Common Elements for Profiles Tasks

On the Main tab, click

Local Traffic

Profiles

.

On the menu bar, expand or click a profile category and choose the type of profile you want to create.

In the name column, click the system-supplied

dns

profile.

The DNS properties list screen opens.

In the name column, click the system-supplied

dns

profile.

The DNS properties list screen opens.

From the

Response Cache

list, select

Enabled

.

In the Hardware Acceleration area, from the

Protocol Validation

list, select

Enabled

.

Click

Update

.

On the Main tab, click

Local Traffic

Profiles

Databases

MS SQL

.

The MS SQL Profiles list screen opens.

On the Main tab, click

Security

Event Logs

Logging Profiles

.

The Logging Profiles list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

HTTP

.

The HTTP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

SMTPS

.

The SMTPS profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

Rewrite

.

The Rewrite profile list appears.

On the Main tab, click

Local Traffic

Profiles

Services

HTTP Compression

.

The HTTP Compression profile list screen opens.

On the Main tab, click

Acceleration

Profiles

HTTP Compression

.

The HTTP Compression profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

Web Acceleration

.

The Web Acceleration profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

FTP

.

The FTP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

DNS

.

The DNS profile list screen opens.

On the Main tab, click

DNS

Delivery

Profiles

DNS

.

The DNS profile list screen opens.

On the Main tab, click

DNS

Delivery

Profiles

DNS

or

Local Traffic

Profiles

Services

DNS

.

The DNS profile list screen opens.

On the Main tab, click

DNS

Delivery

Profiles

DNS

.

The DNS list screen opens.

In the Name column, click the name of the profile you want to modify.

On the Main tab, click

Local Traffic

Profiles

Services

IIOP

.

The IIOP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

RTSP

.

The RTSP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

Diameter

.

The Diameter profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

RADIUS

.

The RADIUS profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

SMTP

.

The SMTP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

iSession

.

The iSession profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

CIFS

.

The Profiles list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

MAPI

.

The MAPI profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

XML

.

The XML profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

HTTP/2

.

The HTTP/2 profile list screen opens.

On the Main tab, click

Acceleration

Profiles

HTTP/2

.

The HTTP/2 profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

SPDY

.

The SPDY profile list screen opens.

On the Main tab, click

Acceleration

Profiles

SPDY

.

The SPDY profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

FIX

.

The FIX profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

IPsecALG

.

The IPsecALG profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Persistence

.

The Persistence profile list screen opens.

In the Name column, click the name of the relevant persistence profile.

For the

Mirror Persistence

setting, select the check box.

On the Main tab, click

Local Traffic

Profiles

Protocol

Fast L4

.

The Fast L4 screen opens.

On the Main tab, click

Local Traffic

Profiles

Protocol

Fast HTTP

.

The Fast HTTP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Protocol

HTTP Class

.

The HTTP Class profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Protocol

TCP

.

The TCP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

SIP (legacy)

.

The SIP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Protocol

UDP

.

The UDP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Protocol

SCTP

.

The SCTP profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

SSL

Client

.

The Client SSL profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

SSL

Server

.

The Server SSL profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

SSL

Client

or

Local Traffic

Profiles

SSL

Server

.

The Client SSL or Server SSL profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

SSL

OCSP Stapling

.

The OCSP Stapling list screen opens.

Scroll down to

Handshake Timeout

and select the

Custom

check box.

Additional settings become available.

To limit the timeout to a number of seconds, select

Specify

from the list, and type the required number in the

seconds

field.

In the list, the value

Indefinite

specifies that the system continue trying to establish a connection for an unlimited time. If you select

Indefinite

, the

seconds

field is no longer available.

On the Main tab, click

Local Traffic

Profiles

Authentication

Profiles

.

The Profiles list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

Request Logging

.

The Request Logging profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

DNS Logging

.

The DNS Logging profile list screen opens.

On the Main tab, click

DNS

Delivery

Profiles

Other

DNS Logging

.

The DNS Logging profile list screen opens.

On the Main tab, click

DNS

Delivery

Profiles

Other

DNS Logging

or

Local Traffic

Profiles

Other

DNS Logging

.

The DNS Logging profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

OneConnect

.

The OneConnect profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

SplitSession Client

.

The SplitSession Client profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

SplitSession Server

.

The SplitSession Server profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Other

HTTP Proxy Connect

.

The

HTTP Proxy Connect

profile list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

Client LDAP

.

The Client LDAP list screen opens.

On the Main tab, click

Local Traffic

Profiles

Services

Server LDAP

.

The Server LDAP list screen opens.

On the Main tab, click

Local Traffic

Profiles

Analytics

HTTP Analytics

.

If

Analytics

is not listed, this indicates that Application Visibility and Reporting (AVR) is not provisioned, or you do not have rights to create profiles.

The HTTP Analytics screen opens.

In the Logging and Reporting area, select the

AVR Statistics Sample Rate

check box.

The

Enabled 1/ 1 queries sampled

field displays.

In the

Enabled 1/ 1 queries sample

field, change the

1

to the number of queries from which the system takes one sample.

0	No DNS requests are stored in the Analytics database.
1	All DNS requests are stored in the Analytics database.
n>1	Every nth DNS request is stored in the Analytics database.

For the

Statistics Logging Type

setting, click

External

.

From the

Publisher

list, select the publisher that contains the destination to which you want the BIG-IP system to send the statistics.

For the

Statistics Logging Type

setting, verify that

Internal

is selected. If it is not, select it.

Selecting

Internal

causes the system to store statistics locally, and you can view the charts on the system by starting at the Main tab, and clicking

Statistics

Analytics

.

For the

Transaction Sampling Ratio

setting, specify whether the system learns information from every transaction (specify

all

), or performs traffic sampling (specify

1 of every n

transactions).

A high sampling rate (such as

99

) results in less precise statistical data but improves system performance. Adjust the sampling ratio according to expected TPS and quantity of entities.

You can change this setting only on the default Analytics profile.

In the Associated Virtual Servers area, specify the virtual servers for which to capture application statistics:

For the

Virtual Servers

setting, click

Add

.

From the Select Virtual Server popup that opens, select the virtual servers to include and then click

Done

.

Only virtual servers previously configured with an HTTP profile display in the list (because the data being collected applies to HTTP traffic). Also, you can assign only one HTTP Analytics profile to a virtual server; therefore, the list displays only virtual servers that have not been assigned an Analytics profile.

Special considerations apply if using Analytics on a BIG-IP system with both Application Security Manager and Access Policy Manager, where security settings (in Portal Access webtop or an iRule) redirect traffic from one virtual server to another. In this case, you need to attach the HTTP Analytics profile to the second virtual server to ensure that the charts show accurate statistics.

Specify the virtual servers for which to capture traffic:

In the

Virtual Servers

setting, click

Add

.

From the Select Virtual Server list that displays, select the virtual servers and click

Done

.

Only previously configured virtual servers display in the list.

In the Statistics Gathering Configuration area, for

Collected Metrics

, select additional statistics you want the system to collect from the requests:

Option	Description
Max TPS and Throughput	Collects and logs statistics regarding the maximum number of transactions occurring per second (TPS) and the amount of traffic moving through the system. Maximum request and response throughput is collected and recorded separately. Each value is then displayed separately when you drill down into details of Transaction Outcomes ( Statistics Analytics Overview ).
HTTP Timing (RTT, TTFB, Duration)	Collects and logs statistics regarding the HTTP request and response times, including round-trip time, time to first byte and overall transaction duration time.
Page Load Time	Collects and logs statistics regarding the time it takes an application user to get a complete response from the application, including network latency and completed page processing. End-user response times and latencies can vary significantly based on geographic location and connection types.
User Sessions	Collects and logs statistics regarding the number of unique user sessions. For Timeout , select the allowed minutes of user inactivity before the system considers the session to be over. For Cookie Secure Attribute , specify whether to secure session cookies: Always , the secure attribute is always added to the session cookie. Never , the secure attribute is never added to the session cookie. Only SSL , the secure attribute is added to the session cookie only when the virtual server has a client SSL profile (the default value).

By default, the system collects many metrics, including TPS, throughput, server latency, response time, network latency. You can select the metrics here, in addition to the ones already collected, once the Analytics profile is attached to one or more virtual servers.

In the Statistics Gathering Configuration area, for

Collected Entities

, select additional entities to collect statistics for each request.

By default, the system collects many entity statistics, including virtual servers, pool members, browser names, operating system, and so on. You can select the ones here in addition to the ones already collected once the Analytics profile is attached to one or more virtual servers.

When you select

URLs

,

Countries

,

Client IP Addresses

or

Client Subnets

you have additional options configure specific statistics filtering options.

Option	Description
URLs	Saves the URLs that were requested.
Countries	Saves the name of the country where the request came from, and is based on the client IP address criteria.
Client IP Addresses	Saves the IP address where the request originated. The address saved also depends on whether the request has an XFF (X-forwarded-for) header and whether the HTTP profile accepts XFF headers.
Client Subnets	Saves statistics for predefined client subnets. Client subnets can be added in the Subnets area of the default HTTP Analytics profile.
Response Codes	Saves HTTP response codes that the server returned in response to requests.
User Agents	Saves information about browsers making the request.
Methods	Saves HTTP methods in requests.
OS and Browsers	Saves information about the operating system and browser making the request.

In the Statistics Gathering Configuration area, for

Collect URLs

, you can configure whether the system collects traffic from all or from specific URLs.

Select

All

to collect traffic from all URLs.

By default, the system collects traffic from all URLs, when you select

URLs

from the

Collected Entities

list.

