F5 Configuring BIG-IP AFM: Advanced Firewall Manager
Course Overview
A firewall that blocks traffic silently creates its own problems. Users report that a service is unreachable, and nobody can say whether a rule, a DoS mitigation, or an IP reputation block is responsible. This F5 BIG-IP AFM training treats visibility as a core skill, alongside building the network firewall itself.
The logging chapter covers how AFM records its decisions. You create logging profiles, enable logging on individual rules, and log events from global rules. Log throttling stops a flood of identical messages from overwhelming the system. You also learn how BIG-IP log publishers and log destinations send events to remote servers for analysis. Logging configuration changes, using qkview and log files, and SNMP MIBs and traps complete the operational picture.
Reporting gets substantial time as well. You examine the status of individual AFM features, schedule and export reports, and build dashboards with custom widgets that highlight attacks and trends. When a manager asks what happened during last night’s spike, these reports provide the answer.
Two tools help answer specific questions. Packet Tester shows how the current rule set would treat a given packet, which is useful when someone asks why a connection is blocked. Flow Inspector shows how active flows are being handled right now.
Visibility only helps if you understand what is being logged. The course builds the network firewall first, covering contexts, modes, rules, policies, address and port lists, schedules, geolocation, and checks for redundant or stale rules. It then covers IP Intelligence, with its own log profile and reporting, and DoS protection with device DoS, DoS profiles, dynamic signatures, and white lists. Sweep flood, IP shunning, DNS Firewall, DNS and SIP DoS, port misuse, and network firewall iRules complete the course.
The result is an AFM deployment you can explain as well as operate. That matters in data center security reviews, where showing evidence counts as much as the configuration itself.
Course Objectives
Participants will learn to:
- Configure logging profiles and enable logging for firewall rules and global rule events.
- Apply log throttling, log publishers, and log destinations to manage event volume and remote logging.
- Analyze AFM reports, schedule and export them, and build dashboards with custom widgets.
- Troubleshoot blocked connections with Packet Tester and Flow Inspector.
- Monitor IP Intelligence activity through its log profile and reports.
- Create network firewall rules and policies across contexts using lists, schedules, and geolocation.
- Identify redundant, conflicting, and stale rules.
- Configure device DoS, DoS profiles, dynamic signatures, and DoS white lists.
- Apply sweep flood, IP shunning, DNS and SIP protection, port misuse policies, and firewall iRules.
Course Prerequisites
Students must complete one of the following F5 prerequisites before attending this course:
- Administering BIG-IP instructor-led course
- F5 Certified BIG-IP Administrator
The following web-based courses, although optional, will be very helpful for any student with limited BIG-IP administration and configuration experience:
- Getting Started with BIG-IP web-based training
- Getting Started with BIG-IP Local Traffic Manager (LTM) web-based training
- Getting Started with BIG-IP Advanced Firewall Manager (AFM) web-based training
The following general network technology knowledge and experience are recommended before attending any F5 Global Training Services instructor-led course:
- OSI model encapsulation
- Routing and switching
- Ethernet and ARP
- TCP/IP concepts
- IP addressing and subnetting
- NAT and private IP addressing
- Default gateway
- Network firewalls
- LAN vs. WAN
Target Audience
- Network security engineers: Build layer 3 and 4 defenses on the platform that already fronts your applications.
- Firewall administrators: Apply familiar rule and policy concepts to AFM's contexts and modes.
- F5 BIG-IP administrators: Add firewall and DoS protection to systems you already manage.
- Network engineers: See how AFM rules interact with self IPs, VLANs, and route domains.
- Application delivery engineers: Protect virtual servers without adding a separate firewall hop.
- Data center and infrastructure specialists: Plan where network firewall and DoS controls sit in your design.
- Security operations staff: Use AFM logs, reports, and dashboards to investigate attacks.
- Teams running or planning BIG-IP AFM: Agree on rule standards, logging, and DoS thresholds before rollout.
Course Content
2 modules · 27 topics01 v12.0 Course Topics14 topics
- Installation and setup of the BIG-IP AFM system
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists, IP reputation database and dynamic IP shunning.
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DoS Sweep/Flood
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall and DoS iRules
- Various AFM component troubleshooting commands
02v11.6 Course Topics13 topics
- Installation and setup of the BIG-IP AFM System
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists and the IP reputation database
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall iRules
- Various AFM component troubleshooting commands
Schedule Dates
4 upcoming batches| Batch Dates | Duration | Batch Options | Language | Action |
|---|---|---|---|---|
| 05 April 2027 - 06 April 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 05 July 2027 - 06 July 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 11 October 2027 - 12 October 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 17 January 2028 - 18 January 2028 | 2 Days | 4 hours & 8 hours | English / Arabic |
Can’t find a suitable date? Request a schedule that fits your team.
