For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

TC's avatar
TC
Icon for Nimbostratus rankNimbostratus
Mar 07, 2014

Virtual Server Scripting

Hi All

 

We have a LTM/APM configuration, and have customised the APM logon screen. We now have quite a number of virtual servers and currently to put the virtual servers into maintenance we change the Access Profile setting (located on the virtual server dialog), plus we also change the Default Pool and point to a server holding a variety of maintenance pages, which are in the same style as the logon pages. I've been looking, and failing to find, a way to script changing the access profile setting via a script, preferably using powershell.

 

So is it even possible to change the access profile setting via a script?

 

Any help would be appriciated

 

application delivery
BIG-IP Access Policy Manager (APM)
devops
iControl
LTM
management
security

2 Replies

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Mar 07, 2014

    just changing the access policy shouldn't be an issue i believe. you probably want to look at iControl to make this happen.

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Mar 07, 2014

    If you're running 11.4 or above you could incorporate the new iControl REST API. Here's what that might look like with cURL:

    Removing the access profile:

    curl -sk -u admin:admin -X DELETE https://x.x.x.x/mgmt/tm/ltm/virtual/my_vs/profiles/my_access_profile

    Adding the access profile:

    curl -sk -u admin:admin -X POST https://x.x.x.x/mgmt/tm/ltm/virtual/my_vs/profiles -d '{"name":"my_access_profile"}' -H "Content-Type: application/json"

    It'd be pretty straight forward to incorporate these REST calls into a Perl, Python, PowerShell, or Bash script.

    You could also, alternatively, use a data group to manage maintenance. Something like this:

    when HTTP_REQUEST {
    if { [class match [virtual] equals maint_mode] } {
        ACCESS::disable
        pool maintmode_pool
    }
}

    where "maint_mode" is a string-based data group containing the names of virtual servers that you want to be in maintenance mode. Example:

    ltm data-group internal maint_mode {
    records {
        /Common/my-vs1 { }
    }
    type string
}