F5 Configuring BIG-IP AFM: Advanced Firewall Manager
Course Overview
Most organizations already send their application traffic through BIG-IP. Adding a separate firewall in front of it means another device to manage, another hop, and another set of rules to keep in sync. BIG-IP Advanced Firewall Manager puts a stateful network firewall on the same platform, so the device that delivers the application also controls what traffic gets near it. This F5 BIG-IP AFM training shows how to build and run that firewall properly.
The course is F5’s Configuring BIG-IP AFM: Advanced Firewall Manager. After a short system setup chapter, it explains where AFM sits in the BIG-IP Security menu and how packets move through it. You learn the firewall contexts, from global and route domain rules down to virtual servers, self IPs, and the management port. You also compare ADC mode, which allows traffic to virtual servers by default, with firewall mode, which denies anything not explicitly permitted.
Firewall policy management takes up a large part of the course. You build rules and policies, reuse address lists, port lists, and rule lists, and apply schedules so a rule is only active when needed. Geolocation matches traffic by region. Built-in checks flag redundant, conflicting, and stale rules before they become a maintenance burden.
DoS protection is the second major theme. You configure device DoS and DoS profiles, tune vector thresholds, and work with dynamic signatures. Further chapters cover IP Intelligence, sweep flood protection, IP shunning, DNS Firewall, DNS and SIP DoS, and port misuse policies.
Visibility runs throughout. Event logs, logging profiles, and log publishers record what the firewall decided, while reports and dashboards show attack trends. Packet Tester confirms how a rule set will treat a packet before it goes live. Flow Inspector shows how active connections are handled.
These skills apply directly to data center security, where application security starts with controlling what reaches the network at layers 3 and 4.
Course Objectives
By the end of the course, you will be able to:
- Provision and set up a BIG-IP system for AFM, and explain how AFM processes packets.
- Configure network firewall rules and policies in the global, route domain, virtual server, self IP, and management port contexts.
- Choose between ADC mode and firewall mode to apply a negative or positive security model.
- Create address lists, port lists, rule lists, and schedules, and use geolocation to match traffic by region.
- Analyze the rule base for redundant, conflicting, and stale rules.
- Apply IP Intelligence policies with dynamic lists, feed lists, and the IP Intelligence database.
- Configure device DoS, DoS profiles, dynamic signatures, white lists, sweep flood protection, and IP shunning.
- Protect DNS and SIP services with DNS Firewall, DNS DoS, SIP DoS, and port misuse policies.
- Monitor and troubleshoot AFM with logging profiles, log publishers, reports, dashboards, Packet Tester, and Flow Inspector.
Course Prerequisites
Students must complete one of the following F5 prerequisites before attending this course:
- Administering BIG-IP instructor-led course
- F5 Certified BIG-IP Administrator
The following web-based courses, although optional, will be very helpful for any student with limited BIG-IP administration and configuration experience:
- Getting Started with BIG-IP web-based training
- Getting Started with BIG-IP Local Traffic Manager (LTM) web-based training
- Getting Started with BIG-IP Advanced Firewall Manager (AFM) web-based training
The following general network technology knowledge and experience are recommended before attending any F5 Global Training Services instructor-led course:
- OSI model encapsulation
- Routing and switching
- Ethernet and ARP
- TCP/IP concepts
- IP addressing and subnetting
- NAT and private IP addressing
- Default gateway
- Network firewalls
- LAN vs. WAN
Target Audience
- Network security engineers: Build layer 3 and 4 defenses on the platform that already fronts your applications.
- Firewall administrators: Apply familiar rule and policy concepts to AFM's contexts and modes.
- F5 BIG-IP administrators: Add firewall and DoS protection to systems you already manage.
- Network engineers: See how AFM rules interact with self IPs, VLANs, and route domains.
- Application delivery engineers: Protect virtual servers without adding a separate firewall hop.
- Data center and infrastructure specialists: Plan where network firewall and DoS controls sit in your design.
- Security operations staff: Use AFM logs, reports, and dashboards to investigate attacks.
- Teams running or planning BIG-IP AFM: Agree on rule standards, logging, and DoS thresholds before rollout.
Course Content
2 modules · 27 topics01 v12.0 Course Topics14 topics
- Installation and setup of the BIG-IP AFM system
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists, IP reputation database and dynamic IP shunning.
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DoS Sweep/Flood
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall and DoS iRules
- Various AFM component troubleshooting commands
02v11.6 Course Topics13 topics
- Installation and setup of the BIG-IP AFM System
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists and the IP reputation database
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall iRules
- Various AFM component troubleshooting commands
Schedule Dates
4 upcoming batches| Batch Dates | Duration | Batch Options | Language | Action |
|---|---|---|---|---|
| 25 January 2027 - 26 January 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 26 April 2027 - 27 April 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 26 July 2027 - 27 July 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 01 November 2027 - 02 November 2027 | 2 Days | 4 hours & 8 hours | English / Arabic |
Can’t find a suitable date? Request a schedule that fits your team.
