bigip hardening

sol5380: Specifying allowable IP ranges for SSH access

 

http://support.f5.com/kb/en-us/solutions/public/5000/300/sol5380.html

 

 

sol7448: Restricting access to the Configuration utility by source IP address

 

http://support.f5.com/kb/en-us/solutions/public/7000/400/sol7448.html

 

 

hope this helps.

hi nitass,

 

 

does sol7448 support v11.0/1 ?

 

 

i think it is applicable but we have to use tmsh instead.

root@ve1100(Active)(/Common)(tmos) show sys version

Sys::Version
Main Package
  Product  BIG-IP
  Version  11.1.0
  Build    1943.0
  Edition  Final
  Date     Sun Nov 20 18:27:50 PST 2011

root@ve1100(Active)(/Common)(tmos) list sys httpd all-properties
sys httpd {
    allow { All }
    auth-name BIG-IP
    auth-pam-dashboard-timeout off
    auth-pam-idle-timeout 1200
    description none
    fastcgi-timeout 300
    hostname-lookup off
    include none
    log-level warn
    max-clients 10
    ssl-certchainfile none
    ssl-certfile /etc/httpd/conf/ssl.crt/server.crt
    ssl-certkeyfile /etc/httpd/conf/ssl.key/server.key
    ssl-ciphersuite ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2
    ssl-include none
}

i cant modify the allow { All } value

 

can you assist?

e.g.

root@ve1100(Active)(/Common)(tmos) list sys httpd all-properties
sys httpd {
    allow { All }
    auth-name BIG-IP
    auth-pam-dashboard-timeout off
    auth-pam-idle-timeout 1200
    description none
    fastcgi-timeout 300
    hostname-lookup off
    include none
    log-level warn
    max-clients 10
    ssl-certchainfile none
    ssl-certfile /etc/httpd/conf/ssl.crt/server.crt
    ssl-certkeyfile /etc/httpd/conf/ssl.key/server.key
    ssl-ciphersuite ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2
    ssl-include none
}

root@ve1100(Active)(/Common)(tmos) modify sys httpd allow replace-all-with { 192.168.206.0/24 }

root@ve1100(Active)(/Common)(tmos) list sys httpd
sys httpd {
    allow { 192.168.206.0/24 }
}

 

 

Hi all,

 

 

I came across this question this morning and looked forward to the feedback. I've used the info here to help secure our LTMS and GTMs.

 

 

I'd like to take this further maybe and talk about locking the system down even further - if possible that is. We're currently going through a pci compliance project. For those of you who don't know about pci it's bascially a security best practice process. Anyway does anyone know of any guidelines from F5 or elsewhere that helps get our kit locked down even further?

 

 

I've yet to carry out a port scan on the kit so I'm not sure what is open, nor am I sure about the implementation of the protocols and services available.

 

 

We use F5 kit quite heavily in our infrastructure so hopefully this won't be too painful. Any help, as always, is greatly appreciated.

 

 

Thanks,

 

 

Joe

 

 

this is additional information but not sure if it is useful.

 

 

sol13092: Overview: Securing access to the BIG-IP system

 

http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13092.html?sr=19043305

 

 

hope this helps.

I think you could also check the configuration of each vserver.

 

 

One thing to specify to tighten it down further is the allowed vlan property. So you will only expose the vserver for the proper interfaces. But this will also depend on if you use the F5 as a pure loadbalancer or if you use it as a router aswell.

 

 

Even if you use it as a router aswell you can then specify for which vlans the forwarding-ip vserver should be exposed.