Select

Only

to collect traffic from specific URLs.

Specify the URLs for which to capture traffic and click

Add

. You can add up to 10 URLs to the list.

If you select

Only

and leave the list empty, the system collects traffic data from all URLs.

In the Statistics Gathering Configuration area, for

Collect Countries

, you can configure whether the system collects traffic from all or from specific countries.

Select

All

to collect traffic from all countries.

By default, the system collects traffic from all countries, when you select

Countries

from the

Collected Entities

list.

Select

Only

to collect traffic from specific countries.

Specify the countries for which to capture traffic. Select from the Available Countries list and use the arrow keys to move each country to the Selected Countries list. You can add up to 10 countries to the Selected list.

If you select

Only

and leave the list empty, the system collects traffic data from all countries.

In the Statistics Gathering Configuration area, for

Collect Client IP Addresses

, you can configure whether the system collects traffic from all or from specific client IPs.

Select

All

to collect traffic from all client IP addresses.

By default, the system collects traffic from all client IPs, when you select

Client IP Addresses

from the

Collected Entities

list.

Select

Only

to collect traffic from specific client IP addresses.

Specify the client IP addresses for which to capture traffic and click

Add

. You can add up to client IP addresses to the list.

If you select

Only

and leave the list empty, the system collects traffic data from all client IP addresses.

In the Statistics Gathering Configuration area, for

Collect Client Subnets

, you can configure whether the system collects traffic from all or from specific client subnet IPs.

Select

All

to collect traffic from all subnets.

By default, the system collects traffic from all subnets, when you select

Client Subnets

from the

Collected Entities

list.

Select

Only

to collect traffic from specific subnets.

Specify the subnet IPs for which to capture traffic and click

Add

. You can add up to 10 subnet IPs to the list.

You can filter the listed subnets by one type of IP protocol. Adding both IPv4 and IPv6 protocols results in an error.

If you select

Only

and leave the list empty, the system collects traffic data from all subnets.

If one of the

Traffic Capturing Logging Type

check boxes is selected, in the Capture Filter area, adjust the settings to specify criteria to determine what application traffic to capture.

You can use the captured information for troubleshooting purposes.

If you want the system to send email notifications, review the

SMTP Configuration

field to ensure that a configuration is specified and not the value

None

.

You can configure SMTP only in the default Analytics profile. If it is not configured, you can save the profile and edit the default profile where you can select an existing SMTP configuration or create a new one. (If you click the

analytics

link without saving the new profile you are working on, you will lose the unsaved changes.)

For the

Notification Type

setting, select how you want the system to send alerts and notifications.

Syslog	Select Syslog if you want the system to send notification and alert messages to the local log system. You can view the messages on the System Logs Local Traffic screen.
SNMP	Select SNMP if you want the system to send notification and alert messages as SNMP traps. You can create the trap by clicking Configuration can be found here ( System SNMP Traps Destination ). Enabling SNMP automatically sets up Syslog notifications, too.
E-mail	Select E-mail if you want the system to send notification and alert messages to email addresses. Type each email address in the Notification E-Mails field, and click Add to create the list. This option requires that the default analytics profile includes an SMTP configuration.

When you select a notification type, the screen displays the Alerts and Notifications Configuration area, where you can indicate the criteria for alerts and notifications.

Click

Create

.

The Create New Logging Profile screen opens.

Click

Create New Profile

.

The Create New Profile Rewrite pop-up screen opens.

Click

Create

.

The New Authentication Profile screen opens.

Click

Create

.

The New Fast L4 profile screen opens.

Click

Create

.

The New DNS Profile screen opens.

Click

Create

.

The New DNS Logging profile screen opens.

Click

Create

.

The New HTTP Compression profile screen opens.

Click

Create

.

The New Diameter profile screen opens.

Click

Create

.

The New HTTP Profile screen opens.

Click

Create

.

The New FTP Profile screen opens.

Click

Create

.

The New SCTP Profile screen opens.

Click

Create

.

The New SMTP Profile screen opens.

Click

Create

.

The New SMTPS Profile screen opens.

Click

Create

.

The New HTTP Class Profile screen opens.

Click

Create

.

The New Web Acceleration Profile screen opens.

Click

Create

.

The New HTTP Analytics profile screen opens.

Click

Create

.

The New Server SSL Profile screen opens.

Click

Create

.

The New Client SSL Profile screen opens.

Click

Create

.

The New Client LDAP Profile screen opens.

Click

Create

.

The New Server LDAP Profile screen opens.

Click

Create

.

The New Request Logging Profile screen opens.

Click

Create

.

The New Persistence Profile screen opens.

Click

Create

.

The New HTTP/2 Profile screen opens.

Click

Create

.

The New SPDY Profile screen opens.

Click

Create

.

The New FIX Profile screen opens.

Click

Create

.

The New GTP Profile screen opens.

Click

Create

.

The New OneConnect Profile screen opens.

Click

Create

.

The New MS SQL Profile screen opens.

Click

Create

.

The New SplitSession Client Profile screen opens.

Click

Create

.

The New SplitSession Server Profile screen opens.

Click

Create

.

The New HTTP Proxy Connect Profile screen opens.

Click

Create

.

The new OCSP Stapling Profile screen opens.

Click

Create

.

Click

Finished

.

Click

Update

.

Click

Delete

.

Click the name of a profile.

In the

Name

field, type a unique name for the profile.

From the

Parent Profile

list, retain the default value,

clientldap

.

From the

Parent Profile

list, retain the default value,

serverldap

.

From the

Parent Profile

list, retain the default value or select another existing profile of the same type.

From the

Parent Profile

list, select the profile from which you want to inherit settings.

The default profile is often used as the parent profile.

The new profile inherits the values from the parent profile. If the parent is changed, the inherited values in the new profile also change.

On the Main tab, click

Local Traffic

Profiles

Message Routing

SIP

.

The SIP transport config list screen opens.

On the menu bar, click

Router Profiles

.

The Router Profiles list screen opens.

Click

Create

.

The New SIP Router Profile screen opens.

In the

Name

field, type a unique name for the SIP router profile.

From the

Operation Mode

list, select

Load Balancing

.

In the

Maximum Pending Messages

field, type ...

In the

Maximum Pending Bytes

field, type ...

For the

Static Routes

setting, move routes that define how the BIG-IP system load balances SIP traffic from the

Available

list to the

Selected

list.

In the

Transaction Timeout (seconds)

field, type the number of seconds...

On the menu bar, click

Session Profiles

.

The Session Profiles list screen opens.

Click

Create

.

The New SIP Session Profile screen opens.

In the

Name

field, type a unique name for the SIP session profile.

In the

Maximum Message Size (bytes)

field, type ...

In the

Maximum Message Header Count

field, type ...

In the

Custom Via

field, type ...

From the

Persist Key

list, select the value the system uses for persistence of a SIP session. The options are:

Option	Description
Call-ID	The system uses the value in the Call-ID header field in the SIP message.
Custom	The system uses the value of a custom key specified in an iRule.
Src-Addr	The system uses the originating IP address in the SIP message.

From the

Persist Type

list, select one of these options:

Option	Description
Session	Persistence is enabled.
None	Persistence is disabled.

In the

Persist Timeout (seconds)

field, type the number of seconds before a SIP session persistence record expires.

In the

Profile Name

field, type a unique name for the Analytics profile.

In the General Properties area, name the profile

dns_express

.

In the General Properties area, name the profile

dns_zxfr_dnssec

.

In the General Properties area, name the profile

dns_zxfr

.

In the

Profile Name

field, type a unique name for the Security Logging Profile.

In the

Profile Name

field, type a unique name for the profile.

In the General Properties area, from the

Parent Profile

list, accept the default

dns

profile.

On the Main tab, click

Local Traffic

Profiles

Services

DHCPv4

.

On the Main tab, click

Local Traffic

Profiles

Services

DHCPv6

.

On the Main tab, click

Local Traffic

Profiles

Policy Enforcement

RADIUS AAA

.

Click

Create

.

The New DHCPv4 Profile screen opens.

Click

Create

.

The New DHCPv6 Profile screen opens.

Click

Create

.

The New Radius Profile screen opens.

In the

Name

field, type a unique name for the profile.

From the

Parent Profile

list, select the default

dhcpv4

profile.

From the

Parent Profile

list, select the default

dhcpv6

profile.

From the

Parent Profile

list, select the default

radiusaaa

profile.

Select the

Custom

check box.

In the Protocol and Proxy Settings Features area, make a selection from the

DHCP Mode

list.

Option	Description
Relay	When in relay mode, a virtual server relays Dynamic Host Control Protocol (DHCP) client requests and applies unicast IP addresses as the relayed message destination.
Forward	When in forward mode, a virtual server forwards Dynamic Host Control Protocol (DHCP), and does not modify, client requests for an IP address to one or more DHCP servers.

For the

Idle Timeout

setting, type the number of seconds that a BIG-IP DHCP connection is idle before the connection is eligible for deletion.

For the

Max Hops

setting, select the

Custom

check box to enable this option. Type the maximum expected number of relay agents that the messages should pass through, before reaching the DHCPv4 server.

For the

Default TTL

setting, select the

Custom

check box to enable this option. Type the time to live (TTL) value that you want to set for each outgoing DHCP packet.

For the

TTL Decrement Amount

setting, select the

Custom

check box to enable this option. Type the amount that the DHCP virtual will use to decrement the TTL for each outgoing DHCP packet.

For the

Default Lease Time

setting, select the

Custom

check box to enable this option. Type the time, in seconds, of the default value of the DHCPv4 lease time.

For the

Transaction Timeout

setting, select the

Custom

check box to enable this option. Type the number of seconds, taken to internally process the messages.

