add module to manage AFM rule lists

[caphrim007]

modify security firewall rule-list DIAMETER-NODES-RL-IPV4 rules add {
  ALLOW-FOREIGNNET-ICMP {
    place-before DEFAULT-DROP
    action accept
    description "Allow DIAMETER-NODES FOREIGNNET to Originate ICMP PING/TRACEROUTE"
    ip-protocol icmp
    icmp replace-all-with {
      0 {} 8 {} 30 {}
    }
    log yes
    destination {
      address-lists add {
        DIAMETER-NODES-PARTNERNETWORK-BILLING-DRA
      }
    }
    source {
      address-lists add {
        DIAMETER-NODES-FOREIGNNET
      }
    }
  }
}

modify security firewall rule-list PARTNERNETWORK-RL-IPV4 rules add {
  ALLOW-PARTNERNETWORK-ICMP {
    place-before DEFAULT-DROP
    action accept
    description "Allow PARTNERNETWORK BILLING DRA to Originate ICMP PING/TRACEROUTE"
    ip-protocol icmp
    icmp replace-all-with {
      0 {} 8 {} 30 {}
    }
    log yes
    destination {
      address-lists add {
        DIAMETER-NODES-FOREIGNNET
      }
    }
    source {
      address-lists add {
        DIAMETER-NODES-PARTNERNETWORK-BILLING-DRA
      }
    }
  }
}

create security firewall rule-list DIAMETER-NODES-RL-UDR-IPV4 {
  description "Rule List for DIAMETER-NODES UDR IPv4 Flows"
  rules replace-all-with {
    ALLOW-UDR-TCP {
      action accept
      description "Allow DIAMETER-NODES Originate TCP SSH UDR"
      ip-protocol tcp
      log yes
      destination {
        address-lists replace-all-with {
          DIAMETER-NODES-PARTNERNETWORK-BILLING-UDR
        }
        port-lists replace-all-with {
          SFTP-TCP
        }
      }
      source {
        address-lists replace-all-with {
          DIAMETER-NODES-FOREIGNNET
        }
      }
    }
    DEFAULT-DROP {
      action drop
      description "Drop Policy with Logging"
      log yes
    }
  }
}

[caphrim007]

bigip_security_rule_list:
    name: DIAMETER-NODES-RL-IPV4
    partition: Common
    rules:
        - name: ALLOW-FOREIGNNET-TCP
          description: Allow DIAMETER-NODES FOREIGNNET to Originate TCP
          state: enabled
          protocol: tcp
          source:
              - [address|address_list|address_range|country_and_region] mutually exclusive
                 [port|port_range|port_list] mutually exclusive
                 vlan (type list)
          destination:
              - [address|address_list|address_range|country] mutually exclusive
                 [port|port_range|port_list] mutually exclusive
                 vlan (type list)
          irule:
          action: (accept|drop|reject|accept_decisively)
          logging: (bool)
          service_policy: string