How to instantiate functions in your firewall
Instantiate serverless functions directly within your firewall.
Instantiate serverless functions directly within your firewall.
This guide uses the configured Deny a request based on Geoip function. You can repeat this process using any function already available on Azion Marketplace or develop other functions.
This guide will also presume you have a network list of the Countries type.
- Access Azion Console > select Firewall.
- Click the firewall you want to configure.
- In the Main Settings tab, enable the Functions module switch to enable functions.
- Click the Save button.
- Go to the Functions Instances tab.
- Click + Function Instance.
- Name your function instance. For example:
Deny Geoip function. - On the Functions dropdown, select the function you want to use. In this example,
Deny Geoip function.
- If you want, you can edit the Arguments.
- Click the Save button.
The functions page now lists the newly created instance. However, this new function isn’t yet active in your application. You need to define what will trigger the function.
Still on the Firewall page:
- Navigate to the Rules Engine tab.
- Click the + Rule button.
- Give a name to your rule.
- Under the Criteria section, select the variable
Network. - As a comparison operator, select matches.
- As an argument, select the network list of the Countries type you want to use. For example:
Blocked Countries Geoip. - In the Behaviors section, select Run Function from the behavior list.
- Select the function you want to use. In this example,
Deny Geoip function. - Click the Save button.
Once your application receives a request generated from one of the countries in the network list, the function in your firewall will deny the request based on the geo IP.
- Run the following
PATCHrequest in your terminal, replacing[TOKEN VALUE]with your personal token and the<edge_firewall_id>variable with your firewall ID to activate the Functions module:
- You’ll receive a response with the updated value.
- Run the following
GETrequest to retrieve theedge_function_idof theDeny Geoip functionfunction:
- You’ll receive a response similar to this:
- Copy the
<function_id>value. - Run the following
POSTrequest, replacing the<edge_firewall_id>variable with your firewall ID and the<function_id>value with the value you received in the previous response:
- You’ll receive a response similar to this:
| Key | Description |
|---|---|
name | Name of the instantiated function |
edge_function | The ID of the function. This isn’t the same as the ID of the instantiated function, which is unique for each application’s function instance |
json_args | Definition of arguments required for the function. Some functions don’t take arguments |
- Run the following
GETto retrieve theidof theBlocked Countries Geoipnetwork list:
- You’ll receive a response similar to this:
| Key | Description |
|---|---|
name | Name of the network list |
id | ID of the network list |
list_type | Definition of the type of the network list |
country_list | Items that compose the list |
- Run the following
POSTrequest in your terminal, replacing[TOKEN VALUE]with your personal token, the<edge_firewall_id>variable with your firewall ID, the<edge_function_instance_id>value with the function instance ID, and the<<network_list_id>>value with the network list ID:
- Wait a few minutes for the changes to propagate.
Once your application receives a request generated from one of the countries in the network list, the function in your firewall will deny the request based on the geo IP.