F5Networks / f5-appsvcs-extension

F5 BIG-IP Application Services 3 Extension
Apache License 2.0
163 stars 52 forks source link

Add AFM options for enabling and disabling rules/rulesets #820

Open thepowercoders opened 2 months ago

thepowercoders commented 2 months ago

Is your feature request related to a problem? Please describe.

For adding AFM entries via AS3 using the classes Firewall_Policy and Firewall_Rule_List there are no options in AS3 for enabling/disabling firewall rules. This is a pretty basic requirement of any firewall product so should be implemented in AS3.

Describe the solution you'd like

Add property "state" to the firewall policy against the rulelist, and to the rule classes:

example:

"fwPolicy": {
   "class": "Firewall_Policy",
   "rules": [
      {
         "use": "fwRuleList-001",
         "state": "enabled"
       },
       {
          "use": "fwRuleList-002",
          "state": "disabled"
       },
    ],
},
"fwRuleList-001": {
   "class": "Firewall_Rule_List",
      "rules": [
         {
            "protocol": "tcp",
            "name": "myfwrule",
            "state": "enabled",
...etc

Describe alternatives you've considered

No real alternative other than removing or adding rules via automation but this is clunky and difficult to manage. Can use TMSH command: tmsh modify security firewall policy /Common/Shared/<policy_name> rules modify { <rule_name> { rule-list /Common/<rulelist_name> status enabled } } ...but would be better to have available in AS3.