net packet-filter-trusted¶

net packet-filter-trusted(1) BIG-IP TMSH Manual net packet-filter-trusted(1)

NAME
packet-filter-trusted - Modifies or displays trusted allow lists for packet filters.

MODULE
net

SYNTAX
Configure the packet-filter-trusted component within the net module using the syntax in the following
sections.

MODIFY
modify packet-filter-trusted
options:
description [string]
ip-addresses none
ip-addresses
[add | delete | replace-all-with] {
[ip address ... ]
}
mac-addresses none
mac-addresses
[ add | delete | replace-all-with] ] {
[MAC address ...]
}
vlans none
vlans
[add | delete | replace-all-with] ] {
[vlan name ... ]
}

edit packet-filter-trusted

DISPLAY
list packet-filter-trusted
show running-config packet-filter-trusted
options:
all-properties
non-default-properties
one-line

DESCRIPTION
Use the packet-filter-trusted component to create a layer of security for the traffic management system using
trusted allow lists.

Trusted allow lists are lists of IP addresses, MAC addresses, and VLANs that are exempt from packet filter
rules.

Important: By default, packet filtering is disabled. You must enable packet filtering using the Configuration
utility. For more information, see the TMOS(r) Management Guide for BIG-IP(r) Systems.

EXAMPLE
Creates a trusted allow list that allows anything listed to bypass the packet filter.

In the following example, you have an administrative laptop that you want to have unrestricted access to the
traffic management system. This is a laptop, and therefore it might have a different IP address from time to
time. One way to solve the problem is to add a trusted MAC address. This trusted allow list example shows the
laptop MAC address as 00:02:3F:3E:2F:FE. Now the laptop can access the traffic management system regardless of
what address it boots with or to which VLAN it is connected, as long as it is on the same physical segment as
the traffic management system.

Also in this example, the traffic management system is configured for basic firewalling of the
private/internal network. This example shows a way to filter incoming traffic and allow outgoing traffic to be
unrestricted. To do this, you add trusted VLANs that represent all traffic that originated on the internal
network. Another way to do this is to use trusted IP addresses instead, for example, 192.168.26.0/24.

modify packet-filter-trusted {
vlans add { internal1 internal2 }
mac-addresses add { 00:02:3F:3E:2F:FE }
}

OPTIONS
description
User defined description.

ip-addresses
Specifies a list of source IP addresses. Any traffic matching a source IP address in the list is
automatically allowed. This simplifies configuration of the packet filter to allow trusted internal
traffic to be passed from VLAN to VLAN without a filter rule, including out to the Internet. Processing
of traffic by this option occurs before rule list evaluation, making it impossible to override this
option and mask out (block) certain types of traffic with a packet filter rule. This option is empty by
default.

mac-addresses
Specifies a list of MAC addresses. The system allows any traffic matching a MAC address in the source
address list. This simplifies configuration of the packet filter to allow trusted internal traffic to be
passed from VLAN to VLAN without a filter rule, including out to the Internet. Processing of traffic by
this option occurs before rule list evaluation, making it impossible to override this option and mask out
(block) certain types of traffic with a packet filter rule. This option is empty by default.

vlans
Specifies a list of ingress VLANs. Any traffic received on a VLAN that is on the ingress VLAN list is
automatically allowed. This simplifies configuration of the packet filter to allow trusted internal
traffic to be passed from VLAN to VLAN without a filter rule, including out to the Internet. Processing
of traffic by this option occurs before rule list evaluation, making it impossible to override this
option and mask out (block) certain types of traffic with a packet filter rule. This option is empty by
default.

SEE ALSO
edit, list, ltm virtual, modify, net packet-filter, net vlan, net vlan-group, show, tmsh

COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

BIG-IP 2016-03-14 net packet-filter-trusted(1)