Orchestrated Infrastructure Security - BIG-IQ

The F5 Beacon capabilities referenced in this article hosted on F5 Cloud Services are planning a migration to a new SaaS Platform - Check out the latest here.

Introduction

This article is part of a series on implementing Orchestrated Infrastructure Security. It includes High Availability, Central Management with BIG-IQ, Application Visibility with Beacon and the protection of critical assets using F5 Advanced WAF and Protocol Inspection (IPS) with AFM. It is also assumed that BIG-IQ is deployed, and basic network connectivity is working.

If you need help setting up BIG-IQ for the first time, refer to the Dev/Central article series Implementing SSL Orchestrator here. That article covers SSL Orchestrator but the procedure to add Advanced WAF and AFM to BIG-IQ is the same.

This article focuses on configuring BIG-IQ version 7.1.0 to manage F5 Advanced WAF, AFM and SSL Orchestrator. It covers management of BIG-IP running version 15.1.0.4 and SSL Orchestrator version 7.4.9, and version 16.0.0 with AFM and Advanced WAF.

Please forgive me for using SSL and TLS interchangeably in this article.

This article is divided into the following high level sections:

Import BIG-IP Devices into BIG-IQ
Service Import Error Resolution
Schedule regular backups of BIG-IP devices
Push backups to BIG-IP device

Import BIG-IP Devices into BIG-IQ

From the BIG-IQ GUI go to Devices > BIG-IP Devices. This is where you add new devices to be managed by BIG-IQ. You should add the two SSL Orchestrator’s using the Dev/Central article above. Click Add Device(s) to add Advanced WAF and AFM devices.

Select the option to Add BIG-IP device(s) and automatically discover and import services. Then click Add Devices.

Enter the IP Addresses of the Devices you want to add, 192.168.41.3 and 192.168.41.4 in this example (use the Plus sign to add another IP address field). These are the two AFM devices. Enter the username and password to access these devices. Under Services check the box for Network Security (AFM) then scroll down.

Check the box to enable Statistics Collection. You can configure a Zone and/or Cluster Display Name if desired. Click Save and Close.

Your screen should look like the following. Click Add Devices so we can add the two Advanced WAFs.

Enter the IP Addresses of the Devices you want to add, 192.168.41.21 and 192.168.41.22 in this example (use the Plus sign to add another IP address field). These are the two Advanced WAF devices. Enter the username and password to access these devices. Under Services check the box for Web Application Security (ASM) then scroll down.

Check the box to enable Statistics Collection. You can configure a Zone and/or Cluster Display Name if desired. Click Save and Close.

Click Discover and Import.

You should see a Progress screen. Click Close.

When complete, your screen should look similar to the following.=

Service Import Error Resolution

Some devices had errors during Import. Click the first one to resolve it.

There was a conflict importing SSM. Check the box to create a snapshot of the configuration then click Import.

The following items were changed on the BIG-IP. You can choose to import these into the BIG-IQ by selecting Set all BIG-IP. Click Continue.

A dialog screen will present you with more information about what you’re doing. Click Resolve.

Click Import to complete the import process. You may want to create a Snapshot of the configuration by checking the box.

The BIG-IP Devices screen should look like this. The Advanced WAF device has been successfully imported. Repeat this process for any devices with an import error.

When all Devices are successfully imported the screen should look like this.

Schedule regular backups of BIG-IP Devices

Now is a good time to schedule regular Backups. Check the box next to Status to select all the BIG-IPs. Click the down Arrow next to More and select Schedule Backup.

Give the Backup a name, Backup_all in this example. There are several options here that you may wish to enable. For Local Retention Policy, it’s not a bad idea to keep multiple backups, 3 in this example. The Start Date and time can be adjusted to suit your needs.

The Devices should automatically be selected. You can optionally enable the Archiving of Backups to an external SCP or SFTP server. Click Save & Close.

Push backups to BIG-IP Device

At some point you may need to restore one of your BIG-IP devices from a backup. To do this select the Devices tab > Back Up & Restore > Backup Files.

From here you can view the different backup files. You can also Compare, Download, Restore or Delete backup files. Select the backup you would like to restore then click Restore.

You will be presented with a confirmation message warning you that the configuration of the device is about to be overwritten from the backup. Click Restore to proceed.