Forum Discussion

player_72606's avatar
player_72606
Icon for Nimbostratus rankNimbostratus
Jan 31, 2012

bigip hardening

Hi all,     how can i harden f5 bigip which is facing the internet directly for specific ip address   to manage the device?     management port is not in use , management is used via t...
config
design
nitass's avatar
nitass
Icon for Employee rankEmployee
Jan 31, 2012
e.g. 

root@ve1100(Active)(/Common)(tmos) list sys httpd all-properties
sys httpd {
    allow { All }
    auth-name BIG-IP
    auth-pam-dashboard-timeout off
    auth-pam-idle-timeout 1200
    description none
    fastcgi-timeout 300
    hostname-lookup off
    include none
    log-level warn
    max-clients 10
    ssl-certchainfile none
    ssl-certfile /etc/httpd/conf/ssl.crt/server.crt
    ssl-certkeyfile /etc/httpd/conf/ssl.key/server.key
    ssl-ciphersuite ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2
    ssl-include none
}

root@ve1100(Active)(/Common)(tmos) modify sys httpd allow replace-all-with { 192.168.206.0/24 }

root@ve1100(Active)(/Common)(tmos) list sys httpd
sys httpd {
    allow { 192.168.206.0/24 }
}