For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Erik's avatar
Erik
Icon for Nimbostratus rankNimbostratus
Sep 26, 2016

Differences between 11.6 and 12.1

Hi all, why is this working in 11.6 but not in 12.1?

 

In version 11.6 the policy-item was successfully created:

 

tmsh create apm policy policy-item ap_test_01 caption ap_test_01 item-type terminal-out

 

Verify that the item was created (do the command again):

 

tmsh create apm policy policy-item ap_test_01 caption ap_test_01 item-type terminal-out

 

01020066:3: The requested Access Policy Item (/Common/ap_test_01) already exists in partition Common.

 

In version 12.1 the same command generate an error:

 

tmsh create apm policy policy-item ap_test_01 caption ap_test_01 item-type terminal-out

 

01071933:3: The access policy item (/Common/ap_test_01) is not referenced by any existing access policy

 

Both configurations are on a new clean install iso. What is missing on 12.1?

 

devops
TMSH

2 Replies

  • James_Thomson's avatar
    James_Thomson
    Icon for Employee rankEmployee
    Sep 26, 2016

    It just looks like 12.1 doesn't allow you to create the object while it is not attached to a policy, but I can't even figure out a way to create it and attach it to a policy simultaneously. Are you able to create a support case and ask them what they expect? The TMSH guide isn't helpful as it just says "Use the GUI"

     

  • Erik's avatar
    Erik
    Icon for Nimbostratus rankNimbostratus
    Sep 27, 2016

    I created a support ticket and got an excellent answer :-) This was a new way to do it. But, then I need to translate this for use with the curl-command.

     

    tmsh create cli transaction

     

    create apm policy agent ending-allow /Common/eple_end_allow_ag { }

     

    create apm policy agent ending-deny /Common/eple_end_deny_ag { }

     

    create apm policy agent ending-deny /Common/eple_end_deny2_ag { }

     

    create apm policy policy-item /Common/eple_end_allow { agents add { /Common/eple_end_allow_ag { type ending-allow } } caption Allow color 1 item-type ending }

     

    create apm policy policy-item /Common/eple_end_deny { agents add { /Common/eple_end_deny_ag { type ending-deny } } caption Deny color 2 item-type ending }

     

    create apm policy policy-item /Common/eple_end_deny2 { agents add { /Common/eple_end_deny2_ag { type ending-deny } } caption Deny2 color 4 item-type ending }

     

    create apm policy policy-item /Common/eple_ent { caption Start color 1 rules { { caption fallback next-item /Common/eple_end_deny } } }

     

    create apm policy access-policy /Common/eple { default-ending /Common/eple_end_deny items add { eple_end_allow { } eple_end_deny { } eple_end_deny2 { } eple_ent { } } start-item eple_ent }

     

    create apm profile access /Common/eple { accept-languages add { en } access-policy /Common/eple}

     

    submit cli transaction