Big-IQ use TMSH to manage BIG-IP configuration in Silo
Hi experts, Is it possible to use the TMSH in Big-IQ to manage configurations for the Big-IP that is in a Silo? Sometimes it is easier to use the TMSH to duplicate configuration, such as an SSL-client profile in the command line than clicking for each setting in the GUI. We used to do that on the Big-IP but now since they are all centrally managed by the Big-IQ, we can't do that anymore. Where is Silo stored on the Big-IQ? Is it in a specific directory? Thanks! DifanSolved1.6KViews2likes4CommentsHow to manage AS3 BIG-IQ deployments and shared objects
Hi, I have a question around how to utilize AS3 and BIG-IQ. Currently I am deploying AS3 via BIG-IQ to get the application statistics in BIG-IQ. However, I cannot use resources created in BIG-IQ within the AS3 declarations. For example, I do not want to store my ssl/tls certificates within the AS3 json that will be in public (-ish) revision control. Likewise, I want the iRules created as on BIG-IQ that can be shared between virtual servers/applications and not squashed on an unreadable line in the AS3 json. However, it appears BIG-IQ will only sync these objects to BIG-IP when you create a virtual server within BIG-IQ (outside of AS3). This leads to the AS3 declaration failing as AS3 can't find these /Common/ objects on the BIG-IP at deployment time. Also, it is unclear how to create applications (again AS3 via BIG-IQ) and pin them to different traffic-groups for an active-active BIG-IP setup. It seems all AS3 deployments are stuck the traffic-group-1. How are people currently managing referencing "shared" things such as iRules/certificates/policies and pushing them with BIG-IQ in a AS3-only world? Does anyone have any good overviews of this level of managing things? Documentation I've seen seems specific to just using AS3 or just using BIG-IQ deployments, etc.459Views2likes1CommentManaging DataGroups from BIG-IQ
A customer today asked me about managing DataGroups from within BIG-IQ as they want to start using it for all configuration work. However they were unable to find where DataGroups could be managed from within BIG-IQ. I've also had a look and haven't been able to find anything relating to this on the GUI or by searching for documentation. Any clues gratefully received.1KViews2likes5CommentsBIG-IQ DCD tokumx.log files filling up
I am running BIG-IQ, trying to get it running is more accurate. Version 6.1.0 I have tokumx.log files being created on my DCD, so many that it is quickly filling up /var I am not having much luck finding anything regarding what I am seeing. Has anyone else experienced this behavior?514Views1like3CommentsAttacks won't log in Events Dos Summary. Just in Dashboard
Hi, i'm trying to understand why when i start an attack to mine BIG IP AFM, the Dashboard on IQ shown all the informations about attack. But in Events> Dos Summary unfortunately the log are empty. Anyone have some idea about this issue?412Views1like1CommentLocal users account are not working in Big-iq.
I have created local users account with administrator role and permissions in F5 Big-iq to run some tests. When I logout and login again with the user that I created, big-iq was giving me authentication failure message in both gui and cli. I used the correct password, verified audit logs just says authentication failed with no explanation. Is this some bug or is it normal behavior of big-iq not to allow any local account other than admin.1.3KViews1like6CommentsIs there Limitation of irule "virtual".. can we do it like this?
Hi We have BIG-IQ and BIG-IP AWAF. I see that BIG-IQ application dashboard is show only 1 application per virtual server. But in BIG-IP AWAF.. we config it as 1 virtual server 100 application (multi domain vip+use irule to check host header and send it to specific pool and choose specific waf policy) So we can't see each application metric in BIG-IQ.... This is our issue. I understand we need to config each vip for each application so BIG-IQ can retrive data from each vip per application but we can't use that many public ip. So I found that we have irule "virtual" which can send traffic to another virtual server. Can we do it like this? Instead of when HTTP_REQUEST { if {[HTTP::host] equals "abc.example.com"} { ASM::enable /Common/abc.example.com >>>> choose pool and waf policy by host header pool /External/Pool_abc.example.com } ------------------------------------ Change to when HTTP_REQUEST { if {[HTTP::host] equals "abc.example.com"} { virtual VS_abc.example.com >>> send it to private ip virtual server by host header which craete a new. } and in virtual server VS_abc.example.com we use private ip and assign pool and waf policy normally so we can add VS_abc.example.com in BIG-IQ application dashboard and see metric per application. But is there any limitation on how to use irule "virtual" like this? Is this practical?730Views1like3CommentsSpecify node based on Client IP, but what if that node is down?
