APM
34 TopicsAPM/OAuth2 : auto apply changes made by discovery
Hi, I've setup OAuth2 to Azure EntraID following this documentation. It works well but I'm only facing a serious issue. In the OAuth provider configuration, I've enabled the discovery job to run once per day. This allows the BigIP to fetch any new certificate and/or JWT as provided by the app on EntraID. The problem is that when the certificate or the JWT change, you have to re-apply the per-session policy in order for the change to take effect. And on multiple occasion, the access to our critical applications failed because the changes were'nt applied in a timely manner. Is there a way to automatically apply the changes made by the OAuth discovery job ? Running version : BigIP 17.1.1.1Solved108Views0likes8CommentsMdm server internal error
Hi All, I have a F5 APM with End point Management Systems configured to make connection with microsoft intune to update the mdm complaince database in the F5. We have running this configuration for many years and since 14 feb, the F5 is not able to make connection to microsoft intune to update the mdm complaince database. in tthe GUI i see the following error message: "Mdm server internal error". The hardware is running on version 15.1.8.2. Has anyone the same issue or have solve the issue. Thanks.99Views0likes6CommentsF5OS share APM VPN licence across tenant clusters
Hello, I have deployed a pair of r5900 series appliances. On these appliances, I have an Active/Standby tenant cluster of F5 BIG IP running with the APM module provisioned and an APM configuration dedicated to SSL VPN using the F5 Edge Client. The F5OS chassis are using 3 licences : r5900 Best bundle APM 1000 VPN Users (x2) This means that the production environment can handle up to 2000 concurrent users connected at the same time, on the APM-enabled BIG-IP tenants. My question is the following : Can I create 2 new tenants running BIG-IP with APM module and create a new APM configuration for VPN testing purposes ? How are the "APM 1000 VPN Users" licence shared across tenants running on the same r5900 chassis ? In the official F5OS documentation, I have noticed that every tenants inherits the licences provisionned on the F5OS chassis. But there is no explanation regarding the sharing of the VPN seats included in the APM VPN licences. Thank you.Solved89Views0likes4CommentsAPM Local DB multiple groups
Hi, I'm using APM with localdb authentication and performing a group lookup and resource assign ACLs based on the localdb group. It works well with one group and one set of ACLs per group. But what if I want a user to have ACLs from more than one group? do I assign multiple groups to the user? I've sort of tried this but it did not work. Only ACL from one group are applied. Is this sort of functionality supported or is the group field in localdb meant for only one group?76Views0likes3CommentsAPM Session timeout splash
Hi All, We are using APM as oauth client to provide SSO for applications hosted behind LTM, the problem we are facing now F5 is not automatically providing any sign about session timeout, user has to refresh the screen to get the authentication page again is there anyway to implement the timeout splash same as above for max session timeout ? any hit will be appreciated69Views0likes4CommentsWhat is the use of epsec-package file in APM ?
Hello Team , What is the use of epsec-package file in APM ? How EPSEC works in APM ? apm epsec epsec-package epsec-1.0.0-1622.0.iso { create-time 2024-09-19:12:50:37 last-update-time 2024-03-21:11:07:38 mode 33188 oesis-version 4.3.3969.0 revision 1 size 301641728 system-package true updated-by root version 1.0.0-1622.0 }67Views0likes3CommentsHow to Disable fields after AD Password expired
Hi everyone. We have a F5 v17.1.0.3 with APM Profile configured in standard mode customization configuration. We would like to disable the fields "New Password" and "Verify Password" after the AD responds with message "Password Expired". The AAA error message we modified without problems, editing the AAA error message custom. Its possible to disable these fields "New Password" and Verify Password? Regards.65Views0likes2CommentsAPM Import error: config version 15.1 is not compatible with BIGIP version 16.1
I would like to migrate all of our APM policies from old F5 platform (v15.1) to newer F5 platform (v16.1). I can migrate most of the objects, except for APM. I get an error message "Import error: config version 15.1 is not compatible with BIGIP version 16.1" when import on the newer F5. I noticed there is a file calledng-export.conf inside the exported .tar file. Can I modify the following setting to correct version like this? I'm not sure if there will be bunch of other settings that may be not compatible between version. #F5[Version:15.1] #F5[Build:15.1.10.3-0.0.12.0] To #F5[Version:16.1] #F5[Build:16.1.5-0.0.3.0] Have anyone done like this before?Solved62Views0likes3CommentsCLI Command for specific machine "Session Deleted due to user inactivity"
Hello, I have this command that I use to search for a specific machine in the apm logs: zgrep -i "Username 'MACHINE_NAME_GOES_HERE'" /var/log/apm* |wc -l Then I have this one to search for the line “Session deleted due to user inactivity”. It produces a number from ALL machines that encountered this message: zgrep -i "Session deleted due to user inactivity." /var/log/apm* | wc -l I'm wondering if there is a command or another method to look up how many times a specific machine encountered a session deletion due to user inactivity?59Views0likes1CommentYubikey APM and AzureAD question
HEy I'm trying to add the ability to use yubikeys as hardware keys to my Saml/Azureid logins. I saw this doc for how to do it with okta. Application access using YubiKey Authentication with APM and Okta | DevCentral I was wondering if their were similar instructions for Azure AD. It seems like the okta integration relies on okta connecter supporting yubikey in v 16.0. We are currently running 16.1.5, but I don't see something similar in the Azure AD connector. I was wondering how other people have done this? Or if their was something I'm missing? We've been able to add yubikeys to ont eh Azure Ad side, but they never show up when we try to use them as a 2nd factor with The BIG IP Edge client.56Views0likes4Comments