AFM ACL Staging Rules¶

Overview¶

Staging Firewall Rules (Access Control List) detailed information

Module Name in API¶

bigip-afm-staged

Product Name in API¶

local-traffic

Dimensions¶

Dimension	Name in API	Description
Country	country	Client Country
Source Port	source-port
Context Info Name	context-info	The name of the object the activity is reported on, this field goes together with the context type
BIG-IP Blade Number	slot-id	Used for BIG-IP Chassis with multiple blades. A value of 0 means this is a non chassis BIG-IP, any other value tells the serial number of the blade in the chassis
Destination Region	destination-region
Client IP	client-ip
Context Type	context-type	The type of the object the activity is reported on, such as virtual-server, vlan, device, etc.
Server Ip	server-ip
Destination User Name	destination-user-name
Destination Ip	destination-ip
Self IP	self-ip
User Name	client-user-name
Source Address Translation Type	sa-translation-type
BIG-IP Host Name	hostname	The hostname given to the BIG-IP
Source Address Translation Pool	sa-translation-pool
Destination Port	destination-port
ACL Policy Name	acl-policy-name
Destination Country	destination-country
BIG-IP Service Cluster	dsc-name	Clusters of BIG-IPs grouped together to have the same config
Vlan Name	vlan-name
Region	region
ACL Rule Name	acl-rule-name
Action	security-action	The action a security module took with this transaction/packet, such as allow or block

MetricSets¶

Rule Match Count¶

Description¶

Number of occurrences a rule was matched

Name In API¶

rule-match-count

Metrics in the metricSet¶

Metric	Name in API	Unit	Description
Rule Match Count	count	conns	Total number of times the system has matched the rule
Avg Rule Matches/s	avg-count-per-sec	conns/s	Average number of times the system has matched the rule per second

Examples¶

By Time Query¶

A query by time returns a series of data points in time, based on optional filters, time range, and time granularity. This query kind is identified by the keyword: “ap:query:stats:byTime”

POST https://<address>/mgmt/ap/query/v1/tenants/default/products/local-traffic/metric-query

This example for JSON body in the post, filters by dimension country and get the count of rule-match-count

{
    "kind": "ap:query:stats:byTime",
    "module": "bigip-afm-staged",
    "timeRange": {
            "from": "-1h",
            "to": "now"
    },
    "timeGranularity": {
            "duration": 30,
            "unit": "SECONDS"
    },
    "aggregations": {
            "rule-match-count$count": {
                    "metricSet": "rule-match-count",
                    "metric": "count"
            }
    },
    "dimensionFilter": {
            "type": "eq",
            "dimension": "country",
            "value": "value to filter by"
    }
}

By Entities Query¶

A query by entities returns a sort set of entities, based on optional filters, time range, and choosen metric to sort by. This query kind is identified by the keyword: “ap:query:stats:byEntities”

POST https://<address>/mgmt/ap/query/v1/tenants/default/products/local-traffic/metric-query

This example for JSON body in the post, gets top entities of type country, sorted by count of rule-match-count

{
    "kind": "ap:query:stats:byEntities",
    "module": "bigip-afm-staged",
    "timeRange": {
            "from": "-1H",
            "to": "now"
    },
    "dimension": "country",
    "sortMetric": "rule-match-count$count",
    "sortOrder": "desc",
    "aggregations": {
            "rule-match-count$count": {
                    "metricSet": "rule-match-count",
                    "metric": "count"
            }
    },
    "limit": 5
}

Entities Count Query¶

An entities count query returns the distinct count of entities, based on optional filters, time range, and choosen entity type. This query kind is identified by the keyword: “ap:query:stats:entitiesCount”

POST https://<address>/mgmt/ap/query/v1/tenants/default/products/local-traffic/metric-query

This example for JSON body in the post, gets the distinct count of entities of type country

{
    "kind": "ap:query:stats:entitiesCount",
    "module": "bigip-afm-staged",
    "dimension": "country",
    "timeRange": {
            "from": "-1h",
            "to": "now"
    }
}

Previous Next