For the

Transaction Timeout

setting, select the

Custom

check box to enable this option. Type the number, in seconds, of the time taken for server to respond.

If you want the DHCP module to insert option 82, for the

Insert Relay Agent ID (Option 82)

setting, select the

Custom

check box.

If you want the DHCP module to insert option 37, for the

Insert Remote ID (Option 37)

setting, select the

Custom

check box .

If you want the DHCP module to insert option 38, for the

Insert Remote ID (Option 38)

setting, select the

Custom

check box to enable this option .

If you want the DHCP relay agent to remove option 82 from the server to client traffic, for the

Remove Relay Agent ID From Client Messages

setting, select the

Custom

check box to enable this option.

If you want the DHCP relay agent to remove option 37 from the server to client traffic, for the

Remove Subscriber Agent ID From Client Messages

setting, select the

Custom

check box.

If you want the DHCP module to remove option 38 from the server to client traffic, for the

Remove Relay Agent ID From Client Messages

setting, select the

Custom

check box.

From the

Subscriber Discovery

list, select

Enabled

. Then, for the

Subscriber ID Format

setting, select the format you want to implement.

Format	Description
MAC Address	Uses the subscriber ID as the MAC address through which the subscriber ID goes through.
Relay Agent Option: Suboption ID 1	Uses the relay agent first option suboption ID.
Relay Agent Option: Suboption ID 1 + <Separator> + Suboption ID 2	Uses the relay agent first and second suboption IDs.
MAC Address + <Separator> + Relay Agent Option: Suboption ID 1	Uses the MAC Address and the relay agent first suboption ID.
MAC Address + <Separator> + Relay Agent Option: Suboption ID 1 <Separator> + Suboption ID 2	Uses the relay agent first option suboption ID.
TCL Expression	Uses the TCL expression to format the subscriber ID.

From the

Authentication Settings

list, select

Enabled

. Then, select the virtual server name from the

Authentication Virtual

list. Select the

User Name Format

you want to implement.

The

User Name Format

has the same options as the

Subscriber ID Format

, in the Subscriber Discovery setting.

From the

Subscriber Discovery

list, select

Enabled

. Then, for the

Subscriber ID Format

setting, select the format you want to implement.

Format	Description
MAC Address	Uses the subscriber ID as the MAC address through which the subscriber ID goes through.
MAC Address + <Separator> + Option 37	Uses the MAC address and the remote ID relay agent option.
MAC Address + <Separator>+ Option 37 <Separator> + Option 38	Uses the MAC address, the remote ID relay agent option and the subscriber ID option.
MAC Address + <Separator> + Option 38	Uses the MAC address and the subscriber ID option.
Option 37	Uses the remote ID relay agent option.
Option 37 <Separator> + Option 38:	Uses the remote ID relay agent option and the subscriber ID option.
Option 38	Uses the subscriber ID option.
TCL Expression	Uses the TCL expression to format the subscriber ID.

From the

Authentication Settings

list, select

Enabled

. Then, select the virtual server name from the

Authentication Virtual

list. Select the

User Name Format

you want to implement.

The

User Name Format

has the same options as the

Subscriber ID Format

, in the Subscriber Discovery setting.

For the

Secret

setting, select the

Custom

check box to enable this option. Type the shared secret of the RADIUS server used for authentication.

For the

Password

setting, select the

Custom

check box to enable this option. Type the password of the RADIUS AAA profile for RADIUS server authentication.

For the

Retransmission Timeout

setting, select the

Custom

check box to enable this option. Type the number of seconds to wait before resending authentication or accounting messages to the RADIUS server.

From the

Parent Profile

list, select the default

ftp

profile.

From the

Parent Profile

list, select a parent profile.

For the

Inherit Parent Profile

setting, select the check box.

This optimizes data channel traffic.

Select the

Custom

check box.

If you want to disable IPv6 translation, in the Settings area, clear the

Translate Extended

check box.

Retain the

Data Port

setting default value of

20

.

To enable FTP security checks, select the

Protocol Security

check box.

The Protocol Security tab opens.

In the

Out Streams

field, type a value for the number of outbound streams.

Ensure that this value equals the value requested by the servers when the server-side connection is established.

A value of

2

, or greater, enables SCTP multistreaming functionality.

In the

In Streams

field, type a value for the number of inbound streams.

Ensure that this value equals the value requested by the servers when the server-side connection is established.

A value of

2

, or greater, enables SCTP multistreaming functionality.

Configure the client-side multihoming settings.

From the

Client Side Multi-homing

list, select

Enabled

to enable SCTP multihoming for clients.

When enabled, this setting enables SCTP clients to connect to a virtual server over multiple IP interfaces.

The

Secondary Addresses

setting appears.

For the

Secondary Addresses

setting, in the

Destination Address

field, type a valid destination address for any virtual server that uses this SCTP profile.

Click

Add

.

Repeat the addition of each destination address that you want to provide to SCTP clients.

From the

Server Side Multi-homing

list, select

Enabled

to enable SCTP multihoming for servers.

From the

Parent Profile

list, select the existing SMTP profile from which you want the new profile to inherit settings. The default is

smtp

.

Select the

Protocol Security

check box to enable SMTP security checks.

From the

Parent Profile

list, select a profile from which the new profile inherits properties.

For the

Parent Profile

setting, confirm that

ssl

appears.

Select the

Custom

check box.

Select the

Custom

check box.

Select the

Custom

check box.

Next to

Settings

, select the

Custom

check box.

Next to

Log Settings

, select the

Custom

check box.

From the

Configuration

list, select

Advanced

.

Select the

Custom

check box.

The settings become available for change.

Next to Client Authentication, select the

Custom

check box.

The settings become available.

From the

Certificate

list, select the name of an SSL certificate on the BIG-IP system.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default certificate name, and ensure that this same certificate name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

From the

Key

list, select the name of an SSL key on the BIG-IP system.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default key name, and ensure that this same key name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

In the

Pass Phrase

field, select a pass phrase that enables access to the certificate/key pair on the BIG-IP system.

From the

Chain

list, select the name of an SSL chain on the BIG-IP system.

Select the

Custom

check box for

Server Authentication

.

Modify the settings, as required.

Modify other settings, as required.

Configure all other profile settings as needed.

For the

Proxy SSL

setting, select the check box.

Select the

Custom

check box for the Request Settings area.

Select the

Custom

check box for the Response Settings area.

Select the check box for the applicable profile.

In the

Profile Name

field, type a unique name for the MS SQL profile, for example,

mssql_user_access

.

In the

Profile Name

field, type a unique name for the MS SQL profile, for example,

mssql_command_access

.

From the

Read/Write Split

list, select

By Command

.

From the

Read/Write Split

list, select

By User

.

From the

Read Pool

list, select the pool of MS SQL database servers to which the system sends read-only requests.

From the

Write Pool

list, select the pool of MS SQL database servers to which the system sends write requests.

In the

Write Persist Timer

field, type the number of milliseconds, after a connection has switched to the write pool, that the connection continues to persist to the write pool.

Use the value

-1

to persist the connection to the write pool for the duration of the connection.

If you set this to a value other than

-1

, the value must be greater than the amount of time required for the primary and secondary database servers to synchronize with one another.

From the

Users Can Write By Default

list, select

Yes

to give write access to all users, except those in the

Read-Only Users

list.

From the

Users Can Write By Default

list, select

No

to give write access only to users in the

Write-Enabled Users

list.

In the

Read-Only Users

area, add users to whom you want to provide read-only access to the database.

In the

Write-Enabled Users

area, add users to whom you want to provide write access to the database.

In the DNS Traffic area, from the

DNS Security

list, select

Enabled

.

In the DNS Traffic area, from the

DNS Security Profile Name

list, select the name of the DNS firewall profile.

In the Denial of Service Protection area, from the

Rapid Response Mode

list, select

Disabled

, until a DNS flood attack occurs. At that time, enable this setting, and select an action from the

Rapid Response Last Action

list.

When you enable this setting, all other DNS features are disabled, except DNS Express.

In the Denial of Service Protection area, from the

Rapid Response Mode

list, select

Enabled

.

Enable this setting after a DNS flood attack occurs. When you enable it, all other DNS features are disabled, except for DNS Express and global server load balancing (GSLB), unless the

Rapid Response Last Action

is set to

Allow

.

In the Denial of Service Protection area, from the

Rapid Response Last Action

list, select an option to protect your network:

Option	Description
Allow	BIG-IP system sends non-matching DNS queries along the regular packet processing path
Drop	BIG-IP system drops the message without sending a response to the client. This is the default value.
No Error	BIG-IP system returns NOERROR response to the client..
NX Domain	BIG-IP system returns non-existent name response to the client.
Refuse	BIG-IP system returns REFUSED response to the client.
Truncate	BIG-IP system truncates the response to the client.

In the DNS Features area, from the

GSLB

list, accept the default value

Enabled

.

In the DNS Features area, from the

GSLB

list, select

Disabled

.

In the DNS Features area, from the

DNS IPv6 to IPv4

list, select how you want the system to handle IPv6 to IPv4 address mapping in DNS queries and responses.

Option	Description
Disabled	The BIG-IP system does not map IPv4 addresses to IPv6 addresses.
Immediate	The BIG-IP system receives an AAAA query and forwards the query to a DNS server. The BIG-IP system then forwards the first good response from the DNS server to the client. If the system receives an A response first, it appends a 96-bit prefix to the record and forwards it to the client. If the system receives an AAAA response first, it simply forwards the response to the client. The system disregards the second response from the DNS server.
Secondary	The BIG-IP system receives an AAAA query and forwards the query to a DNS server. Only if the server fails to return a response does the BIG-IP system send an A query. If the BIG-IP system receives an A response, it appends a 96-bit user-configured prefix to the record and forwards it to the client.
v4 Only	The BIG-IP system receives an AAAA query, but forwards an A query to a DNS server. After receiving an A response from the server, the BIG-IP system appends a 96-bit user-configured prefix to the record and forwards it to the client. Select this option only if you know that all your DNS servers are IPv4 only servers.

