ServiceNow discovery and service mapping
Our organization is switching to ServiceNow, as part of the implementation of it the project team wants to be able to discover the F5 BIG-IPs and service mappings. We were able to get the devices discovered after some trial and error with the device certificates. We are now getting stuck on service mapping portion. My understanding is that they are using F5 Rest pattern. Documentation that we were provided is the following: https://www.servicenow.com/docs/r/it-operations-management/itom-visibility/c_LoadBalancerF5BIGIP.html When they try to perform the service mapping discovery portion they get a 401 authentication error on the SNOW discovery tool. We are running BIG-IP 17.1.3.4. Curious if anyone has struggled with the Service mapping portion and if so if you can share your experience/workarounds so we can at least get going in the right direction.
restore the BIG-IP to its previous state (where server.csr displays No CSR) without impact
Hello, I made same mistake and filled in the CSR file (server.csr) under: System > Certificate Management > Device Certificate Management > Device Certificate Signing Request Before this change, the server.csr entry already existed in the GUI and its status was: No Certificate Signing Request After I filled in the CSR parameters, I would like to restore the BIG-IP to its previous state, where server.csr appears with the message: No Certificate Signing Request I would like to remove the CSR information safely without impacting the existing configuration. I performed the following checks: tmsh list sys crypto csr tmsh list sys crypto csr one-line tmsh list sys crypto csr server.csr None of the above commands return any output. I also found that the file exists only at: /config/ssl/ssl.csr/server.csr Furthermore, searching for server.csr under /config did not show any reference to it in the BIG-IP configuration files. If not, what would be the recommended and safest procedure to remove the CSR information and restore the BIG-IP to its previous state (where server.csr displays No Certificate Signing Request) without impacting the current Device , i want to remove it from cli using this command: rm /config/ssl/ssl.csr/server.csr Thank you in advance
F5 insight Software Installation Job possible bug
Hi everyone, I have noticed something strange regarding the new F5 insight product, we have recently deployed a POC to test software distribution and installation and while the distribution works fine and I can see the files are distributed to the two target BIGIPs (verified on BIGIP with the same filename), when I try to run the upgrade job, it fails at the "Readiness checks" with the following error: "Software Image PresenceFailed image Hotfix-BIGIP-17.5.1.8.0.30.19-ENG.iso is not present on the device - distribute the software image to the device before starting the upgrade" Now when I select an image that isn't a Hotfix, the readiness check is alright. Has someone already experienced this issue ? I am running F5 insight v1.2.1-4 with a trial license and my BIGIPs are trial license VEs running on version 17.5.1.8-0.0.19.Dynamic import of data groups
Hello. We use data groups for various kind of black lists, such as undesirable user agents, for instance. That's really efficient, but requires a BigIP administrator intervention for any update. We'd like to switch authoritative origin for those lists to an external location, such as an internal git repository, in order to allow trusted people without access to the administration interface to update those lists in auditable manner, as we do for instance with our firewalls using "dynamic list" feature. There seems to be no such native fonctionality in BigIPs, as even "external" dynamic lists actually relies on files hosted on local filesystem, not to arbitrary URLs. We could probably use a cron task to implement a pull-based update mechanism, or use the API to periodically push changes, but I'm not sure of the reliability of such ad-hoc mechanism, and the potential consequences in case of failure. Is there any alternative for such kind of configuration delegation ? Regards, Guillaume
APM Policy Migration Between Standalone TMOS 17.1.3 Systems
Hi everyone, We're migrating a single production APM policy from an i4600 to an r4600 appliance. Both systems are running TMOS 17.1.3, and the new appliance will not be part of the existing DSC cluster. We tried exporting/importing only the APM policy, but the import fails because referenced objects are missing on the target system. A full UCS restore would also migrate many unused objects that we don't want. Is there a supported way to: Analyze an APM policy and list all required dependencies before import? Export/import only the APM Customization GUI (HTML/CSS/JavaScript templates)? Migrate a single APM policy without restoring the entire APM configuration? Any recommended best practices for this scenario would be appreciated. Thanks in advanced!
How to safely purge logs on BIG-IP (disk usage high)
Hi All, I would like to ask for the best practice to purge/clean log files on BIG-IP system. Current situation: - Disk usage is getting high due to log files - Logs located in /var/log (e.g. ltm, asm, audit, etc.) Questions: What is the recommended way to purge or rotate logs safely? Can we manually delete logs under /var/log ? Is there any tmsh command or utility tool to manage this? How to configure log rotation properly? Thanks in advance!
Local-Only in your browser BIG-IP Report Generator
Leveraging my f5query engine and the Python interface to it, along with my Tcl-LSP Tcl/iRule compiler and analyser, I built a report generator. You can run it locally yourself, it's a single HTML file that embeds all the WASM to do the work, makes no requests to the outside world. I don't have good lab devices to use for demo content anymore so I had to use some SCF files I found on GitHub for the demo. Example Report Report Generator - nothing is ever uploaded, there's no telemetry, the only external URL in it is in the footer pointing to my GitHub. It should have somewhat decent print output. If you have feature requests, bug reports, please open issues on GitHub This work only exists in the rust branch and 2.x pre-releases if you're interested in the code.
Migration doubt
Scenario is: 4 serie i2600 forming sync-group GTM. Being two diferent cluster HA active/standby LTM. First ill change one pair and another day the another. My idea for migrating an LTM/GTM pair from the iSeries platform to the rSeries platform is as follows: We used same cables from i series and same names and IPs to do it easier to customer First, I disconnect all the cables from the standby iSeries unit. The active iSeries unit will remain active in standalone mode. Next, I connect the interfaces used for the synchronization and failover network from both iSeries appliances to the new rSeries appliances. The HA pair has already been configured on the new rSeries units, so one will be active and the other will be in standby. Once the standby rSeries node is in place, I connect all the service cables to it. After all the service cables have been connected and I have verified that everything looks correct (ARP entries, pools, etc.), I proceed to run the bigip_add and gtm_add commands against the active iSeries node. It is important to note that the iSeries and rSeries appliances will never form an HA cluster with each other. After running both commands, I verify that everything is operating correctly before forcing the active iSeries node offline and allowing the rSeries node to become active. If I face any issues while running the bigip_add or gtm_add commands, since the new rSeries nodes use the same hostnames and IP addresses as the previous iSeries appliances, I may need to remove the trusted certificates associated with the old appliances from the other BIG-IP devices before attempting the commands again. Anything to keep in mind? or any potencial issie doing like that?? Would it be necessary or recommended to temporarily take the GTM cluster being migrated out of service, or is there no significant risk in keeping it operational? Its my first GTM migration in a bit lost.Doubt adding F5 in sync-group
I need to replace an LTM-GTM cluster. I will replace the standby node first. The sync-group are 4 devices. My question is about adding it to the GTM sync group. Should I run only the gtm_add command, or do I also need to run the bigip_add command? I'm not sure whether joining a sync group requires both commands or just one of them. I'd also like to know where each command should be executed. I understand that gtm_add is run on the new node being added, but is bigip_add also run on the new node? how can i delete the old nodes for the sync-group when its donde the change?
