F5 BIG-IP stock definitions

Stock definitions for F5 BIG-IP, from the f5/ folder. They check the tmsh configuration in brace format, where each object starts on a top-level line such as ltm virtual and its braces are balanced. This page documents release v1.2.0. See importing a stock template to load one into rConfig.

Hardening definitions

F5 BIG-IP security baseline

bigip-security-baseline.policy · 7 rules · minimum rConfig 8.3.0 · Lab tested

NTP, syslog and SNMP present, no public or private SNMP communities, SSH idle timeout, remote syslog, WAF logging profiles and WAF policies on virtual servers.

Rule	Method	What it checks
F5: Core services are configured (NTP, syslog, SNMP objects present)	must_match_all_from_array	The config contains the text sys ntp, sys syslog and sys snmp.
F5: An NTP object exists for accurate log timestamps	wildcard_match_single_string	The config contains sys ntp followed by a space.
F5: No default or public/private SNMP community strings anywhere	evaluate_block	No line contains community-name public or community-name private.
F5: The SSH daemon enforces a non-zero idle timeout	evaluate_block	Each sys sshd block has an inactivity-timeout line whose value starts with a digit from 1 to 9.
F5: Remote syslog is configured (logs leave the box)	evaluate_block	Each sys syslog block contains remote-servers.
F5 WAF logging: WAF-enabled virtual servers carry the required security-log-profiles (disabled servers skipped)	evaluate_block	Each ltm virtual block passes if it is disabled, if it has no ASM_WAF_ policy, or if it lists all four log profiles: siem_log_collector, netlog_tcp, Log illegal requests and telemetry_asm_security_log_profile.
F5 WAF on external servers: externally reachable virtual servers have a WAF policy (disabled servers skipped)	evaluate_block	Each ltm virtual block passes if it is disabled, if its source is not 0.0.0.0/0, or if it references an ASM_WAF_ policy.

Known limitations

• A scoped rule fails when no config block matches its scope. A config with no sys sshd or sys syslog block fails those rules.
• The WAF logging rule uses the generic log profile name siem_log_collector. Change it to your own profile name.
• rConfig has no F5 platform or collection command yet, so the sidecar sets no collection command.

F5 BIG-IP SSL/TLS and virtual server hardening

bigip-ssl-virtual-hardening.policy · 5 rules · minimum rConfig 8.3.0 · Lab tested

Client-SSL profiles disable SSLv3, TLS 1.0 and TLS 1.1 and avoid DEFAULT/ALL ciphers; pools have monitors; HTTPS virtual servers use client-SSL and keep source address translation.

Rule	Method	What it checks
F5: Every client-SSL profile disables SSLv3 and TLSv1.0/1.1	evaluate_block	Each ltm profile client-ssl block contains no-sslv3, no-tlsv1 and no-tlsv1.1. no-tlsv1.1, no-tlsv1.2 and no-tlsv1.3 do not count as no-tlsv1.
F5: No client-SSL profile falls back to a permissive DEFAULT/ALL cipher set	evaluate_block	No ltm profile client-ssl block has a ciphers DEFAULT or ciphers ALL line.
F5: Every pool has at least one health monitor assigned	evaluate_block	Each ltm pool block contains monitor.
F5: Every HTTPS (:443) virtual server terminates TLS with a client-SSL profile	evaluate_block	Each ltm virtual block with a /Common/...:443 destination contains clientssl. Other virtual servers pass.
F5: HTTPS virtual servers do not disable source address translation	evaluate_block	No ltm virtual block with a /Common/...:443 destination has a type none line. Other virtual servers pass.

Known limitations

• A scoped rule fails when no config block matches its scope. A config with no client-SSL profiles or pools fails those rules.
• The TLS 1.0 check uses a regex so that no-tlsv1.1, no-tlsv1.2 and no-tlsv1.3 do not satisfy it. TLS 1.1 is checked separately.
• rConfig has no F5 platform or collection command yet, so the sidecar sets no collection command.