F5 Configuring BIG-IP AFM: Advanced Firewall Manager
Course Overview
A public virtual server starts receiving thousands of SYN packets a second from addresses that never complete a handshake. Legitimate users begin timing out. BIG-IP Advanced Firewall Manager is designed to absorb that kind of network-level attack before it reaches the application, and this F5 BIG-IP AFM training spends serious time on configuring that defense.
DoS protection in AFM works at two levels. Device DoS protects the BIG-IP system as a whole, while DoS profiles attach to specific virtual servers. You learn how F5 groups attack vectors into variants, when to set thresholds manually, and when automatic thresholds are the better choice. Dynamic signatures help identify attack patterns, and DoS iRules add custom control. DoS white lists make sure trusted sources, such as monitoring systems, are never caught by mitigation.
Floods aren’t the only threat. Sweep flood protection isolates a client that probes many addresses or ports. IP shunning blocks known bad sources early and can be extended with remotely triggered black hole routing or diversion to a scrubbing service. For protocol-specific attacks, the course covers DNS DoS, DNS Firewall, and SIP DoS.
A firewall that only reacts to floods isn’t enough, so the course also builds a network firewall from the ground up. You work with contexts, ADC and firewall modes, rules, policies, address and port lists, schedules, and geolocation. IP Intelligence adds reputation-based blocking, using dynamic lists and the separately licensed IP Intelligence database.
Visibility ties everything together. Logging profiles and log publishers record attacks and firewall decisions, while reports and dashboards show what was mitigated and when. In the labs you take the attacker’s role, send test traffic, and watch the defenses respond.
That experience carries straight into data center security operations. Knowing your thresholds before an attack matters far more than tuning them during one.
Course Objectives
Participants will be able to:
- Configure device DoS protection and DoS profiles for Variant 1, 2, and 3 attack vectors.
- Apply automatic thresholds and dynamic signatures, and add DoS iRules where needed.
- Create DoS white lists so trusted sources bypass mitigation.
- Isolate scanning clients with sweep flood protection and block persistent attackers with IP shunning.
- Protect DNS and SIP services using DNS Firewall, DNS DoS, and SIP DoS.
- Build network firewall rules and policies across AFM contexts in ADC or firewall mode.
- Apply IP Intelligence policies, feed lists, and the IP Intelligence database.
- Monitor attacks with logging profiles, log publishers, reports, and dashboards.
- Verify rule behavior with Packet Tester and examine live connections with Flow Inspector.
Target Audience
- Network security engineers: Build layer 3 and 4 defenses on the platform that already fronts your applications.
- Firewall administrators: Apply familiar rule and policy concepts to AFM's contexts and modes.
- F5 BIG-IP administrators: Add firewall and DoS protection to systems you already manage.
- Network engineers: See how AFM rules interact with self IPs, VLANs, and route domains.
- Application delivery engineers: Protect virtual servers without adding a separate firewall hop.
- Data center and infrastructure specialists: Plan where network firewall and DoS controls sit in your design.
- Security operations staff: Use AFM logs, reports, and dashboards to investigate attacks.
- Teams running or planning BIG-IP AFM: Agree on rule standards, logging, and DoS thresholds before rollout.
Course Content
2 modules · 27 topics01 v12.0 Course Topics14 topics
- Installation and setup of the BIG-IP AFM system
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists, IP reputation database and dynamic IP shunning.
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DoS Sweep/Flood
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall and DoS iRules
- Various AFM component troubleshooting commands
02v11.6 Course Topics13 topics
- Installation and setup of the BIG-IP AFM System
- AFM network firewall concepts
- Network firewall options and modes
- Network firewall rules, policies, address/port lists , rule lists and schedules
- IP Intelligence facilities of dynamic black and white lists and the IP reputation database
- Detection and prevention of DoS attacks
- Event logging of firewall rules and DoS attacks
- Reporting and notification facilities
- DoS Whitelists
- DNS Firewall and DNS DoS
- SIP DoS
- Network Firewall iRules
- Various AFM component troubleshooting commands
Schedule Dates
4 upcoming batches| Batch Dates | Duration | Batch Options | Language | Action |
|---|---|---|---|---|
| 25 January 2027 - 26 January 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 26 April 2027 - 27 April 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 26 July 2027 - 27 July 2027 | 2 Days | 4 hours & 8 hours | English / Arabic | |
| 01 November 2027 - 02 November 2027 | 2 Days | 4 hours & 8 hours | English / Arabic |
Can’t find a suitable date? Request a schedule that fits your team.
