Lab 2.2: Create custom security policies & Application Service Template¶

****TASKS****

Create a custom ASM policy

1. Logout of BIG-IQ (top right corner)
2. Login as larry with password of larry
3. Navigate to Configuration >> SECURITY >> Web Application Security >> Policies

4. Click on the ASM policy f5-asm-policy1 from the list and look through its settings. Notice the policy is in Transparent mode.
5. Validate Learning Mode is set to Manual
6. Check the box Make available in Application Templates

7. Click Save Button (bottom right)
8. While still editing the policy f5-asm-policy1, navigate to POLICY BUILDING >> Settings
9. Change Learning Mode to Manual
10. Change Policy Building Mode to Central
11. Click Save & Close button (bottom right corner)

****TASKS****

Create an AFM Policy

1. Navigate to Configuration >> SECURITY >> Network Security >> Firewall Policies
2. Click Create button
3. Enter the name of your policy: f5-afm-policy1
4. Make sure the box Make available in Application Templates is checked.

****TASKS****

Create 2 Firewall Rules

1. Click on RULES
2. Click Create Rule button
3. Click the little pencil icon on Rule id 1
4. On the next step, do not mistakenly use Port SOURCE instead of Port DESTINATION
5. Add 80 and 443 to Port Destination
6. Set Protocol to tcp (use scroll bar in rule window to scroll right)
7. Scroll back to the left side and click Update button on rule
8. Click Create Rule (creating 2nd rule)
9. Click the little pencil icon on Rule id 2
10. Set Action to reject (use scroll bar in rule window to scroll right)
11. Check Log checkbox (all the way to the right in the rule)
12. Scroll back to the left side and click Update button on rule
13. Click Save & Close button (bottom right corner)

****TASKS****

Create an App Service Catalog from a template

1. Logout of BIG-IQ (top right corner)
2. Login as marco with password of marco
3. Navigate to Applications >> SERVICE CATALOG
4. Select Default-f5-HTTPS-WAF-lb-template
5. Click the Clone button (top right)
6. Enter the name of your cloned template as f5-HTTPS-WAF-lb-template-custom1
7. Click Clone button

8. While editing the template, navigate to SECURITY POLICIES
9. Under Attached ASM Policy, select f5-asm-policy1 for both Virtual Servers in this template
10. Under Enforce Firewall Policy, seelect f5-afm-policy1 for both Virtual Servers in this template
11. Click Save buttom (bottom right)
12. Navigate around in this template (left navigation) and review the Virtual Servers and Pools this template is configured to create for new apps.

****TASKS****

We need to give permission to the group that Paula belongs to access this new application template.

1. Navigate to System (top tab) >> Role Management >> Roles
2. Then navigate within that to CUSTOM ROLES >> Application Roles
3. Click on Application Creator VMware role (already assigned to Paula)
4. Select checkbox on Available Template f5-HTTPS-WAF-lb-template-custom1
5. Push right arrow to move to Selected
6. Click Save & Close button (bottom right corner)