If you selected

Immediate

,

Secondary

, or

V4 Only

two new fields display.

From the

DNS IPv6 to IPv4

list, specify how you want the system to handle IPv6 to IPv4 address mapping in DNS queries and responses.

Option	Description
Disabled	The BIG-IP system does not map IPv4 addresses to IPv6 addresses.
Immediate	The BIG-IP system receives an AAAA query and forwards the query to a DNS server. The BIG-IP system then forwards the first good response from the DNS server to the client. If the system receives an A response first, it appends a 96-bit prefix to the record and forwards it to the client. If the system receives an AAAA response first, it simply forwards the response to the client. The system disregards the second response from the DNS server.
Secondary	The BIG-IP system receives an AAAA query and forwards the query to a DNS server. Only if the server fails to return a response does the BIG-IP system send an A query. If the BIG-IP system receives an A response, it appends a 96-bit user-configured prefix to the record and forwards it to the client.
v4 Only	The BIG-IP system receives an AAAA query, but forwards an A query to a DNS server. After receiving an A response from the server, the BIG-IP system appends a 96-bit user-configured prefix to the record and forwards it to the client. Select this option only if you know that all your DNS servers are IPv4 only servers.

If you selected

Immediate

,

Secondary

, or

V4 Only

, two new fields display.

In the DNS Features area, in the

IPv6 to IPv4 Prefix

field, specify the prefix the BIG-IP system appends to all A query responses to an IPv6 request.

In the

IPv6 to IPv4 Prefix

field, specify the prefix the BIG-IP system appends to all A query responses to an IPv6 request.

In the DNS Features area, from the

IPv6 to IPv4 Additional Section Rewrite

list, select an option to allow improved network efficiency for both Unicast and Multicast DNS-SD responses.

Option	Description
Disabled	The BIG-IP system does not perform additional rewrite.
v4 Only	The BIG-IP system accepts only A records. The system appends the 96-bit user-configured prefix to a record and returns an IPv6 response to the client.
v6 Only	The BIG-IP system accepts only AAAA records and returns an IPv6 response to the client.
Any	The BIG-IP system accepts and returns both A and AAAA records. If the DNS server returns an A record in the Additional section of a DNS message, the BIG-IP system appends the 96-bit user-configured prefix to the record and returns an IPv6 response to the client.

From the

IPv6 to IPv4 Additional Section Rewrite

list, select an option to allow improved network efficiency for both Unicast and Multicast DNS-SD responses.

Option	Description
Disabled	The BIG-IP system does not perform additional rewrite.
v4 Only	The BIG-IP system accepts only A records. The system appends the 96-bit user-configured prefix to a record and returns an IPv6 response to the client.
v6 Only	The BIG-IP system accepts only AAAA records and returns an IPv6 response to the client.
Any	The BIG-IP system accepts and returns both A and AAAA records. If the DNS server returns an A record in the Additional section of a DNS message, the BIG-IP system appends the 96-bit user-configured prefix to the record and returns an IPv6 response to the client.

In the DNS Features area, from the

DNS Express

list, retain the default value

Enabled

.

In the DNS Features area, from the

DNS Express

list, select

Disabled

.

In the DNS Features area, from the

DNSSEC

list, select

Enabled

.

In the DNS Features area, from the

DNSSEC

list, select

Disabled

.

In the DNS Traffic area, from the

Zone Transfer

list, select

Enabled

.

In the DNS Features area, from the

Unhandled Query Actions

list, select how you want the BIG-IP system to handle a query that is not for a wide IP or DNS Express zone.

Option	Description
Allow	The BIG-IP system forwards the query to a DNS server or a member of a pool of DNS servers. Note that if the pool is not associated with a listener and the Use BIND Server on BIG-IP option is set to enabled , queries are forwarded to the local BIND server. (Allow is the default value.)
Drop	The BIG-IP system does not respond to the query.
Reject	The BIG-IP system returns the query with the REFUSED return code.
Hint	The BIG-IP system returns the query with a list of root name servers.
No Error	The BIG-IP system returns the query with the NOERROR return code.

In the DNS Features area, from the

Unhandled Query Actions

list, select

Allow

.

The BIG-IP system forwards zone transfer requests to a DNS server or a member of a pool of DNS servers.

In the DNS Features area, from the

Use BIND Server on BIG-IP

list, select

Enabled

.

Enable this setting only when you want the system to forward non-wide IP queries to the local BIND server on BIG-IP DNS.

From the

Use BIND Server on BIG-IP

list, select

Enabled

.

Enable this setting only when you want the system to forward non-wide IP queries to the local BIND server on BIG-IP DNS.

In the DNS Features area, from the

Use BIND Server on BIG-IP

list, select

Disabled

.

In the DNS Features area, make a selection from the

Use BIND Server on BIG-IP

list.

Option	Description
Enabled	Enable this setting only when you want the system to forward non-wide IP queries to the local BIND server on the BIG-IP DNS.
Disabled	Disable this setting when you want the system to forward non-wide IP queries to a DNS server behind BIG-IP DNS.

In the DNS Features area, make a selection from the

Recursion Desired

list.

Option	Description
Enabled	BIG-IP accepts DNS queries with the recursion bit set.
Disabled	BIG-IP does not accept DNS queries with the recursion bit set. When you configure BIG-IP to be an authoritative nameserver for an external web site, disable this option as a security measure to prevent denial of service attacks.

In the DNS Features area, make a selection from the

DNS Cache

list.

When you enable the

DNS Cache

option, you must also select a name from the

DNS Cache Name

list.

Option	Description
Enabled	Enable this setting when you want to cache the DNS responses handled by the virtual servers associated with this profile.
Disabled	Disable this setting when you want to debug the system. When you disable this setting, the profile retains the association with the DNS cache in the DNS Cache Name field, but the system does not cache DNS responses.

From the

Rate Limiting

list, select

Enabled

.

When you enable this setting, you must also select a profile from the

Rate Limiting Profile

list.

From the

Rate Limiting Profile

list, select a profile based on your rate limited license.

In the DNS Features area, from the

DNS Cache

list, select

Enabled

.

When you enable the

DNS Cache

option, you must also select a DNS cache from the

DNS Cache Name

list.

In the DNS Features area, from the

DNS Cache

list, select

Disabled

.

In the DNS Features area, from the

DNS Cache Name

list, select the DNS cache that you want to associate with this profile.

You can associate a DNS cache with a profile, even when the

DNS Cache

option, is

Disabled

.

In the Logging and Reporting area, from the

Logging

list, select

Enabled

.

In the Logging and Reporting area, from the

Logging

list, select

Disabled

.

In the Logging and Reporting area, from the

Profile

list, select a custom DNS Logging profile.

In the Log Settings area, from the

Logging Profile

list, select a custom Logging profile.

In the DNS Security area, from the

Publisher

list, select a destination to which the BIG-IP system sends DNS log entries.

From the

Log Publisher

list, select a destination to which the BIG-IP system sends log entries.

You can specify publishers for other DoS types in the same profile, for example, for DNS, Network, or Application DoS Protection.

If you want the BIG-IP system to log all DNS queries, for the

Log Queries

setting, ensure that the

Enabled

check box is selected.

If you want the BIG-IP system to log all DNS responses, for the

Log Responses

setting, select the

Enabled

check box.

If you want the BIG-IP system to include the query ID sent by the client in the log messages, for the

Include Query ID

setting, select the

Enabled

check box.

For

Actions

, select the

Custom

check box.

The settings in the

Actions

area become available for configuring.

From the

Hosts

list, select and configure one of the following options, as applicable:

Match All

Match Only

From the

URI Paths

list, select and configure one of the following options, as applicable:

Match All

Match Only

From the

Headers

list, select and configure one of the following options, as applicable:

Match All

Match Only

From the

Cookies

list, select and configure one of the following options, as applicable:

Match All

Match Only

From the

Send To

list, select and configure one of the following options, as applicable:

None

Pool

Redirect to

From the

Application Acceleration Manager

list, select

Accelerate

.

Configuring the

HTTP Class

profile to accelerate traffic with the Application Acceleration Manager overrides

Web Acceleration

profile settings on the virtual server.

In the

WebAccelerator

list, select

Bypass

.

Configuring the

HTTP Class

profile to bypass the

Web Application

application overrides

Web Acceleration

profile settings on the virtual server.

From the

Parent Profile

list, select one of the following profiles:

httpcompression

.

wan-optimized-compression

.

From the

HTTP Compression Profile

list, select one of the following profiles:

httpcompression

wan-optimized-compression

A customized profile

For the

File Types

setting, specify whether you want to create a list of allowed or disallowed file types:

To create a list of file types that are permitted in requests, select

Define Allowed

.

To create a list of file types not permitted, select

Define Disallowed

.

For the

File Types

setting, specify the file types to allow or disallow in a request:

Select file types from the

Available

list, and move them to the

Allowed

or

Disallowed

list.

Add a new file type: type the name in the

File Type

field, click

Add

to add it to the

Available

list, and move it to the list.

If the profile is case-sensitive, the file types are case-sensitive. For example,

jsp

and

JSP

> will be treated as separate file types.

