insert HTTP header according to a value received in Radius accounting
Hi, I'd like to know if the following is somehow achievable: I want that from Every Radius Accounting message (UDP 1813) the BIGIP will look for 3 attributes: Calling-Station-Id, Framed-IP-Address & Acct-Status-Type In case the Radius attribute Acct-Status-Type=1 (Start) the BIGIP will insert an entry to a table in which the key will be the Framed-IP-Address and the value will be the Calling-Station-Id. In case the Radius attribute Acct-Status-Type=2 (Stop) the BIGIP will remove the value of an entry in the same table (remove the value which is the calling-station-id assigned to the framed-ip-address) Then when HTTP transaction arrive from a client IP which appears as a key in the table, the BIGIP will insert the value assigned to that key in the table (i.e. the corresponding Calling-Station-Id) to an HTTP header called "MSISDN". Example: Radius accounting arrives with following attributes: Acct-Status-Type=1 Calling-Station-Id=123456789 Framed-IP-Address=1.1.1.1 An entry is inserted to a table 1.1.1.1 (key) -> 123456789 (value) HTTP request arrives from source IP 1.1.1.1 The F5 will insert a header "MSISDN: 123456789" to the HTTP request before forwarding. Radius accounting arrives with following attributes: Acct-Status-Type=2 Calling-Station-Id=123456789 Framed-IP-Address=1.1.1.1 The value is removed 1.1.1.1 (key) -> (empty) HTTP request arrives from source IP 1.1.1.1 The F5 will not insert a header (not "MSISDN: 123456789" and not "MSISDN: ") Hope it's clear. Thanks in advance, Yaniv
F5 Insight - SSLO Integration
Could you please advise how this section is supposed to be integrated? We have already integrated our SSLO device, but nothing is displayed in this section. If there is any documentation or knowledge base article describing the integration process, we would appreciate it if you could share it with us.F5OS cloud-init on 21.1 does tenants come with DO and AS3 RPM installed?
Hello Everyone, This great new feature https://techdocs.f5.com/en-us/bigip-21-1-0/big-ip-f5os-cloud-init-support-velos-rseries/cloud-init-support-velos-rseries.html is not very well described. I think F5 making a demo session or a Guide with pictures will be helpful. For example do the F5os Tenants come with RPM AS3 and DO installed by default for this to work ? Other than that it is mentioned that the DO yaml file needs to be hosted on F5OS ? Where exactly ?
APM Policy Migration Between Standalone TMOS 17.1.3 Systems
Hi everyone, We're migrating a single production APM policy from an i4600 to an r4600 appliance. Both systems are running TMOS 17.1.3, and the new appliance will not be part of the existing DSC cluster. We tried exporting/importing only the APM policy, but the import fails because referenced objects are missing on the target system. A full UCS restore would also migrate many unused objects that we don't want. Is there a supported way to: Analyze an APM policy and list all required dependencies before import? Export/import only the APM Customization GUI (HTML/CSS/JavaScript templates)? Migrate a single APM policy without restoring the entire APM configuration? Any recommended best practices for this scenario would be appreciated. Thanks in advanced!