Request More InformationWhy F5 BIG-IP AFM Training in Saudi Arabia Matters
Vision 2030 has moved banking, telecom, energy, and government services firmly online, and public-facing services make visible targets for network-level attacks. Engineers in Riyadh, Jeddah, and Dammam who protect these platforms need to know how their firewall and DoS settings behave before an incident, not during one. Our F5 BIG-IP AFM training in Saudi Arabia covers device DoS, DoS profiles, IP Intelligence, and firewall policy management in hands-on labs, with time spent on the logs and reports that document what happened. That evidence also supports the wider security work many organizations carry out under the National Cybersecurity Authority’s Essential Cybersecurity Controls. This F5 AFM course for Riyadh teams builds on our Administering BIG-IP course. It pairs well with F5 Advanced WAF training for web-layer protection. You can also explore our wider cybersecurity training programs. To plan BIG-IP firewall training in Jeddah or elsewhere for your team, review the outline or speak with our advisors.
FAQs
What does the Configuring BIG-IP AFM course teach?
It teaches you to configure and operate BIG-IP Advanced Firewall Manager as a network firewall and DoS protection system. F5’s course covers firewall contexts, modes, rules, and policies, plus device DoS, DoS profiles, IP Intelligence, logging, and reporting. Extra chapters address DNS Firewall, DNS and SIP DoS, sweep flood, IP shunning, port misuse, and network firewall iRules.
How does AFM protect against DoS attacks, and how is this covered?
AFM detects and mitigates DoS attacks using device-wide protection and per-virtual-server DoS profiles. The course covers attack vector variants, manual and automatic thresholds, dynamic signatures, DoS iRules, and whitelists. It also covers sweep flood protection, IP shunning with black hole or scrubber options, and protocol-specific protection for DNS and SIP, with labs that simulate attacks.
Is this course suitable for my role?
It suits you if you configure or operate network security controls on BIG-IP. F5 aims it at system and network administrators responsible for AFM. Network security engineers, firewall administrators, and security operations staff protecting busy public services will also benefit, as long as they already understand BIG-IP basics.
Are there prerequisites I must meet first?
Yes, F5 lists required prerequisites. You must have completed Administering BIG-IP, hold the F5 Certified BIG-IP Administrator credential, or have passed the Administering BIG-IP Equivalency Assessment. F5 also recommends knowledge of TCP/IP, routing and switching, Ethernet and ARP, subnetting, NAT, and network firewalls. Free Getting Started courses for BIG-IP, LTM, and AFM are optional.
Which hands-on abilities will I build?
You will build the ability to protect applications from network-level attacks and prove that the protection works. In labs, you configure DoS thresholds, whitelists, sweep flood, and IP shunning, then build firewall rules and policies. You also review logs and reports to confirm results and use Packet Tester to check rule behavior before changes go live.
Will I be F5 certified after attending?
No. Training alone does not grant F5 certification, and F5 does not currently list a dedicated AFM exam. Any F5 certification requires passing the relevant exams separately, such as F5CAB1 to F5CAB5 for F5 Certified Administrator, BIG-IP. The AFM course is skills-focused and can support your wider F5 learning.
Why is DoS protection so important for public-facing services?
A single flood can make a service unavailable even when the servers are healthy. DoS protection stops attack traffic before it exhausts connections or bandwidth. Firewall policies reduce exposure by only permitting intended services. Logs and reports then show exactly what was blocked, which supports both incident response and security reviews.
How might this course support my career in Saudi Arabia?
It builds practical network firewall and DoS skills that are directly useful wherever AFM protects critical services. Stronger security skills can help you take on more responsibility in protection and incident response work. The course does not guarantee a job, promotion, or pay change. Those depend on your experience and your employer’s needs.
Flexible Training Options to Meet Your Needs
Choose how you learn — live online, in-classroom, at your workplace, or internationally. CounselTrain delivers certified IT training in the format that fits your team.
Select the method that best suits your needs.
Online Instructor-Led Training
Learn from the comfort of your workplace or at home through live virtual sessions led by expert trainers.
Learn moreHighlights
Classroom Training
Participate in interactive, face-to-face training in our top 5-star training facilities in Dubai.
Learn moreHighlights
Onsite Training
Learn a customised curriculum in your workplace to ensure the most impact and team participation.
Learn moreHighlights
Overseas Training
Participate in our international training sessions and improve your abilities with world-class instructors.
Learn moreHighlights
Related Courses
Other courses in the same category that might interest you.