I been trying to figure this out and unable to find an exact answer. I have multiple unknown clients connecting to a virtual address. I also have 2 known clients connecting to the same address. I want them all to round robin as normal, but I always want these two known users to connect to specific nodes. I have persistence configured so when they connect they will stay on which ever node they connect to, this is for everyone. I think I have the iRule figured out.... but what if one of the specified nodes goes down, how do I get that known user to just hit a random node until it gets back up? This is what I am trying. The rule will check the first Known User's IP then send it to node 1, see the second known user and send to node 2, everyone else will hit the pool and round robin as normal. The last part is if node 1 goes down and doesn't respond, it will just hit the pool and round robin to what is available. Is this right, or am I missing something? when CLIENT_ACCEPTED { if {IP::addr [IP::client_addr] equals 172.1.1.1] } { node 1.1.1.1 60006 } elseif {IP::addr [IP::client_addr] equals 172.1.1.2] } { node 2.2.2.2.] 60006 } else { pool servers_60006_pool } } when LB_FAILED { servers_60006_pool }748Views1like2CommentsBIG-IQ 7.0 - Discovery Error for ASM Service - (java.lang.NullPointerException)
I'm running BIG-IQ 7.0 and I'm unable to Discover the ASM module on 2 BIG-IP's, (running 12.1.2 and 13.1.0.4). LTM and DNS modules are discovered and configs imported with no issues. Below is the error messages from restjavad.0.log. Has anyone ever run into this issue? Thanks, Dave. [INFO][04 Feb 2020 09:08:42 CST][/cm/security-shared/tasks/discover-config/60e17daf-bf8b-43b7-ab9f-340f8898271c/worker SharedDiscoveryTaskWorker] Discover: Elapsed times in mSec: GET_BIG_IP_INFO:2 GET_PROVISIONING_INFO:121 VERIFY_PROVISIONING:57 UPDATE_INPROCESS_STATE:66 WORKER_SPECIFIC_PREPROCESSING:66 CHECK_BULK_DISCOVERY_SUPPORT:58 DISCOVER_OBJECTS:2970 POST_DISCOVERY_PROCESSING:59 UPDATE_DISCOVERED_STATE:69 UPDATE_DEVICE:58 (Total 3526) [ERROR][04 Feb 2020 09:08:44 CST][/cm/asm/tasks/discover-config/5cf10f82-3af1-4a7f-95e6-bcb2648b218c/worker AsmDiscoveryTaskWorker] java.lang.NullPointerException at java.util.concurrent.ConcurrentHashMap.putVal(ConcurrentHashMap.java:1011) at java.util.concurrent.ConcurrentHashMap.put(ConcurrentHashMap.java:1006) at com.f5.rest.workers.asm.utils.ImportExportConversionUtil.addLocalAttackTypeSelfLinkToId(ImportExportConversionUtil.java:841) at com.f5.rest.workers.asm.utils.AsmUtils$8.completed(AsmUtils.java:982) at com.f5.rest.workers.asm.utils.AsmUtils$8.completed(AsmUtils.java:972) at com.f5.rest.common.RestOperation.complete(RestOperation.java:2713) at com.f5.rest.common.RestCollectionItemsLoadedCompletion.expandCollectionItems(RestCollectionItemsLoadedCompletion.java:128) at com.f5.rest.common.RestCollectionItemsLoadedCompletion.completed(RestCollectionItemsLoadedCompletion.java:62) at com.f5.rest.common.RestCollectionItemsLoadedCompletion.completed(RestCollectionItemsLoadedCompletion.java:25) at com.f5.rest.common.RestOperation.complete(RestOperation.java:2713) at com.f5.rest.workers.storage.StorageWorker$8.completed(StorageWorker.java:814) at com.f5.rest.workers.storage.StorageWorker$8.completed(StorageWorker.java:810) at com.f5.rest.workers.storage.TransactionRunnable$TxRunCompletion.run(TransactionRunnable.java:644) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) [ERROR][04 Feb 2020 09:08:44 CST][/cm/asm/tasks/discover-config/5cf10f82-3af1-4a7f-95e6-bcb2648b218c/worker AsmDiscoveryTaskWorker] no message: java.lang.NullPointerException [ERROR][04 Feb 2020 09:08:44 CST][/cm/global/tasks/device-discovery/afd4319a-8114-49b1-be50-44b17031a007/worker DiscoverySuperTaskWorker] Failed to process module tasks for device xx-bigip-13.1.0.4.labs.wwtatc.local (10.253.x.x): At least one module has failed [ERROR][04 Feb 2020 09:08:45 CST][/cm/global/tasks/device-discovery/afd4319a-8114-49b1-be50-44b17031a007/worker DiscoverySuperTaskWorker] Failed to process module tasks for device xx-bigip-13.1.0.4.labs.wwtatc.local (10.253.x.x): At least one module has failedSolved1.6KViews1like11CommentsWhere do we create Cipher Rules and Groups on BIG-IQ?
I can't seem to find where to create cipher rules and groups on BIG-IQ 6.1. I have configured some on our BIG-IPs but can't seem to find them on BIG-IQ. Anyone know where I can find them or if they just aren't available in BIG-IQ?299Views1like1Comment