - All of these portLists are empty or do not exist (soft-reference case) and - The rule does not specify any direct source port	[]
rule.source.vlans array	Specifies a list of F5BigNetVlans in an array.	[]
rule.source.namespaces array	Specifies a list of Kubernetes namespaces to match the firewall rule. Note: Namespace matching requires TMM to receive traffic with the original pod IP addresses; if the source IP address is translated before reaching TMM, source namespace matching does not work.	[]
rule.destination.addresses array	Specifies a list of IPv4 or IPv6 destination addresses against which the packet will be compared: host 2002::10:10:10:1, subnet 2002::10:10:0:0/96, or range 2002::10:10:10:1-2002::10:10:10:20.	[]
rule.destination.ports array	Specifies a list of destination service ports or port ranges against which the packet will be compared. Port 0 is a valid value, that functions as a service port, not as a wildcard.	[]
rule.destination.addressLists array	Specifies the F5BigCneAddressList by metadata.name against which the packet will be compared. See the Address and Port Lists section below. The ACL/NAT rule is disabled internally and is not used for matching traffic while: - This attribute specifies one or more addressLists and - All of these addressLists are empty or do not exist (soft-reference case) and - The rule does not specify any direct destination address	[]
rule.destination.portLists array	Specifies the F5BigCnePortList by metadata.name against which the packet will be compared. See the Address and Port Lists section in this guide. The ACL/NAT rule is disabled internally and is not used for matching traffic while: - This attribute specifies one or more portLists and - All of these portLists are empty or do not exist (soft-reference case) and - The rule does not specify any direct destination port	[]
rule.destination.namespaces array	Specifies a list of Kubernetes namespaces to match the firewall rule. Note: Destination namespace matching works only for east‑west traffic to pod IPs via Egress CRs; virtual (gateway) IPs are not supported.	[]
rule.ruleList string	Specifies the firewall rule list name this rule references. The maximum length of the string is 255.	“”

To add, modify, or delete the firewall rules easily, you need to break the firewall rules list into multiple smaller units and store them in F5BigFwRulelist CR.

CR Example

This section provides the sample CRs of F5BigFwPolicy use cases. For more details to apply the CRs, see Firewall policy in Gateway API

F5BigFwPolicy CR with ACLs attached to GatewayClass

Following is an example F5BigFwPolicy CR with ACLs attached to GatewayClass:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFwPolicy
metadata:
  name: fwpolicy-global-1
  namespace: f5-bnk
spec:
  rule:
  - name: sc-rule-1
    ipProtocol: any
    source:  
      addresses:
      - 11.19.10.9
    logging: true
    action: drop

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-gatewayclass
  namespace: f5-bnk
spec:
  extensionRefs:
  - name: fwpolicy-global-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway-class
    kind: GatewayClass
    group: gateway.networking.k8s.io

Note

SecPolicy, FirewallPolicy CRs should be in f5-bnk namespace when attached to GatewayClass.

F5BigFwPolicy with ACLs attached to Gateway

Following is an example F5BigFwPolicy CR with ACLs attached to Gateway:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFwPolicy
metadata:
  name: fwpolicy-virtual-1
  namespace: gatewayns
spec:
  rule:
  - name: sc-rule-1
    ipProtocol: any
    source:
      addresses:
      - 11.19.10.8
    logging: true
    action: drop

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-virtual-1
  namespace: gatewayns
spec:
  extensionRefs:
  - name: fwpolicy-virtual-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway
    kind: Gateway
    group: gateway.networking.k8s.io

SecPolicy with ACLs attached to Gateway Listeners

Following is an example SecPolicy CR with ACLs attached to Gateway Listeners:

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-virtual-1
  namespace: gatewayns
spec:
  extensionRefs:
  - name: fwpolicy-virtual-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
    sectionName: tcp-listener

Note

SecPolicy, Gateway, FirewallPolicy CRs should be in same namespace when attached to Gateway or Gateway Listener.