security packet-filter policy
security packet-filter policy(1) BIG-IP TMSH Manual security packet-filter policy(1)
NAME
policy - Configures packet-filter policy.
MODULE
security packet-filter
SYNTAX
Modify the policy component within the security packet-filter module using the syntax shown in the following sections.
CREATE/MODIFY
create policy [name]
modify policy [name]
options:
description [string]
rules [add | delete | modify | replace-all-with] {
[name] {
options:
action [accept | drop]
description [string]
ipv6-extension-headers [add | delete | replace-all-with] {
[ah | esp | hopopt | ipv6-frag | ipv6-nonxt | ipv6-opts | ipv6-route | mh] {
values [add | delete | replace-all-with] {
[ [value] | [value1-value2] ]
}
}
}
log [no | yes]
status [disabled | enabled]
}
}
rules none
edit policy
options:
all-properties
non-default-properties
DISPLAY
list policy
DESCRIPTION
You can use the policy component to configure a shareable and reusable set of security packet-filter rules which can be
associated with a number of configuration objects of the following types: security packet-filter default-rules, net route-
domain.
EXAMPLES
modify policy policy1 rules add {
drop-frags {
action drop
ipv6-extension-headers replace-all-with { ipv6-frag }
} }
Creates a rule entry that drops all IPv6 packets specifying Fragment Header.
modify policy policy1 rules delete drop-frags
Removes the rule drop-frags from the list of rules.
create policy xyz rules add { r1 { action drop ipv6-extension-headers replace-all-with { hopopt { values replace-all-with {
0 } } } } }
Creates a policy with a single rule that drops all packets specifying Hop-by-Hop Header with option 0. Packets specifying
Hop-by-Hop Header, but without option 0, will not be dropped.
create policy xyz rules add { r1 { action drop ipv6-extension-headers replace-all-with { hopopt } } }
Creates a policy with a single rule that drops all packets specifying Hop-by-Hop Header with or without any options.
list policy
Displays the current list of policy rules.
OPTIONS
description
User defined description.
rules
Adds, deletes, or replaces a packet-filter rule.
action
Specifies the action that the system takes when a rule is matched.
accept
Specifies that the current packet should be accepted.
drop Specifies that the current packet should be silently dropped. Nothing is sent back to the packet source. The
packet is still compared to any other rules, so other rule counters may be incremented.
description
User defined description.
ipv6-extension-headers
Specifies a list of IPv6 Extension Header types (only one item per list is currently supported), against which
the packet will be compared
values
Specifies a list of IPv6 Extension Header options or option ranges against which the packet will be
compared. Specifying values is supported only for some of the IPv6 Extension Header types: hopopt - values
match Hop-by-Hop Options; ipv6-opts - values match Destination Options; ipv6-route - values match Routing
type. If values are omitted - no values are required in packet to match the rule, so it's enough for a
packet to include the IPv6 Extension Header of the type specified in a rule for rule to match.
log Specifies whether the packet will be logged if it matches the rule. Logging must also be enabled in security log
profile global-network. Note that the statistics counter is always incremented when a packet matches a rule.
status
Specifies whether the rule is enabled or disabled. If a rule is disabled it has no effect on data packets.
SEE ALSO
create, edit, list, modify, security log profile, tmsh
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
use, without the express written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2008, 2012-2018. All rights reserved.
BIG-IP 2018-05-10 security packet-filter policy(1)