Local-Only in your browser BIG-IP Report Generator
Leveraging my f5query engine and the Python interface to it, along with my Tcl-LSP Tcl/iRule compiler and analyser, I built a report generator. You can run it locally yourself, it's a single HTML file that embeds all the WASM to do the work, makes no requests to the outside world. I don't have good lab devices to use for demo content anymore so I had to use some SCF files I found on GitHub for the demo. Example Report Report Generator - nothing is ever uploaded, there's no telemetry, the only external URL in it is in the footer pointing to my GitHub. It should have somewhat decent print output. If you have feature requests, bug reports, please open issues on GitHub This work only exists in the rust branch and 2.x pre-releases if you're interested in the code.F5 CIS applying iRule from one VirtualServer definition to another
Hi everyone, I am experiencing a strange behavior with F5 Container Ingress Services (CIS) where an iRule defined in one VirtualServer resource is being applied to a different VirtualServer on BIG-IP. The setup: I have two VirtualServer manifests sharing the same IP address and partition, but serving different ports — one for HTTPS (443) and one for HTTP (80). The HTTP VirtualServer (cis-dev-80) has the iRule /Common/https-301-redirect explicitly defined, which is expected — it redirects HTTP traffic to HTTPS. I'm not using the parameter httpTraffic because I need the http status code 301 instead of 302. The HTTPS VirtualServer (cis-dev-443) has no iRules defined in its manifest. # cis-dev-443 — no iRules defined spec: virtualServer HTTPSPort: 443 tlsProfileName:dev-tls-profile ... # cis-dev-80 — iRule intentionally defined here only spec: virtualServerHTTPPort: 80 iRules: - /Common/https-301-redirect ... The problem: After CIS reconciles, BIG-IP shows the iRule /Common/https-301-redirect attached to both virtual servers — including cis-dev-443, which should not have it. This causes HTTPS traffic to be redirected back to HTTPS in a loop. Questions: Has anyone else encountered this behavior? Does this needs a different configuration? Any help or pointers to related issues or F5 support articles would be appreciated. Environment: CIS version: 2.20.3 AS3 version: 3.55.0 Kubernetes version: v1.22 Thanks in advanceChanges to DO and AS3 GitHub - no longer monitored
I see Changes to DO and AS3 GitHub pages have been updated with these notices: " AS OF FEBRUARY 2026, THIS GITHUB REPOSITORY WILL NO LONGER BE MONITORED OR UPDATED. This repository will remain available, at least temporarily. You can find the latest RPMs and other files on MyF5 Downloads. Refer to 'Filing Issues and Getting Help' for additional details. " I'm also seeing [Deprecated] notices on some VS Code extensions, which may or may not be related. I haven't been able to find any larger announcements regarding these. I have not been able to find any additional detail. Does anyone know if we are about to see a a large shift (or loss) of tooling around BIG-IP?F5 System Scanner - How I deployed it at scale
Does anyone uses the F5 System Scanner regularly? I was surprised when, a while back, one of my clients told me about this tool. I hadn't read about it anywhere before, and I thought I was pretty well-informed. What is it? https://my.f5.com/manage/s/article/K000160515 It is a small tool that calculates hashes from installed files and compares it with hashes provided by F5. Basically, it's a simple host-based intrusion detection system. You can download it from myF5. Test I tested it the other day, and it seems to work well, except for 1 or 2 false positives because the latest Hotfix isn't supported. I simply changed the hashes in the dat file and the status was ok. My deployment scenario Installing the tool manually on a fleet of F5s and running the scans by hand is not my operating modal. I implemented a Restsh function f5.system-scanner that does the heavy lifting for me in an automatable way. It uploads the f5-system-scanner binary and the dat file with the hashes to the F5. Runs the f5-system-scanner in the background and downloads the report after it finishes it. The script exits with an error code if the scanner found a hash mismatch. This is the ideal basis to put it in a pipeline and deploy it at scale. You can download Restsh for free: https://github.com/AxiansITSecurity/Restsh The pipeline itself is part of the Axians Automation Framework, a enterprise ready GitOps framework for F5 BIG-IP. The Future I hope F5 maintenance this nice small utility further and updates the hashes for future F5 releases. Has anyone more infos about it than I have?CPU load when Prometheus is scraping metrics from F5 BIG-IP LTM
We are experiencing an issue where Prometheus is scraping metrics from F5 BIG-IP LTM, causing high CPU and memory utilization on the F5 device. Initial step, we have adjusted the scraping interval to 1 minute, but the issue still. Are there any recommended tuning options or best practices?
Need BIG-IP VE Lab License for Personal Study/Learning
Hi F5 Community, I am setting up a personal home lab to learn. F5 BIG-IP for certification preparation. I have deployed BIG-IP VE but need a lab license. to access the management GUI. Could anyone help me get a free lab/evaluation? license for personal learning purposes? Thank you.