From the

Web Acceleration Profile

list, select one of the following profiles:

optimized-acceleration

optimized-caching

webacceleration

A customized profile

From the

Web Acceleration Profile

list, select one of the following profiles with an enabled application:

optimized-acceleration

optimized-caching

webacceleration

A customized profile

From the

Request Logging

list, select

Enabled

.

In the

Template

field, type the request logging parameters for the entries that you want to include in the log file.

From the

HSL Protocol

list, select a high-speed logging protocol.

From the

Pool Name

list, select the pool that includes the log server as a pool member.

You can also configure the error response settings.

From the

Respond On Error

list, select

Enabled

.

In the

Error Response

field, type the error response strings that you want to include in the log file.

These strings must be well-formed for the protocol serving the strings.

Select the

Close On Error

check box to drop the request and close the connection if logging fails.

You can also configure the logging request errors settings.

From the

Log Logging Errors

list, select

Enabled

.

In the

Error Template

field, type the request logging parameters for the entries that you want to include in the log file.

From the

HSL Error Protocol

list, select a high-speed logging error protocol.

From the

Error Pool Name

list, select a pool that includes the node for the error logging server as a pool member.

From the

HSL Pool

list, select the name of the remote pool of servers to which you want the BIG-IP system to send DNS log entries.

In the Response Settings area, from the

Response Logging

list, select

Enabled

.

Select the

Log By Default

check box.

The

Log By Default

check box is selected by default.

In the

Template

field, type the response logging parameters for the entries that you want to include in the log file.

From the

HSL Protocol

list, select a high-speed logging protocol.

From the

Pool Name

list, select the pool that includes the node log server as a pool member.

Configure the logging request error settings.

From the

Log Logging Errors

list, select

Enabled

.

In the

Error Template

field, type the response logging parameters for the entries that you want to include in the log file.

From the

HSL Error Protocol

list, select a high-speed logging error protocol.

From the

Error Pool Name

list, select a pool that includes the node for the error log server as a pool member.

For the

WA Applications

setting, select an application in the

Available

list and click

Enable

.

The application is listed in the

Enabled

list.

For the

WA Applications

setting, select an application in the

Enabled

list and click

Disable

.

The Application Acceleration Manager application is listed in the

Disabled

list.

On the Main tab, click

Local Traffic

Profiles

Classification

.

The Classification screen opens.

Scroll down to the Enforcement area.

From the

Allow Truncated Redirect

list, select

Enabled

to forward HTTP traffic with missing trailing carriage returns to the client.

In the

Maximum Header Size

field, type a size, in bytes, for the maximum acceptable size of a header.

From the

Oversize Client Header

list, select

Pass Through

to pass through traffic to the server when the

Maximum Header Size

value is exceeded by the client.

From the

Oversize Server Header

list, select

Pass Through

to pass through traffic to the client when the

Maximum Header Size

value is exceeded by the server.

In the

Maximum Header Count

field, type a maximum number of headers for the system to support.

From the

Excess Client Headers

list, select

Pass Through

to pass through traffic to the server when the

Maximum Header Count

value is exceeded by the client.

From the

Excess Server Headers

list, select

Pass Through

to pass through traffic to the client when the

Maximum Header Count

is exceeded by the server.

From the

Pipeline Action

list, select one of the following settings.

Allow	Default. Enables clients to make requests, even when prior requests have not received a response. Destination servers must include support for pipelining.
Reject	Rejects the request.
Pass Through	Provides identical functionality as the Allow setting, until a pipelined request is received, whereupon pass-through functionality becomes active. This setting works around clients and servers that break standard HTTP request-response connection handling.

From the

Unknown Method

list, select one of the following settings.

Allow	Default. Allows the HTTP filter to process an unknown HTTP method.
Reject	Rejects HTTP traffic that includes an unknown HTTP method.
Pass Through	Passes through HTTP traffic that includes an unknown HTTP method.

Configure the list of known methods in the

Known Method

list.

Add a method to the Enabled Methods list.	In the Add user defined method field, type the name of a method. Click Add . The method appears in the Enabled Methods list.
Delete a method from the Enabled Methods list.	Select a method in the Enabled Methods list. Click Delete . If you delete a known method from the Enabled Methods list, the BIG-IP system applies the Unknown Method setting to manage that traffic. Deleting a standard method, such as HEAD or CONNECT , causes BIG-IP functionality that depends on detecting that method to fail to work correctly.

From the

Polling Interval

list, select

Specify

, and type the maximum interval in seconds between polling by the s Flow agent of this profile.

From the

Sampling Rate

list, select

Specify

, and type the ratio of packets observed at the virtual server associated with this profile to the samples you want the BIG-IP system to generate.

For example, a sampling rate of 2000 specifies that one sample will be randomly generated for every 2000 packets observed.

Select the

Protocol Security

check box.

In the HTTP, FTP, and SMTP Security area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log HTTP, FTP, and SMTP Security events.

In the HTTP, FTP, and SMTP Security area, from the

Publisher

list, select

local-db-publisher

.

In the DNS Security area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log DNS Security events.

In the DNS Security area, from the

Publisher

list, select

local-db-publisher

.

Select the

Log Dropped Requests

check box, to enable the BIG-IP system to log dropped DNS requests.

Select the

Log Filtered Dropped Requests

check box, to enable the BIG-IP system to log DNS requests dropped due to DNS query/header-opcode filtering.

The system does not log DNS requests that are dropped due to errors in the way the system processes DNS packets.

Select the

Log Malformed Requests

check box to enable the BIG-IP system to log malformed DNS requests.

Select the

Log Rejected Requests

check box to enable the BIG-IP system to log rejected DNS requests.

Select the

Log Malicious Requests

check box to enable the BIG-IP system to log malicious DNS requests.

From the

Storage Format

list, select how the BIG-IP system formats the log.

Option	Description
None	Specifies the default format type in which the BIG-IP system logs messages to a remote Syslog server, for example: "management_ip_address","bigip_hostname","context_type","context_name","src_ip","dest_ip","src_port","dest_port","vlan","protocol","route_domain","acl_rule_name","action","drop_reason
Field-List	Allows you to: Select, from a list, the fields to be included in the log. Specify the order the fields display in the log. Specify the delimiter that separates the content in the log. The default delimiter is the comma character.
User-Defined	Allows you to: Select, from a list, the fields to be included in the log. Cut and paste, in a string of text, the order the fields display in the log.

Select the

Network Firewall

check box.

In the Network Firewall area, from the

Publisher

list, select the publisher the BIG-IP system uses to log Network Firewall events.

In the Network Firewall area, from the

Publisher

list, select the IPFIX publisher the BIG-IP system uses to log Network Firewall events.

Select

Blocked Logging

to guarantee logging of firewall events when logging traffic load is heavy, even to the detriment of system performance.

Set an

Aggregate Rate Limit

to define a rate limit for all combined network firewall log messages per second.

Beyond this rate limit, log messages are not logged.

Rate Limits are calculated per-second per TMM. Each TMM throttles as needed independently of other TMMs.

In the Network Firewall area, from the

Publisher

list, select

local-db-publisher

.

For the

Log Rule Matches

setting, select how the BIG-IP system logs packets that match ACL rules. You can select any or all of the options.

Option	Enables or disables logging of packets that match ACL rules configured with:
Accept	action=Accept
Drop	action=Drop
Reject	action=Reject

When an option is selected, you can configure a rate limit for log messages of that type.

Select the

Log IP Errors

check box, to enable logging of IP error packets.

When this setting is enabled, you can configure a rate limit for log messages of this type.

Select the

Log TCP Errors

check box, to enable logging of TCP error packets.

When this is enabled, you can configure a rate limit for log messages of this type.

Select the

Log TCP Events

check box, to enable logging of open and close of TCP sessions.

When this is enabled, you can configure a rate limit for log messages of this type.

In the IP Intelligence area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log source IP addresses, which are identified and configured for logging by an IP Intelligence policy.

The IP Address Intelligence feature must be enabled and licensed.

Set an

Aggregate Rate Limit

to define a rate limit for all combined IP Intelligence log messages per second.

Beyond this rate limit, log messages are not logged.

Rate Limits are calculated per-second per TMM. Each TMM throttles as needed independently of other TMMs.

In the IP Intelligence area, from the

Publisher

list, select

local-db-publisher

.

The IP Address Intelligence feature must be enabled and licensed.

Enable the

Log Translation Fields

setting to log both the original IP address and the NAT-translated IP address for Network Firewall log events.

Enable the

Always Log Region

setting to log the geographic location when a geolocation event causes a network firewall event.

Enable the

Log Translation Fields

setting to log both the original IP address and the NAT-translated IP address for IP Intelligence log events.

Enable the

Log Geolocation IP Address

setting to specify that when a geolocation event causes a network firewall action, the associated IP address is logged.

In the Traffic Statistics area, from the

Publisher

list, select

local-db-publisher

.

In the Traffic Statistics area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log traffic statistics.

For the

Log Timer Events

setting, enable

Active Flows

to log the number of active flows each second.

For the

Log Timer Events

setting, enable

Reaped Flows

to log the number of reaped flows, or connections that are not established because of system resource usage levels.

For the

Log Timer Events

setting, enable

Missed Flows

to log the number of packets that were dropped because of a flow table miss. A flow table miss occurs when a TCP non-SYN packet does not match an existing flow.

For the

Log Timer Events

setting, enable

SYN Cookie (Per Session Challenge)

to log the number of SYN cookie challenges generated each second.

For the

Log Timer Events

setting, enable

SYN Cookie (White-listed Clients)

to log the number of SYN cookie clients whitelisted each second.

In the Logging Profile Properties, select the

DoS Protection

check box.