Request More InformationNetwork Firewall and DoS Skills for Global Teams
Organizations now deliver applications from private data centers, colocation sites, and public clouds, and each entry point needs network-level protection. Many already run BIG-IP at those edges, which makes Advanced Firewall Manager a practical way to add stateful filtering and DDoS resilience without adding another device. Our F5 BIG-IP AFM training shows engineers how to design rule sets, tune DoS thresholds, and prove their configuration with logs and reports. This F5 Advanced Firewall Manager course builds on our Administering BIG-IP training. For web application attacks, see our separate F5 Advanced WAF course. You can also browse every F5 security and application delivery course to plan a learning path. To see whether the BIG-IP AFM course fits your team, review the outline or contact our training team.
FAQs
What is the F5 BIG-IP AFM course?
It is F5’s Configuring BIG-IP AFM: Advanced Firewall Manager course, which teaches you to deploy and operate AFM on BIG-IP. The course covers the network firewall, DoS protection, IP Intelligence, logging, and reporting, plus DNS Firewall, DNS and SIP DoS, and port misuse. It combines lectures with hands-on labs, including exercises where you generate attack traffic and watch AFM respond.
What does BIG-IP AFM do, and what topics are covered?
BIG-IP AFM is a stateful network firewall and DoS protection module that filters traffic at layers 3 and 4 on the BIG-IP platform. The course covers firewall contexts and modes, rules, policies, lists, schedules, and geolocation. It also covers device DoS and DoS profiles, IP Intelligence, sweep flood, IP shunning, DNS and SIP protection, logging, reports, Packet Tester, and Flow Inspector.
Who should attend this course?
F5 aims it at system and network administrators responsible for configuring and administering BIG-IP AFM. Network security engineers, firewall administrators, BIG-IP administrators, and security operations staff who work with AFM will also benefit. You should already know BIG-IP basics, since the course focuses on firewall and DoS features rather than general administration.
What are the prerequisites for the AFM course?
F5 requires one of three: the Administering BIG-IP instructor-led course, the F5 Certified BIG-IP Administrator credential, or the Administering BIG-IP Equivalency Assessment. F5 also recommends networking knowledge, including OSI encapsulation, routing and switching, Ethernet and ARP, TCP/IP, subnetting, NAT, and network firewalls. Free Getting Started courses for BIG-IP, LTM, and AFM are optional preparation.
What skills will I gain?
You will gain the ability to build, test, and operate an AFM deployment. That means writing rules and policies in the right context, choosing ADC or firewall mode, and keeping the rule base clean with lists and stale-rule checks. You’ll also tune DoS protection, apply IP Intelligence, and use logs, reports, Packet Tester, and Flow Inspector to confirm what the firewall is doing.
Does the AFM course lead to an F5 certification?
No. Attending the course does not grant any F5 certification, and F5’s current exam list has no dedicated AFM exam. F5 certifications require passing exams separately. For example, F5 Certified Administrator, BIG-IP requires exams F5CAB1 to F5CAB5. The AFM course is skills-focused training that can support broader F5 learning alongside those exams.
Why do network firewall policies, DoS protection, and logging matter?
They decide what reaches your applications and whether you can prove it. Firewall policies limit exposure to the services you actually intend to offer. DoS protection keeps floods from exhausting connections and bandwidth. Logging shows what was blocked and why, which is essential when a user reports a problem or an auditor asks how a rule behaves.
How can this course support my professional development?
It adds network firewall and DoS protection skills to your BIG-IP experience, which broadens the security work you can take on. Those skills can help you contribute to firewall design, incident response, and security reviews. Career outcomes depend on your experience and employer, so the course supports your development without promising a role or salary change.
Flexible Training Options to Meet Your Needs
Choose how you learn — live online, in-classroom, at your workplace, or internationally. CounselTrain delivers certified IT training in the format that fits your team.
Select the method that best suits your needs.
Online Instructor-Led Training
Learn from the comfort of your workplace or at home through live virtual sessions led by expert trainers.
Learn moreHighlights
Classroom Training
Participate in interactive, face-to-face training in our top 5-star training facilities in Dubai.
Learn moreHighlights
Onsite Training
Learn a customised curriculum in your workplace to ensure the most impact and team participation.
Learn moreHighlights
Overseas Training
Participate in our international training sessions and improve your abilities with world-class instructors.
Learn moreHighlights
Related Courses
Other courses in the same category that might interest you.
