# How to update Firewall

import DocButton from '~/components/webkit/DocButton.vue';


Previously, to use a rule set from Firewall or Web Application Firewall (WAF), you had to activate these modules in the **Main Settings** tab of each applications. Then, criteria and behaviors were applied in the application's **Rules Engine** tab.

Azion **Firewall** has evolved into an independent product including all security functionalities: DDoS Protection, Network Shield, Web Application Firewall, and **Functions**. This update facilitates the creation of new security policies that can be applied globally or specifically. Consequently, rule sets used in deprecated versions of **Firewall** have also been deprecated.

:::note
Rule Sets deprecated from Firewall show a banner with the following message: `This Firewall rule set is deprecated. Please upgrade to the new version.`
:::

This documentation will guide you through updating the Firewall features used in the deprecated versions to the latest ones. Each section describes how each feature works on the new modules, Network Lists, and Rules Engine.

<DocButton href="/en/documentation/products/secure/firewall/" label="Go to Firewall reference" kind="secondary" size="medium" />

---

## Creating new rules in Firewall

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. Create a new firewall by clicking the **+ Firewall** button.
    - Alternatively, you can edit an already created one.
3. Follow the steps explained below according to the functionality.


### Referrer Block

[![referer-blocking](/assets/docs/images/update-edge-firewall/referer-blocking.jpg)](/assets/docs/images/update-edge-firewall/referer-blocking.jpg)

If you used **Referer Block** in your deprecated rule set, still in the new firewall:

1. In the **Main Settings** tab, enable the **Web Application Firewall** module.
2. Click the **Save** button.
3. Go to the **Rules Engine** tab.
4. Click the **+ Rule Engine** button.
5. Give a name and, optionally, a description for your rule.
6. In the **Criteria** section, set the desired criteria to trigger the rule:
    - If `Header Referer` *does not match* `yourdomain.com`.
    - Use the accepted domain of the old rule set.
7. For each domain in **Accepted Domains** of the old rule set, click the **+ Add Criteria** button and repeat the step 6.
8. In the **Behavior** section, select **Deny (403 Forbidden)**.
9. Click the **Save** button.

### Geo-Blocking

[![geo-blocking](/assets/docs/images/update-edge-firewall/geo-blocking.jpg)](/assets/docs/images/update-edge-firewall/geo-blocking.jpg)

If you used **Geo-Blocking** in your deprecated rule set:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Network Lists**.
2. Create a new network list by clicking the **+ Network List** button.
    - Alternatively, you can edit an already created one.
3. Give a name for your network list.
4. In **Type**, select **Countries**.
5. In the **Countries** dropdown, select the countries you want to add, based on the the deprecated rule set.
6. Click the **Save** button.

Now it's time to create a rule using the network list for your firewall:

1. Go to **Products menu** > **Firewall**.
2. Select the firewall you created previously. 
3. In **Main Settings**, enable the **Network Shield** module.
4. Click the **Save** button.
5. Go to the **Rules Engine** tab.
6. Click the **+ Rule Engine** button.
7. Give a name and, optionally, a description for your rule.
8. In the **Criteria** section, set the desired criteria to trigger the rule:
    - If `Network` *does not match* `your network list` (to use as an allowlist) or If `Network` **matches** `your network list` (to use as a blocklist).
    - Select the network list you created in the previous steps as the value.
9. In the **Behavior** section, select **Deny (403 Forbidden)**.
10. Click the **Save** button.