The DoS Protection tab opens.

In the DNS DoS Protection area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log DNS DoS events.

You can specify publishers for other DoS types in the same profile, for example, for SIP or Application DoS Protection.

In the SIP DoS Protection area, from the

Publisher

list, select the publisher that the BIG-IP system uses to log SIP DoS events.

You can specify publishers for other DoS types in the same profile, for example, for DNS or Application DoS Protection.

On the Main tab, click

Local Traffic

Profiles

Services

ICAP

.

Click

Create

.

On the right side of the screen, select the

Custom

check box.

On the right side of the screen, select the

Custom

check box.

In the

Name

field, type a unique name for the profile.

For the

Parent Profile

setting, retain the default value,

icap

.

In the

URI

field, type a URI in this format:

icap://hostname:port/path

.

For example, using macro expansion, you can set the

URI

value to:

 icap://${SERVER_IP}:${SERVER_PORT}/virusScan

.

In the

URI

field, type a URI in this format:

icap://hostname:port/path

.

For example, using macro expansion, you can set the

URI

value to:

 icap://${SERVER_IP}:${SERVER_PORT}/videoOptimization

In the

Preview Length

field, type a length or retain the default value

0

.

This value defines the amount of the HTTP request or response that the BIG-IP system offers to the ICAP server when sending the request or response to the server for adaptation. This value should not exceed the length of the preview that the ICAP server has indicated it will accept.

In the

Header From

field, type a value for the

From:

ICAP header.

In the

Host

field, type a value for the

Host:

ICAP header.

In the

Referer

field, type a value for the

Referer:

ICAP header.

In the

User Agent

field, type a value for the

User-Agent:

ICAP header.

Click

Finished

.

On the Main tab, click

Local Traffic

Profiles

Services

Request Adapt

.

Click

Create

.

On the right-side of the screen, clear the

Custom

check box.

In the

Name

field, type a unique name for the profile.

For the

Parent Profile

setting, retain the default value,

requestadapt

.

For the

Enabled

setting, retain the default value,

Enabled

.

When you set this value to

Enabled

, the BIG-IP system forwards HTTP requests to the specified internal virtual server for adaptation.

From the

Internal Virtual Name

list, select the name of the internal virtual server that you previously created for forwarding HTTP requests to the pool of iCAP servers.

In the

Preview Size

field, type a numeric value.

This specifies the maximum size of the preview buffer. This buffer holds a copy of the HTTP request header and the data sent to the internal virtual server, in case the adaptation server reports that no adaptation is needed. Setting the preview size to

0

disables buffering of the request and should only be done if the adaptation server always returns a modified HTTP request or the original HTTP request.

In the

Timeout

field, type a numeric value, in seconds.

If the internal virtual server does not return a result within the specified time, a timeout error occurs. To disable the timeout, use the value

0

.

From the

Service Down Action

list, select an action for the BIG-IP system to take if the internal virtual server returns an error:

Select

Ignore

to instruct the BIG-IP system to ignore the error and send the unmodified HTTP request to an HTTP server in the HTTP server pool.

Select

Drop

to instruct the BIG-IP system to drop the connection.

Select

Reset

to instruct the BIG-IP system to reset the connection.

On the Main tab, click

Local Traffic

Profiles

Services

Response Adapt

.

Click

Create

.

On the right-side of the screen, select the

Custom

check box.

In the

Name

field, type a unique name for the profile.

For the

Parent Profile

setting, retain the default value,

responseadapt

.

For the

Enabled

setting, retain the default value,

Enabled

.

When you set this value to

Enabled

, the BIG-IP system forwards HTTP responses to the specified internal virtual server for adaptation.

From the

Internal Virtual Name

list, select the name of the internal virtual server that you previously created for forwarding HTTP responses to the pool of iCAP servers.

In the

Preview Size

field, type a numeric value.

This specifies the maximum size of the preview buffer. This buffer holds a copy of the HTTP response header and the data sent to the internal virtual server, in case the adaptation server reports that no adaptation is needed. Setting the preview size to

0

disables buffering of the response and should only be done if the adaptation server always returns a modified HTTP response or the original HTTP response.

In the

Timeout

field, type a numeric value.

If the internal virtual server does not return a result within the specified time, a timeout error occurs. To disable the timeout, use the value

0

.

From the

Service Down Action

list, select an action for the BIG-IP system to take if the internal virtual server returns an error:

Select

Ignore

to instruct the BIG-IP system to ignore the error and send the unmodified HTTP response to an HTTP server in the HTTP server pool.

Select

Drop

to instruct the BIG-IP system to drop the connection.

Select

Reset

to instruct the BIG-IP system to reset the connection.

Set the

PVA Acceleration

field to

Guaranteed

.

Select the

Loose Close

check box only for a one-arm virtual server configuration.

Set the

TCP Close Timeout

setting, according to the type of traffic that the virtual server will process.

If you plan to use

Late Binding

and either of the

Loose Initiation

and

Loose Close

check boxes are enabled, clear them both.

The

Late Binding

feature examines the first few packets in the FIX stream, and the

Loose Initiation

feature makes it possible to skip those packets without any examination.

Disable the

Hardware SYN Cookie Protection

feature by clearing the check box.

Enable the

Software SYN Cookie Protection

feature by selecting the check box.

The

Late Binding

feature makes it possible to choose a server pool based on data in the FIX header. An iRule in the virtual server parses the FIX header and selects the server pool. Select the check box to enable

Late Binding

.

You can allow the iRule to explicitly determine when the flow is released from Layer 7 down to Layer 4. The iRule code can then perform additional computation before binding the connection to Layer 4. Enable this by selecting the

Explicit Flow Migration

check box. When this feature is enabled, the flow is not released to Layer 4 until the iRule invokes the

BIGTCP::release_flow

command.

By default, this is disabled and the flow drops down to Layer 4 immediately after the connection to the server is established.

Use the

Client Timeout

field to determine how much time to allow for any client to send the first 2144 bytes of Layer 7information. In normal cases, this amount of data arrives immediately.

From the

Timeout Recovery

list, select an action that the profile should take in case of timeout. Select

Disconnect

to drop the connection summarily, or select

Fallback

to process the packet without parsing the Layer 7 fields. The fallback option sends any timed-out connection to the Virtual Server's default pool.

For the

Session Ticket

setting, select or clear the check box:

Selecting the check box causes the BIG-IP system to use session tickets as a way to improve SSL performance.

Clearing the check box prevents the BIG-IP system from using session tickets.

In the

Profile Name

field, type a name, such as

my_rewrite_profile

.

From the

Rewrite Mode

list, select

URI Translation

.

From the

Parent Profile

list, select

rewrite

.

On the left pane, click

Settings

.

A list of request and response settings appears on the Settings tab.

In the Settings box, select or clear the appropriate check boxes.

Using the check boxes, you can rewrite and insert headers into HTTP requests, as well as rewrite headers and content in HTTP responses.

On the left pane, click

URI Rules

.

An empty text box appears for displaying client-server URI mappings that you specify.

In the URI Rules box, click

Add

.

This displays the Create New Rewrite URI box.

From the

URI Type

list, select a URI type.

Click

Update

.

Click

Add

.

Click

Add

again.

From the

Rule Type

list, select

Both

.

In the

Client URI

box, type a client path, such as

/sales/

.

In the

Server URI

box, type a server URI, such as

http://appserver1.siterequest.com/sales/

.

You must include a scheme in the server URI that you specify.

An example of a scheme is

http

.

In the

Client URI

field, type a client path, such as

/marketing/

.

In the

Server URI

field, type a server URI, such as

http://appserver2.siterequest.com/marketing/

.

You must include a scheme in the server URI that you specify.

An example of a scheme is

http

.

Click

OK

.

This displays a mapping of the specified client path to the associated server scheme, host, and path.

In the

Server URI

field, type a server URI, such as

http://appserver2.siterequest.com/sales/

.

Click

OK

.

In the

Name

column, locate the Rewrite profile that you created previously and select the adjacent check box.

Click the

Edit

button.

On the left pane, click

Set-Cookie Rules.

.

This displays a list of client and server domain and path information.

Type the relevant domain and path for both the client and the server.

TBD

On the Settings tab, .

A list of settings appears.

On the Main tab, click

Local Traffic

Profiles

Content

HTML

.

In the

Profile Name

field, type a name, such as

my_html_profile

.

From the

Parent Profile

list, select

/Common/html

.

On the left pane, click

HTML Rules

.

Click the

Create New

button.

Click the

Create New Profile

button.

On the

Create New

button, click the right arrow.

Select

Remove Tag

.

The Create New Remove Tag Rule box appears.

In the

Rule Name

field, type a name, such as

my_remove_img_tag_rule

.

Optionally, in the

Description

field, type a description of the rule, such as

Removes the img tag with the src attribute

.

On the left pane, click

Content Settings

.

This displays the Content Selection Type box.

In the

Type

box, specify the type of content you want the HTML rule to act on.

A typical type of content to specify is

text/html

.

On the left pane, click

Match Settings

.

In the

Match Tag Name

field, type the name of the tag that you want to remove from the HTML content.

An example of a tag to specify is the HTML

img

tag.

In the

Match Attribute Name

field, type the name of the attribute associated with the tag that you specified for removal.

An example of an attribute to specify is the

src

attribute for the

img

tag.

In the

Available Rules

list, locate the HTML rule that you want to enable, and select the adjacent check box.

Using the Move button, move the selected HTML rule to the

Selected Rules

list.

If the access policy uses On-Demand certificate authentication, perform these substeps:

From the

Configuration

list, select

Advanced

.

Additional settings display.

Select the

Custom

check box for

Configuration

.

