F5 Backup procedure over SCP using iCall

Problem this snippet solves:

Purpose: You should consider using this procedure under the following condition. * You want to transfer BIG-IP Backup to the remote SCP Server on a specific frequency, without entering the password each time to transfer the file.

Prerequisites: You must meet the following prerequisite to use this procedure. * You have administrator access to the BIG-IP Configuration utility and Command Line Access. * You have a user account on SCP Server with file transfer privileges.

Description

BIG-IP offers feature to transfer files over a remote SCP Server. Secure Copy (SCP) is the preferred means of transferring files to or from an F5 device. SCP securely transfers files between hosts using the Secure Shell (SSH) protocol for authentication and encryption. Unlike FTP, SCP provides an option to preserve the original date stamp on the file during file transfers. You can use SCP to transfer files between an F5 device and a remote host using either command line SCP or Windows-based SCP.

We can automate the authentication process by export the public key from BIG-IP to SCP Server. By doing this, SCP Server will establish trust relationship with BIG-IP, and will not prompt for the password every-time we transfer files from BIG-IP to SCP Server.

To achieve this, we need to have a user account on SCP Server, which has file transfer privileges. In this document, we will be using Linux based SCP Server.

Once the transfer of files through the SCP works successfully. We can prepare the script done in iCall (as written following) and put it to run in the required interval.

Login to SCP Server

1.Create a user account with permission to accept files from remote location, we will be using f5_user as user account, or you can use root user account (default user account on every Linux system).

2.It is good to have organized directory structure to receive F5 Backup. We will be creating 2 directories on our SCP Server as following.

/F5Backup is the directory to receive F5 backup on a configured frequency (weekly, monthly, yearly etc).

/authorized_key is temporary directory where will be sending the public key from F5 to SCP.

3.To create a directory in any Linux machine, you can use following command,

mkdir /root/…path

Eg.

mkdir /home/f5_user/tmp/F5Backup/

4.Create another directory to copy F5's public RSA key.

mkdir /home/f5_user/tmp/authorized_keys

Login to BIG-IP CLI

Login to F5 CLI
Generate RSA key by executing following.

ssh-keygen -t rsa

The RSA key will authenticate BIG-IP when it communicates with SCP Server.

It would ask you to enter name and password, ignore the prompt by pressing ENTER.
It will generate the Public / Private key under the directory /root/.ssh/id_rsa
Verify the generated key by executing the following command.

cat /root/.ssh/id_rsa.pub

This should show you the public key, you have generated using above command.
Send this public key to your Linux SCP Server. (We will be using SCP command to transfer the file from F5 to Linux Server).

scp id_rsa.pub f5_user@10.1.20.222:/tmp/authorized_keys

It will prompt for the password, enter the password for the f5_user user.
In case if you are using other user account than f5_user, which has file transfer permission granted, you can replace f5_user with that user account, and keep the rest of the command as it is.

Back to SCP Server

Check if the Public key sent from F5 is received successfully under /tmp/authorized_keys or not.

cat /f5_user/tmp/authorized_keys

Note, in case if you have used other user account than "f5_user", replace the "f5_user" with the username you are using.
Copy the key to right location, in order to authorize SCP connection from F5.

cat /f5_user/tmp/mykey >> /f5_user/.ssh/authorized_keys

If "authorized_keys" directory isn't exist, create a one by using mkdir command as mentioned earlier in the document.
Verify the key is successfully placed under /f5_user/.ssh/authorized_keys or not.

cat /f5_user/.ssh/authorized_keys

Once the key successfully placed to the right location, it is time to test the connectivity from F5 to SCP Server.

Switch back to F5

F5's CLI,

scp filetest f5_user@10.1.60.240:/home/f5_user/tmp/

filetest 100% 5 0.0KB/s 00:00

If you have notices, this time it won’t ask for the password. In case if it still prompts, means you haven’t place the RSA key to the right place. The objective to place the RSA key under the user directory/.ssh/authorized_key.

Once the connectivity is tested successfully, we can try to send F5’s UCS file over SCP to the remote server by the same method. Here, we can use the following script to generate the BIG-IP Backup and send it to the remote server.

F5 CLI, type the following to type the script as following.

Create a script with the command "tmsh create sys icall script <script name>" and then edit with vi and insert the content below.</p> </script>

How to use this snippet:

sys icall script auto_backup {
app-service none
definition {
    #Delete backup files
    exec rm -f /shared/tmp/*.ucs
    #Set Current Date/Time for Filename
    set cdate [clock format [clock seconds] -format "%Y%m%d"]
    #Set source repository
    set localpath "/var/local/ucs/"
    #Set destination repository
    set destinationpath "/home/teste/f5_backups"
    #Set remote host
    set host "10.1.20.222"
    #set remote user
    set user "f5_user"
    #Set device hostname
    set hostname [exec uname -n | cut -d "." -f1]

    #Set source repository
    cd $localpath

    #Delete files created more than 45 Days.
    catch { exec find "/var/local/ucs/" -type f -mtime +45 | grep -v .conf | xargs rm -f {} ; }

    #Delete UCS file if it exists
    catch { tmsh::delete sys ucs $hostname }

    #Export UCS
    tmsh::save sys ucs $hostname

    #Set temporary path
    set tmpdir "/shared/tmp/"

    append filename $hostname "_" $cdate

    #Copy UCS to temporary path
    exec cp $localpath$hostname.ucs $tmpdir$filename.ucs

    #Set Remote path
    append destination $user "@" $host ":" $destinationpath
    #Set source path
    append source $tmpdir $hostname "_" $cdate ".ucs"

    #Send the files via SCP. Prerequisite: The public key of BIG-IP must be registered in the file "authorized_keys" of the remote server
    if { [catch { exec scp -c aes128-ctr $source $destination > /dev/null 2> aux }] } {
        exec logger -p local0.info "Backup upload failed."
    }
    else {
        exec logger -p local0.info "The backup has been successfully sent to $destination."
            }
    exec rm -f aux
}
description none
events none
`</pre>

}

**Create the iCall Handler**

I run the backup once a day; however, the periodicity can be adjusted according to the need of each one. In this example, I set the first-occurrence, the interval (once a day), and the script to call:

<pre>`sys icall handler periodic auto_backup { 
    first-occurrence 2019-03-27:05:01:00 
    interval 86400 
    script auto_backup 
}

I know there are other scripts available in the community (much more sophisticated), the idea is just to share a simple and functional model. Remember that each one must adapt in the best way to meet your need.

Code :

Tested this on version:

12.1

Updated Jun 06, 2023

Version 2.0