BigIP Report Old

@Mike,

How would this handle Forwarding(IP) layer 3 vips since they don't have the option for an HTTP profile?

@Patrik,

I'm wondering: 1st is it exposed via icontrol? 2nd If it is just as simple as including the get_type while building the data does it make sense to include. 3rd If we include it where do we put it on the table? under the virtual server?

Basically my requirement is to use the bigipreport to let security know which vips are handling their own SSL protocols, ciphers, certs, etc. as an auditing tool.

E

E,

we have Forwarding(IP) for each one our Route Domains as pass-through VS and are showing HTTP Profile as No in the column.

shown on the LTM config for pass_through_rd111

Hi guys!

Many questions at once (nice to get some activity!). :)

Mike:

The code is "open source" so you may do what you like. You can even contribute on Github like Tim Riker has done. :) To solve your issue I think it would be beneficial to have a Skype call, perhaps tomorrow?

Esloan:

One way to sort out virtual servers that are offloading SSL is to sort on SSL = Yes as a column filter. If that does not work I could add an additional column to my backlog, or add which VIP type it is in the virtual server details in which case it could easily be exported/filtered via the json files.

/Patrik

Hello Patrik,

Skype would work for me. I am in Arizona currently on Pacific Time Zone. Let me know what time works for you?

Add me on skype? My details are here (use the email):

http://loadbalancing.se/about/

/Patrik

So this is probably one of the largest asks and I understand if this is not on your roadmap or too difficult to do, but what are the chance that you might incorporate SSL/TLS statics? So every company that uses F5 and provides services in which they have to protect PCI/PAN/PII data (Username/Passwords/Personal Info/CreditCards/etc) are having to adhere to the new PCI regulations which state that you have to be off TLS 1.0 by June 30th 2018. I as are many of my colleges are being asked to provide SSL/TLS stats. The problem is, the stats are accumulative from the last time the F5 was rebooted, so you have to poll the stats in real-time. Below are by in large the stats most are focused on to meet these requirements. Any suggestions are more than welcome by myself and thousands of Admins like myself. In closing this tool you have built is absolutely amazing and I'm floored by the time you have invested. I've started sharing with some of my peers within my org and once I get this secured with APM, I'm planning to share it with peers outside. Thank you!

[jeff@EC-LB2:Active:In Sync] ~ tmsh show ltm profile client-ssl /Test/ClientPROD* | egrep -E 'Ltm|Proto' Ltm::ClientSSL Profile: /Test/Client-0120-PROD-SSL

Hi Jeff!

Thank you for your kind words. It's feedback that's been fueling the development over the years. :)

Gathering statistics is a different beast altogether. BigIPReport is a 100% clientside application (except the generation). Adding a database would be possible, but would make the installation much harder. Of course, I could utilize flat files for statistics, but that would make large installations either take way to long to generate, or to load depending on if the flat files would be processed client side or during the report generation.

However, I recently did a similar exercise with both SSLv3 and TLS1.0 so this might help you. Created a blog post about it here:

https://loadbalancing.se/2018/04/19/gather-cipher-statistics-from-your-f5-device/

It's not 100% of the answer, but if you have some kind of infrastructure in place for log management and visualization you will find that this is a piece of cake.

/Patrik

I've reworked Patrik's datatables implementation to use client side rendering for the main table. Client side load times are much faster. My pull request does not support rendering orphan pools. Is this an important feature for folks?

Patrik has been reviewing my changes and integrating them. We have found BIG-IP Report very useful in our organization.

Thanks!

Hi Tim,

I find the Orphan Pool feature helpful. Recently used as a quick cleanup effort. If there alternative way to quickly find them, I am open to use that route.

Thanks, Mike

OK. Added orphan pools into virtualservers.json and now they show up in the report again.