The settings become available.

In the

Ciphers

field, type the name of a NATIVE cipher.

The list of supported NATIVE ciphers includes these:

RC4-MD5

RC4-SHA

AES128-SHA

AES256-SHA

DES-CBC3-SHA

DES-CBC-SHA

EXP1024-RC4-MD5

EXP1024-RC4-SHA

EXP1024-DES-CBC-SHA

EXP-RC4-MD5

EXP-DES-CBC-SHA

NULL-MD5

NULL-SHA

Scroll down to the Client Authentication area.

From the

SSL Forward Proxy

list, select

Enabled

.

In the SSL Forward Proxy area, select the

Custom

check box.

From the

SSL Forward Proxy Bypass

list, select

Enabled

.

When assigned to a virtual server, a client SSL profile and a server SSL profile both must specify the same value for this setting. You cannot change this setting in either profile while assigned to a virtual server. To change the

SSL Forward Proxy Bypass

setting, you can create new profiles and add them to the virtual server, or detach the profiles from the virtual server, update them, and assign them to the virtual server again.

Additional settings display.

From the

Bypass Default Action

list, select

Intercept

or

Bypass

.

The default action applies to addresses and hostnames that do not match any entry specified in the lists that you specify. The system matches traffic first against destination IP address lists, then source IP address lists, and lastly, hostname lists. Within these, the default action also specifies whether to search the intercept list or the bypass list first.

If you select

Bypass

and do not specify any additional settings, you introduce a security risk to your system.

If you want to cache certificates by IP address and port number, select the

Cache Certificate by Addr-Port

check box.

From the

Report Log Publisher

list, select the publisher for error messages and status reports.

From the

Message Log Publisher

list, select the publisher for message logging.

In the

Rate Sample Interval

field, type the sample interval, in seconds, for the message rate.

From the

Error Action

list, select one of the following settings.

Don't Forward

(default) to drop a message with errors and not forward it.

Drop Connection

to disconnect the connection.

Select the

Quick Parsing

check box to parse the basic standard fields, and validate the message length and checksum.

Select the

Response Parsing

check box to parse the messages from the FIX server, applying the same parser configuration and error handling for the server as for the client.

Select the

Fully Parse Logon Message

check box to fully parse the logon message, instead of using quick parsing.

From the

Sender and Tag Substitution Data Group Mapping

list, select one of the following settings.

Setting	Description
Not Configured (default)	Disables the tag substitution map between sender ID and tag substitution data group.
Specify	Provides the Mapping List settings for you to configure as required. In the Sender field, type a sender ID that represents the identity of the firm sending the message. Example: client1 In the Data Group field, type a tag substitution data group. Example: FIX_tag_map Click Add .

Configure the

Mapping List

settings, as required.

In the

Sender

field, type a sender ID that represents the identity of the firm sending the message.

In the

Data Group

field, type a tag substitution data group.

Click

Add

.

In the

Ingress Maximum

field, type the maximum number of messages that can be held in the GTP ingress queue.

From the

STARTTLS Activation Mode

list, select

Require

.

From the

STARTTLS Activation Mode

list, select a value:

Value	Description
Allow	This value activates STARTTLS encryption for any client-side traffic that allows, but does not require, STARTTLS encryption.
Require	This value activates STARTTLS encryption for any client-side traffic that requires STARTTLS encryption. All messages sent to the BIG-IP system prior to STARTTLS activation are rejected with a message stating that a stronger authentication mechanism is required.
None	This value refrains from activating STARTTLS encryption for client-side traffic. Note if you select this value, that you optionally can create an iRule that identifies client-side traffic that requires STARTTLS encryption and then dynamically activates STARTTLS for that particular traffic.

From the

STARTTLS Activation Mode

list, select a value:

Value	Description
Allow	This value activates STARTTLS encryption for server-side traffic that allows, but does not require, STARTTLS encryption. In this case, the BIG-IP system only activates STARTTLS for server-side traffic when the BIG-IP system has activated STARTTLS on the client side and the client has acknowledged the activation.
Require	This value activates STARTTLS encryption for any server-side traffic that requires STARTTLS encryption. In this case, the BIG-IP system activates STARTTLS when a successful connection is made.
None	This value refrains from activating STARTTLS encryption for server-side traffic. Note that if you select this value, you can optionally create an iRule that identifies server-side traffic that requires STARTTLS encryption and then dynamically activates STARTTLS for that particular traffic.

Using the

Certificate Key Chain

setting, specify both an ECDSA and an RSA certificate key chain:

From the

Certificate

list, select the name of a certificate with a key of type ECDSA.

From the

Key

list, select the name of an ECDSA key.

From the

Chain

list, select the chain that you want to include in the certificate key chain.

Click

Add

.

Repeat this process and specify an RSA certificate key chain.

For the

Certificate Key Chain

setting, click

Add

.

From the

Certificate

list, select a certificate name.

This is the name of a certificate that you installed on the BIG-IP system. If you have not generated a certificate request nor installed a certificate on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing certificate named

default

.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default certificate name, and ensure that this same certificate name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

From the

Key

list, select the name of the key associated with the certificate specified in the previous step.

This is the name of a key that you installed on the BIG-IP system. If you have not installed a key on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing key named

default

.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default key name, and ensure that this same key name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

From the

Chain

list, select the chain that you want to include in the certificate key chain.

A certificate chain can contain either a series of public key certificates in Privacy Enhanced Mail (PEM) format or a series of one or more PEM files. A certificate chain can contain certificates for Intermediate certificate Authorities (CAs).

The default self-signed certificate and the default CA bundle certificate are not appropriate for use as a certificate chain.

For the

Passphrase

field, type a string that enables access to SSL certificate/key pairs that are stored on the BIG-IP system with password protection.

This setting is optional. For added security, the BIG-IP system automatically encrypts the pass phrase itself. This pass phrase encryption process is invisible to BIG-IP system administrative users.

Click

Add

.

For the

Certificate Key Chain

setting, click

Add

.

From the

Certificate

list, select the name of a certificate with a key of type ECDSA.

This is the name of a certificate that you installed on the BIG-IP system. If you have not generated a certificate request nor installed a certificate on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing certificate named

default

.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default certificate name, and ensure that this same certificate name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

From the

Key

list, select the name of an ECDSA key.

This is the name of a key that you installed on the BIG-IP system. If you have not installed a key on the BIG-IP system, and the BIG-IP system is not part of a device service clustering (DSC) configuration, you can specify the name of the existing key named

default

.

If the BIG-IP system is part of a DSC Sync-Failover group, always select a non-default key name, and ensure that this same key name is specified in every instance of this SSL profile in the device group. Taking these actions helps to ensure that SSL handshakes are successful after a failover event.

From the

Chain

list, select the chain that you want to include in the certificate key chain.

A certificate chain can contain either a series of public key certificates in Privacy Enhanced Mail (PEM) format or a series of one or more PEM files. A certificate chain can contain certificates for Intermediate certificate Authorities (CAs).

The default self-signed certificate and the default CA bundle certificate are not appropriate for use as a certificate chain.

For the

Passphrase

field, type a string that enables access to SSL certificate/key pairs that are stored on the BIG-IP system with password protection.

This setting is optional. For added security, the BIG-IP system automatically encrypts the pass phrase itself. This pass phrase encryption process is invisible to BIG-IP system administrative users.

Click

Add

.

Click

Add

and repeat the process for all certificate key chains that you want to specify. At a minimum, you must specify an RSA certificate key chain.

Sample configuration with three key types specified

The result is that all specified key chains appear in the text box.

For the

OCSP Stapling

setting, select the check box.

This setting is optional. To enable OCSP stapling, you must first create an OCSP Stapling profile.

Using the

Certificate Key Chain

setting, specify a certificate key chain:

From the

Certificate

list, select a certificate name.

This is the name of an RSA certificate that you installed on the BIG-IP system. If you have not generated a certificate request nor installed a certificate on the BIG-IP system, you can specify the name of an existing certificate,

default

.

From the

Key

list, select a key name.

This is the name of an RSA key that you installed on the BIG-IP system. If you have not installed a key on the BIG-IP system, you can specify the name of an existing key,

default

.

From the

Chain

list, select the chain that you want to include in the certificate key chain.

A certificate chain can contain either a series of public key certificates in Privacy Enhanced Mail (PEM) format or a series of one or more PEM files. A certificate chain can contain certificates for Intermediate certificate Authorities (CAs).

The default self-signed certificate and the default CA bundle certificate are not appropriate for use as a certificate chain.

For the

Passphrase

field, type a string that enables access to the SSL certificate/key pair.

This setting is optional. For added security, the BIG-IP system automatically encrypts the pass phrase itself. This pass phrase encryption process is invisible to BIG-IP system administrative users.

Click

Add

.

The result is that the specified key chain appears in the text box.

From the

Configuration

list, select

Advanced

.

For the

Ciphers

setting, click

Cipher Group

, and from the list, choose a cipher group.

For the

Ciphers

setting, specify a cipher group or cipher string by choosing one of these options.

If you specified an ECDSA certificate key chain in the

Certificate Key Chain

setting, you must include the cipher string

ECDHE_ECDSA

in the cipher group or cipher string that you specify in the

Ciphers

setting. (At a minimum, you should specify a cipher group or string such as

DEFAULT:ECDHE_ECDSA

.) This is necessary to ensure successful cipher negotiation when the BIG-IP system is offered an ECDSA-based certificate only.

