For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

amolari's avatar
amolari
Icon for Cirrostratus rankCirrostratus
Sep 22, 2014

iCall to dynamically configure datagroup at Access Policy apply

i need to workaround some apm limitations using irules and datagroups. Is the "Access policy apply" action also an iCall trigger? The idea would be to parse the Access policy within an iCall script and modify entries of a few data groups with specific values configured in the AP. Feasible? Thanks - Alex

 

BIG-IP Access Policy Manager (APM)
deployment
iCall
security

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 22, 2014

    It would seem technically possible to trigger an iCall on access policy update, but you'd have to 1) enable MCP logging, 2) reconfigure syslog to send audit logs (/var/log/audit) for APM events to the LTM log (/var/log/ltm), 3) create a user_alert.conf script to trigger on a specific audit message.

     

    In lieu of that, it may be much easier to simply create a periodic iCall handler. Take a look at this example:

     

    https://devcentral.f5.com/wiki/iCall.APM_AD_Site_Awareness.ashx