### Secure Token

[![secure-token](/assets/docs/images/update-edge-firewall/secure-token.jpg)](/assets/docs/images/update-edge-firewall/secure-token.jpg)

If you used **Secure Token** in your deprecated rule set, still in the new firewall:

1. In the **Main Settings** tab, enable the **Functions** module.
2. Click the **Save** button.
3. Go to the **Functions Intances** tab.
4. Click the **+ Function Intance** button.
5. Give a name for your instance.
6. In **Function**, select the **Secure Token** function.
7. Use the **Arguments** box to define the secret that composes the hash.
8. Click the **Save** button.
9. Go to the **Rules Engine** tab.
10. Click the **+ Rules Engine** button.
11. Give a name and, optionally, a description for your rule.
12.  In the **Criteria** section, set the desired criteria to trigger the rule.
    - For example: if `Host` **is equal** `xxxxxxxxxxxx.map.azionedge.net/classes`.
13. In the **Behavior** section, select **Run Function**.
14. In the dropdown, select the function instance you created to Secure Token.
15. Click the **Save** button.

### IP Blocking

[![ip-blocking](/assets/docs/images/update-edge-firewall/ip-blocking.jpg)](/assets/docs/images/update-edge-firewall/ip-blocking.jpg)

If you used **IP Blocking** in your deprecated rule set:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Network Lists**.
2. Create a new network list by clicking the **+ Network List** button.
    - Alternatively, you can edit an already created one.
3. Give a name for your network list.
4. In **Type**, select **IP/CIDR**.
5. In the **List** box, copy the list of blocked IPs from the deprecated rule set.
6. Click the **Save** button.

Now it's time to create a rule using the network list for your firewall:

1. Go to **Products menu** > **Firewall**.
2. Select the firewall you created previously. 
3. In **Main Settings**, enable the **Network Shield** module.
4. Click the **Save** button.
5. Go to the **Rules Engine** tab.
6. Click the **+ Rule Engine** button.
7. Give a name and, optionally, a description for your rule.
8. In the **Criteria** section, set the desired criteria to trigger the rule:
    - If `Network` *does not match* `your network list` (to use as an allowlist) or If `Network` *matches* `your network list` (to use as a blocklist).
    - Select the network list you created in the previous steps as the value.
9. In the **Behavior** section, select **Deny (403 Forbidden)**.
10. Click the **Save** button.

### Rate Limiting

[![rate-limiting](/assets/docs/images/update-edge-firewall/rate-limiting.jpg)](/assets/docs/images/update-edge-firewall/rate-limiting.jpg)

If you used **Rate Limiting** in your deprecated rule set, still in the new firewall:

1. Go to the **Rules Engine** tab.
2. Click the **+ Rule Engine** button.
3. Give a name and, optionally, a description for your rule.
4. In the **Criteria** section, set the desired criteria to trigger the rule.
5. In the **Behavior** section, select **Set Rate Limit**.
6. In the **Rate Limit type**, select either **Req/s** or **Req/min** and define the average rate limit.
7. Select if you want to set a limit by **Client IP Address** or **Global** and the maximum burst size.
8. Click the **Save** button.

### WAF Rule Set Association

You can also associate one or more WAF Rule Sets with the new firewall: 

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. Select the firewall you created previously. 
3. In the **Main Settings** tab, enable the **Web Application Firewall** module.
4. Click the **Save** button.

Now it's time to create a rule using the WAF Rule Set for your firewall:

1. Go to the **Rules Engine** tab.
2. Click the **+ Rule Engine** button to add a new rule or edit an existing one.
3. Give a name and, optionally, a description for your rule.
4. In the **Criteria** section, set the desired criteria to trigger the rule.
5. In the **Behavior** section, select **Set WAF Rule Set** and choose a **WAF Rule Set**.
6. Click the **Save** button.

---

## Removing the Firewall rules in your applications

After creating and applying the rule for the latest version of Firewall for your domain, you must remove the rules in your applications:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Applications**.
2. Select the applications with the deprecated configurations.
3. In the **Rules Engine** tab, select any rule including the behaviors **Set Firewall with Rule Sets** or **Set WAF Rule Set**.
4. Remove the behavior by clicking the trash can icon and your rule will be removed.
    - To remove the whole rule, in the list, click the three points in the right corner of the rule and select the **Delete** option. Then, confirm the deletion in the modal and your rule will be removed.
5. Click the **Save** button.