Option	Description
Cipher Group	Select an existing cipher group from the list when you want to use a system-defined or custom cipher group to define the ciphers that the BIG-IP system uses for negotiating SSL connections. Here's an example of the Ciphers setting where we've selected a custom cipher group that we created earlier.
Cipher String	Type a cipher string in the box if you want to manually specify a cipher string instead of selecting a cipher group. For security and performance reasons, consider following these recommendations: Always append ciphers to the DEFAULT cipher string. Type a cipher string that includes the ECC key type, because its shorter length speeds up encryption and decryption while still offering virtually the same level of security. Disable ADH ciphers but also include the keyword HIGH . To do this, just include both !ADH and :HIGH in your cipher string. For AES, DES, and RC4 encryption types, make sure you specify the DHE key exchange method. DHE uses Forward Privacy , which creates a key that it throws away after each session so that the same session key never gets used twice. When you use DHE, make sure that the SSL private key isn't being shared with a monitoring system or a security device like an intrusion detection or prevention system. Also, diagnostic tools like ssldump won't work when you're using Forward Secrecy. Disable EXPORT ciphers by including !EXPORT in the cipher string. If you can live with removing support for the SSLv3 protocol version, do it. This protocol version is not secure. Simply include :!SSLv3 in any cipher string you type. Here's an example of the Ciphers setting where we have opted to manually type the cipher string DEFAULT:ECDHE-RSA-AES-128-GCM-SHA256:!ADH:!EXPORT:HIGH :

Option

Description

Cipher Group

Select an existing cipher group from the list when you want to use a system-defined or custom cipher group to define the ciphers that the BIG-IP system uses for negotiating SSL connections. Here's an example of the

Ciphers

setting where we've selected a custom cipher group that we created earlier.

Cipher String

Type a cipher string in the box if you want to manually specify a cipher string instead of selecting a cipher group. For security and performance reasons, consider following these recommendations:

Always append ciphers to the

DEFAULT

cipher string.

Type a cipher string that includes the ECC key type, because its shorter length speeds up encryption and decryption while still offering virtually the same level of security.

Disable ADH ciphers but also include the keyword

HIGH

. To do this, just include both

!ADH

and

:HIGH

in your cipher string.

For AES, DES, and RC4 encryption types, make sure you specify the DHE key exchange method. DHE uses

Forward Privacy

, which creates a key that it throws away after each session so that the same session key never gets used twice. When you use DHE, make sure that the SSL private key isn't being shared with a monitoring system or a security device like an intrusion detection or prevention system. Also, diagnostic tools like

ssldump

won't work when you're using Forward Secrecy.

Disable EXPORT ciphers by including

!EXPORT

in the cipher string.

If you can live with removing support for the SSLv3 protocol version, do it. This protocol version is not secure. Simply include

:!SSLv3

in any cipher string you type.

Here's an example of the

Ciphers

setting where we have opted to manually type the cipher string

DEFAULT:ECDHE-RSA-AES-128-GCM-SHA256:!ADH:!EXPORT:HIGH

:

For the

Ciphers

setting, click

Cipher Group

and from the list, select a custom cipher group.

This shows a custom cipher group selected for the

Ciphers

setting:

For the

Ciphers

setting, click

Cipher Group

and from the list, select a cipher group.

To specify DHE ciphers:

From the

Configuration

list, select

Advanced

.

For the

Ciphers

setting, click

Cipher String

and type

DHE:DHE_DSS

.

To specify ECDHE ciphers:

From the

Configuration

list, select

Advanced

.

In the

Ciphers

field, type

ECDHE

.

Configure all profile settings as needed.

Click

Finished

.

From the

Persistence Type

list, select

SSL

.

Configure settings as needed.

From the

General Properties

list, select

Advanced

.

In the

Name

field, type a unique name for the OCSP stapling profile.

In the

Proxy Server Pool/DNS Resolver

field, select the proxy server pool/DNS resolver used for fetching the OCSP response.

For the

Use Proxy Server

check box, select one of the following options:

Option	Description
Select	If you want the BIG-IP system to use the Proxy Server Pool . Use when there are one or more servers that can proxy an HTTP request to an external server and fetch the response.
Clear (default)	If you want to use the DNS Resolver . Use when the OCSP responder can be reached on one of the BIG-IP interfaces.

In the

Trusted Certificate Authorities

field, select the name of the file containing a trusted Certificate Authority (CA) certificate used to sign the responder's certificate.

In the

Trusted Responders

field, select the name of a certificate to use to verify the response from the OCSP responder.

In the

Responder URL

field, type the name of a URL that will override the OCSP responder URL obtained from the certificate's AIA extension. This must be an HTTP or HTTPS-based URL.

In the

Signer Certificate

field, select a certificate corresponding to the key used for signing the OCSP request.

In the

Signer Key

field, select a key to use to sign an OCSP request.

In the

Signer Key Passphrase

field, type the passphrase of the key used to sign an OCSP request.

In the

Sign Hash

field, select the hash algorithm used to sign an OCSP request. The default is

SHA256

.

This is not the algorithm used in the certificate itself. It is what the OCSP responder will use when validating the request.

In the

Timeout

field, type a time interval for the BIG-IP system to wait before dropping the connection to the OCSP responder.

In the

Clock Skew

field, type a value for the maximum tolerable absolute difference between the clocks of the responder and the BIG-IP system.

In the

Status Age

field, type a value for the maximum allowed lag time in the OCSP response that the BIG-IP system accepts. If you type

0

, the validation is skipped. The default value is

86400

.

In the

Cache Timeout

field, select a value that specifies the lifetime of the OCSP response. The default is

Indefinite

, indicating that the response validity period takes precedence.

In the

Cache Error Timeout

field, type a value for how long a BIG-IP system will cache an error response.

In the

Options

field, if necessary, select the

Strict Responder Certificate Checking

check box for the system to check the responder's certificate for the OCSP signing extension.

Click

Create

.

The New SIP Profile screen opens.

Select the

SIP Firewall

check box.

When enabled, the SIP Security settings configured in the protection profile apply to the protected object that use this profile.

If you want to enable optional subscriber ID logging:

Select the

Network Address Translation

check box.

Then in the Network Address Translation area, select the

Log Subscriber ID

check box.

Click

Network Firewall

.

In the Logging Profile Properties area, select the

Network Firewall

check box.

Select the

Network Firewall

check box.

On the Main tab, click

Local Traffic

Profiles

Message Routing

MQTT

.

The MQTT list screen opens.

Click

Create

.

The New MQTT Session profile screen opens.

In the

Name

field, type a unique name for the MQTT session profile.

From the

Parent Profile

list, select a profile from which the new profile inherits properties.

From the

Parent Profile

,

Client ID Prefix

, and

Keepalive Interval

lists, retain the default settings.

For the

Keepalive Interval

setting, retain the default, or type a value for the

MQTT CONNECT

message on the server-side connection.

The default is

60

seconds.

Click

Transport Config

.

The Transport Config list screen opens.

Click

Peers

.

The Peers list screen opens.

Click

Static Routes

.

The Static Routes list screen opens.

On the menu bar, click

Router Profiles

.

The Router Profiles list screen opens.

Click

Create

.

The New Transport Config screen opens.

Click

Create

.

The New Peer screen opens.

Click

Create

.

The New Route screen opens.

Click

Create

.

The New MQTT Router Profile screen opens.

In the

Name

field, type a unique name for the Transport Config profile.

In the

Name

field, type a unique name for the Peer profile.

In the

Name

field, type a unique name for the Route profile.

In the

Name

field, type a unique name for the Router profile.

For the

Profiles

setting, select the profile(s) you want from the

Available

list, and move it to the

Selected

field.

In the Settings area, for the

Client ID Prefix

field, type a prefix to add to the

client-id

for the server-side connection.

For the

iRules

setting, select the name of the server-side iRule from the

Available

list, and move it to the

Selected

list.

If you want to use peered client-side and server-side connections, select the

Peered Session Mode

check box.

The default is not to use peered connection (the checkbox is cleared); the BIG-IP system uses the MQTT message routing.

In the

Proxy Topic Prefix

field, type a prefix to add to the MQTT topics sent on the server-side connection.

From the

Client Will Handling Mode

list:

To disable forwarding of the client will message, select

Ignore

.

To control the

will

action for the ungraceful shutdown of the client-side connection, retain the default.

The default is

Send-Local-Copy

.

From the

Server Will Handling Mode

list:

To exclude the server side connection, select

Ignore

.

To control the

will

action for the ungraceful shutdown of the server-side connection, retain the default.

The default is

Copy-From-Client

.

Retain the default settings for the remaining settings in the Configuration area.

From the

Pool

list, select the name of the pool you created previously.

From the

Transport Config

list, select the name of the Transport Config you created previously.

From the

Virtual Server

list, select the name of the virtual server you created previously.

From the

Peer

list, select the name of a peer you created previously.

From the

Static Route

list, select the name of a static route you created previously.

Click

Finished

.

The screen refreshes, and you see the new Transport Config profile in the Transport Config list.

Click

Finished

.

The screen refreshes, and you see the new MQTT session profile in the MQTT list.

Click

Finished

.

The screen refreshes, and you see the new Peer profile in the Peers list.

Click

Finished

.

The screen refreshes, and you see the new Route profile in the Static Routes list.

Click

Finished

.

The screen refreshes, and you see the new Route profile in the Static Routes list.

Subscriptions

Product Usage

Trials

Registration Keys

Downloads

Applies To:

BIG-IP APM

Common Elements for Profiles Tasks

Have a Question?

About F5

Education

F5 Sites

Support Tasks

Subscriptions

Product Usage

Trials

Registration Keys

Downloads

Applies To:

BIG-IP APM

Common Elements for Profiles Tasks

Have a Question?

Follow Us

About F5

Education

F5 Sites

Support Tasks