Forum Discussion

daboochmeister's avatar
daboochmeister
Icon for Cirrus rankCirrus
Mar 07, 2015

How do you tell if you're licensed for OAM WebGates in the APM module?

Hi - we have a full APM license - I had always understood that to include OAM WebGate support. Is that true? If not, how do I tell whether the OAM WebGate support is present in APM?

 

thx!

 

BIG-IP Access Policy Manager (APM)
design
oam
security
  • daboochmeister's avatar
    daboochmeister
    Icon for Cirrus rankCirrus
    Mar 09, 2015

    To close the book on this - I asked because we are having problems integrating OAM - eamtest and oamtest worked fine, but anytime we applied OAM to a virtual server, the VS would do a TCP RST on any connection attempt.

     

    This turns out to be a known problem with 11.5.0/11.5.1 ... caused as a side effect of the move to CMP in 11.4.0, which affected the communication between eam and tmm. Copying in info provided by F5 support:

     

    Per our conversation. The issue you're running into is known to us as ID 491478.

     

    The solution is either to Upgrade to 11.5.2, or possibly 11.5.1 HF8 though it's not confirmed to have been fixed in that release, or to work around the issue by doing a hand-edit of a specific configuration file on the system.

     

    File and path: /defaults/config_base.conf

     

    Section:

     

    sys ltcfg-instance eam { class-name profile_eam container none ... plugin_name { class-name profile_eam container none instance-name eam value "External Access Management plug-in" } plugin_threads { class-name profile_eam container none instance-name eam value "1" <---- Change this value to "tmms" } plugin_type { class-name profile_eam container none instance-name eam value APM::EAM } } }

     

    Once done, save the file and then a restart of TMM will be required to finish the change: bigstart restart tmm

     

    • daboochmeister's avatar
      daboochmeister
      Icon for Cirrus rankCirrus
      Mar 12, 2015
      To really REALLY close the book - the fix suggested for 11.5.1 didn't work. We are at HotFix 5 - it might have worked if we were at a higher HF, not sure. In any case, we ended up upgrading to 11.5.2, and the fix worked there. One minor detail - I had the 11.5.1 fix in place when I did the upgrade ... our rep said that shouldn't matter, but I haven't tested 11.5.2 without the fix in place, so caveat emptor.
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Mar 07, 2015

    IIRC it's logged on startup... I don't have a full APM box at the moment to check, but certainly it logs in /var/log/apm and /var/log/tmm when you DON'T have a full APM license. e.g.

    [root@bigltm:ModuleNotLicensed:Active:Standalone] log  grep -i oam *
apm:Mar  7 17:06:16 bigltm notice /usr/libexec/eam[7355]: 01490000:5: APM full license is required for OAM to work.
ltm:Mar  7 17:06:16 bigltm notice /usr/libexec/eam[7355]: APM full license is required for OAM to work.
[root@bigltm:ModuleNotLicensed:Active:Standalone] log

    H