Technical Articles
F5 SMEs share good practice.
cancel
Showing results for 
Search instead for 
Did you mean: 
KevinGallaugher
F5 Employee
F5 Employee

The F5 Beacon capabilities referenced in this article hosted on F5 Cloud Services are planning a migration to a new SaaS Platform - Check out the latest here.

Introduction

This article is part of a series on implementing Orchestrated Infrastructure Security. It includes High Availability, Central Management with BIG-IQ, Application Visibility with Beacon and the protection of critical assets using F5 Advanced WAF and Protocol Inspection (IPS) with AFM. It is also assumed that BIG-IQ is deployed, and basic network connectivity is working.

If you need help setting up BIG-IQ for the first time, refer to the Dev/Central article series Implementing SSL Orchestrator here. That article covers SSL Orchestrator but the procedure to add Advanced WAF and AFM to BIG-IQ is the same.

This article focuses on configuring BIG-IQ version 7.1.0 to manage F5 Advanced WAF, AFM and SSL Orchestrator. It covers management of BIG-IP running version 15.1.0.4 and SSL Orchestrator version 7.4.9, and version 16.0.0 with AFM and Advanced WAF. 

Please forgive me for using SSL and TLS interchangeably in this article.

This article is divided into the following high level sections:

  • Import BIG-IP Devices into BIG-IQ
  • Service Import Error Resolution
  • Schedule regular backups of BIG-IP devices
  • Push backups to BIG-IP device

Import BIG-IP Devices into BIG-IQ

From the BIG-IQ GUI go to Devices > BIG-IP Devices. This is where you add new devices to be managed by BIG-IQ. You should add the two SSL Orchestrator’s using the Dev/Central article above. Click Add Device(s) to add Advanced WAF and AFM devices.

0151T000003pkPYQAY.png

Select the option to Add BIG-IP device(s) and automatically discover and import services. Then click Add Devices.

0151T000003pkPiQAI.png

Enter the IP Addresses of the Devices you want to add, 192.168.41.3 and 192.168.41.4 in this example (use the Plus sign to add another IP address field). These are the two AFM devices. Enter the username and password to access these devices. Under Services check the box for Network Security (AFM) then scroll down.

0151T000003pkPsQAI.png

Check the box to enable Statistics Collection. You can configure a Zone and/or Cluster Display Name if desired. Click Save and Close.

0151T000003pkPxQAI.png

Your screen should look like the following. Click Add Devices so we can add the two Advanced WAFs.

0151T000003pkQ2QAI.png

Enter the IP Addresses of the Devices you want to add, 192.168.41.21 and 192.168.41.22 in this example (use the Plus sign to add another IP address field). These are the two Advanced WAF devices. Enter the username and password to access these devices. Under Services check the box for Web Application Security (ASM) then scroll down.

0151T000003pkPjQAI.png

Check the box to enable Statistics Collection. You can configure a Zone and/or Cluster Display Name if desired. Click Save and Close.

0151T000003pkQ7QAI.png

Click Discover and Import.

0151T000003pkQCQAY.png

You should see a Progress screen. Click Close.

0151T000003pkQ8QAI.png

When complete, your screen should look similar to the following.=

0151T000003pkQ9QAI.png

Service Import Error Resolution

Some devices had errors during Import. Click the first one to resolve it.

0151T000003pkQ3QAI.png

There was a conflict importing SSM. Check the box to create a snapshot of the configuration then click Import.

0151T000003pkPyQAI.png

The following items were changed on the BIG-IP. You can choose to import these into the BIG-IQ by selecting Set all BIG-IP. Click Continue.

0151T000003pkPtQAI.png

A dialog screen will present you with more information about what you’re doing. Click Resolve.

0151T000003pkQMQAY.png

Click Import to complete the import process. You may want to create a Snapshot of the configuration by checking the box.

0151T000003pkPuQAI.png

The BIG-IP Devices screen should look like this. The Advanced WAF device has been successfully imported. Repeat this process for any devices with an import error.

0151T000003pkQbQAI.png

When all Devices are successfully imported the screen should look like this.

0151T000003pkQgQAI.png

Schedule regular backups of BIG-IP Devices

Now is a good time to schedule regular Backups. Check the box next to Status to select all the BIG-IPs. Click the down Arrow next to More and select Schedule Backup.

0151T000003pkQAQAY.png

Give the Backup a name, Backup_all in this example. There are several options here that you may wish to enable. For Local Retention Policy, it’s not a bad idea to keep multiple backups, 3 in this example. The Start Date and time can be adjusted to suit your needs.

0151T000003pkQhQAI.png

The Devices should automatically be selected. You can optionally enable the Archiving of Backups to an external SCP or SFTP server. Click Save & Close.

0151T000003pkQ4QAI.png

Push backups to BIG-IP Device

At some point you may need to restore one of your BIG-IP devices from a backup. To do this select the Devices tab > Back Up & Restore > Backup Files.

0151T000003plIYQAY.png

From here you can view the different backup files. You can also Compare, Download, Restore or Delete backup files. Select the backup you would like to restore then click Restore.

0151T000003plIdQAI.png

You will be presented with a confirmation message warning you that the configuration of the device is about to be overwritten from the backup. Click Restore to proceed.

0151T000003plIZQAY.png

While the device is being restored you will see the following.

0151T000003plIaQAI.png

Select BIG-IP Devices to check the status of the device when the restore is complete. 

0151T000003plInQAI.png

Summary

In this article you learned how to import BIG-IP devices into BIG-IQ, import the BIG-IP Services and schedule regular backups of the BIG-IP devices.

Next Steps

Click Next to proceed to the next article in the series.

Version history
Last update:
‎10-Aug-2022 17:04
Updated by:
Contributors