Request More InformationF5 BIG-IP AFM Training in Qatar and Security Visibility
Qatar National Vision 2030 has supported the growth of digital government, finance, and energy services, and protecting them means being able to show what the network firewall is doing at any moment. Our F5 BIG-IP AFM training in Qatar gives engineers in Doha and Lusail that visibility. You learn how to configure logging profiles and log publishers, read AFM reports and dashboards, and trace a dropped connection back to the exact rule. Clear logs and reporting also support organizations whose security programs follow guidance from the National Cyber Security Agency. This F5 AFM course in Doha builds on our Administering BIG-IP training in Qatar. Engineers working on incident analysis may also find our Troubleshooting BIG-IP course useful. For a wider view, see our cybersecurity training options. To plan training for your team, request the full outline or contact our corporate training team.
FAQs
What is the F5 Configuring BIG-IP AFM course, in brief?
It is F5’s official course for configuring and operating BIG-IP Advanced Firewall Manager. It covers the network firewall, logging, IP Intelligence, DoS protection, and reporting, plus DNS and SIP protection, sweep flood, IP shunning, port misuse, and network firewall iRules. F5 notes that a good share of the course is spent analyzing reports.
How does the course handle AFM logging and reporting?
It covers logging and reporting as dedicated chapters, not afterthoughts. You configure logging profiles, enable rule logging, apply log throttling, and set up log publishers and destinations. You then schedule and export reports, build dashboards with custom widgets, and use Packet Tester and Flow Inspector to explain specific firewall decisions.
Who should take this F5 AFM course?
F5 intends it for system and network administrators who configure and administer BIG-IP AFM. Network security engineers, firewall administrators, and security operations staff who need to explain firewall decisions will find the logging and reporting chapters particularly useful. You should already be comfortable with BIG-IP basics before you attend.
What background does F5 expect before the course?
F5 expects you to have completed Administering BIG-IP, hold the F5 Certified BIG-IP Administrator credential, or have passed the Administering BIG-IP Equivalency Assessment. Recommended knowledge includes TCP/IP, routing and switching, Ethernet and ARP, subnetting, NAT, network firewalls, and LAN versus WAN concepts. Getting Started courses for BIG-IP, LTM, and AFM are optional preparation.
What skills does the course help me develop?
It develops the skill to run an AFM deployment you can see into and explain. You will build firewall rules and policies, then configure the logging and reports that show their effect. You’ll also tune DoS protection, apply IP Intelligence, and use Packet Tester and Flow Inspector to answer questions about specific connections.
Is completing the course the same as being F5 certified?
No. Attending training, passing an exam, and holding a certification are separate things. F5 does not currently list a dedicated AFM exam. F5 certifications require passing their own exams, such as F5CAB1 to F5CAB5 for F5 Certified Administrator, BIG-IP. The AFM course is skills-focused and can support wider F5 learning.
Why do firewall logging, policies, and DoS protection matter together?
Policies and DoS protection decide what reaches your applications, and logging proves what happened. Without logs, a blocked user and a blocked attacker look the same. With good logging and reports, you can confirm that protection works, fix rules that block legitimate traffic, and give clear evidence during security reviews.
How does the course support professional development?
It adds firewall, DoS, and security visibility skills to your BIG-IP experience. Those skills can help you contribute to security operations, incident analysis, and audits. The course does not guarantee a promotion, job, or pay increase, since those depend on many factors beyond training.
Flexible Training Options to Meet Your Needs
Choose how you learn — live online, in-classroom, at your workplace, or internationally. CounselTrain delivers certified IT training in the format that fits your team.
Select the method that best suits your needs.
Online Instructor-Led Training
Learn from the comfort of your workplace or at home through live virtual sessions led by expert trainers.
Learn moreHighlights
Classroom Training
Participate in interactive, face-to-face training in our top 5-star training facilities in Dubai.
Learn moreHighlights
Onsite Training
Learn a customised curriculum in your workplace to ensure the most impact and team participation.
Learn moreHighlights
Overseas Training
Participate in our international training sessions and improve your abilities with world-class instructors.
Learn moreHighlights
Related Courses
Other courses in the same category that might interest you.
