For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

John_Ogle_45372's avatar
John_Ogle_45372
Icon for Nimbostratus rankNimbostratus
Apr 01, 2015

F5 APM implementation question

We have had a SSL VPN appliance for a long time. It has a public ip address for outside, of course and an internal address for the inside lan. We also have a LTM virtual pair and want to enable APM.

 

Should I just use private addresses (two self and one floater) for the APM configurations and do NAT at the firewall for the floater address or should I stand up another single VE for APM with one public ip and one internal address, just like the existing SSL VPN box?

 

I am just now looking at APM so I'm sure I don't have the configuration concepts understood completely. Please educate as much as possible...:)

 

Thank you,

 

BIG-IP Access Policy Manager (APM)
security

4 Replies

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Apr 01, 2015

    Hi John,

     

    This is a tough question as we don't know your complete environment and your Sales Team might be better to answer. What is the new APM for? Will it be for testing or will it be for production? How busy is the LTM pair today? Can it handle the additional load with adding the services of APM and the new connections?

     

    My suggestion is that since you are new to looking at APM if you have a VE you can spin up and make it independent then I would go that way. This way you can mess with the box without impacting production as you figure out how to configure APM best for your organization.

     

    Seth

     

  • John_Ogle_45372's avatar
    John_Ogle_45372
    Icon for Nimbostratus rankNimbostratus
    Apr 01, 2015

    The LTM VEs currently don't do much at all and growth is not expected. We have the resources. The APM will mainly be used for SSL VPN use (full tunnel and a few app tunnels). This is a small office.

     

    Thanks,

     

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Apr 01, 2015

    Hi John,

     

    Either way you describe setting it up should be fine for what you are doing. If you have APM licensed on the LTM and want to reduce the overall device management then go ahead and provision APM on the LTM and then either add a new external IP as your virtual address or you can also do a NAT if needed.

     

    Seth

     

  • Tosin_Omojola's avatar
    Tosin_Omojola
    Icon for Altostratus rankAltostratus
    Aug 10, 2015

    Hi everyone, Please, I want to play around with APM in a VE towards eventually implementing it in a production environment. Please, what are the preparations to make. What and what am I to put in place for a basic test of APM's capabilities?

     

    Thank you