Manual Chapter :
Integrating APM with PingAccess
Servers
Applies To:
Show Versions![Show Versions](/etc/designs/pcx/techdocs/images/expandversions.gif)
BIG-IP APM
- 14.0.1, 14.0.0
Integrating APM with PingAccess
Servers
Overview: Integrating APM with
PingAccess
You can configure Access Policy Manager (APM®) to
act as a Policy Enforcement Point (PEP) in place of PingAccess agents installed on web servers.
In this case, APM intercepts client requests to web applications, and queries PingAccess servers
for policy decisions. APM then enforces the policy decisions that the PingAccess server provides,
such as these:
- Allow or deny a request for a resource.
- Redirect the user for authentication.
- Modify request/response HTTP headers.
Prerequisites for PingAccess
integration
Infrastructure for a PingAccess deployment might include one or more PingAccess servers with
zero or more agents configured on each one. Before you start to configure Access Policy Manager (APM®) for PingAccess, download agent
properties files from PingAccess servers. If PingAccess servers are deployed in a cluster, you
need only one agent properties file per agent instance.
For more information, refer to
PingAccess Deployment Guide
, which is available
from Ping Identity. F5 is not responsible for any
inaccuracies in third party content.
PingAccess SSL certificates and BIG-IP
configuration
A PingAccess agent properties file can include only one SSL certificate. When importing the
PingAccess agent properties file, Access Policy Manager (APM®) can also import the SSL certificate. With the certificate imported, APM creates a
server SSL profile and specifies the SSL certificate in the
Trusted Certificate
Authorities
field.For more information, refer to
BIG-IP® System: SSL
Administration
on the AskF5™ web site located at
support.f5.com/
. Uploading PingAccess agent properties to
APM
You upload agent properties files
for use in Access Policy Manager (APM)
communication with PingAccess servers.
If the PingAccess server
is configured to use SSL, and APM can detect the server SSL certificate in the agent
properties file, you will have the opportunity to import the server SSL certificate
from the server along with the agent properties.
- On the Main tab, click.
- ClickCreate.A New screen opens.
- In theNamefield, type a unique name.
- In the Configuration area forProperties File, click theChoose Filebutton.A popup directory screen opens.
- Navigate to and select an agent properties file that you downloaded from a PingAccess server, and clickOpen.The popup screen closes. If APM detects a valid SSL certificate in the properties file, anImport SSL Certificatecheck box displays.
- If theImport SSL Certificatecheck box displays, select it.The SSL certificate comes from the PingAccess server.
- ClickFinished.APM imports the properties file. If you selected theImport SSL Certificatecheck box, APM imports the certificate to the BIG-IP system and creates a server SSL profile that specifies the certificate as the trusted certificate authority. The name of the imported certificate and the name of the server SSL profile match the name you specified for this PingAccess properties object.
If the PingAccess server uses SSL,
and APM did not detect and import an SSL certificate, you must download the SSL
certificate from the PingAccess server, import it to the BIG-IP system, and configure a
server SSL profile to use it.
Configuring a local
traffic pool of PingAccess servers
You configure a pool of PingAccess servers that
serve requests from the same PingAccess agent so that, when Access Policy Manager (APM)
acts as a Policy Enforcement Point (PEP) in place of the PingAccess agent, APM has the
correct group of PingAccess servers with which to interact.
- On the Main tab, click.The Pool List screen opens.
- ClickCreate.The New Pool screen opens.
- In theNamefield, type a unique name for the pool.
- ForHealth Monitors, you can selecttcp.You can select an HTTP or HTTPS type of health monitor if you configure one to use this custom send stringGET /pa/heartbeat.ping\r\n.
- In the Resources area, for theNew Memberssetting, add PingAccess servers that serve requests from the same agent:
- Either type an IP address in theAddressfield, or select a preexisting node address from theNode List.
- In theService Portfield, type the port number.The default port number for PingAccess server is 3030. However, the port used in your configuration might differ.
- ClickAdd.
- ClickFinished.
The new pool appears in the Pools list.
Creating a PingAccess profile for APM
authentication
You configure a profile to specify
PingAccess agent properties and PingAccess servers for integration with Access Policy Manager (APM).
- On the Main tab, click.
- ClickCreate.A New screen opens.
- In theNamefield, type a unique name.
- For theProperties Filefield, select one from the list or click (+) to upload a PingAccess agent properties file before you make a selection.
- From thePool Namelist, select the pool of PingAcess policy servers that you configured earlier.
- TheUse HTTPSsetting default is to have the check box selected (enabled).
- IfUse HTTPSis enabled, from theServer SSL Profilelist, select a profile that is configured with the PingAccess server SSL certificate as the trusted certificate authority.If APM imported the server SSL certificate from the PingAccess agent properties file, the profile name matches the properties file name.
For the PingAccess profile to go
into effect, you must now add it to a virtual server.
Configuring a pool
of web application services to protect
You configure a pool to specify the web
application services behind a virtual server that Access Policy Manager (APM) protects
when acting as a PingAccess agent.
- On the Main tab, click.The Pools list screen opens.
- ClickCreate.The New Pool screen opens.
- In theNamefield, type a name for the pool.Names must begin with a letter, and can contain only letters, numbers, and the underscore (_) character.The pool name is limited to 63 characters.
- In the Resources area, for theNew Memberssetting, add web application services that APM protects:
- Either type an IP address in theAddressfield, or select a preexisting node address from theNode List.
- In theService Portfield, type the port number for the web application service.
- ClickAdd.
- ClickFinished.
The new pool appears in the Pools list.
To use this pool, you must now specify it in the
virtual server configuration. If the web application servers use SSL, download the SSL
certificate, import it into the BIG-IP system, and create a server SSL profile with the
certificate to assign to the virtual server configuration.
Creating a virtual server for a PingAccess
profile
A virtual server represents a
destination IP address for application traffic.
- On the Main tab, click.The Virtual Server List screen opens.
- ClickCreate.The New Virtual Server screen opens.
- In theDestination Address/Maskfield, type the IP address for a host virtual server.The IP address you type must be available and not in the loopback network.This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
- In theService Portfield:
- If you want to specify a single service port or all ports, confirm that thePortbutton is selected, and type or select a service port.
- If you want to specify multiple ports other than all ports, select thePort Listbutton, and confirm that the port list that you previously created appears in the box.
- From theHTTP Profile (Client)list, select a previously-created HTTP/2 profile for client-side traffic.
- If SSL protocol is in use on the web application servers in the pool that you configured previously:
- FromSSL Profile (Client), select a profile.
- FromSSL Profile (Server), select a profile.
- From theSource Address Translationlist, selectAuto Map.
- Scroll down to the Access Policy area.
- Confirm thatAccess Profileis set toNone.APM supports assignment of only one of these profiles to a virtual server: an access profile or a PingAccess profile.
- From thePingAccess Profilelist, select a profile.
- Retain the default values for all other settings in the Access Policy area.
- In the Resources area of the screen, from theDefault Poollist, select the name of the pool that you configured to specify web applications that APM protects.
- ClickFinished.
A destination IP address on the BIG-IP system is now available for application traffic.
Troubleshooting SSL handshake
failure
If the connection between the BIG-IP system and an external server is SSL-protected and it
fails, these steps might help you if the problem is due to the BIG-IP system using a
later version of TLS than the external server uses. (Older servers that do not support
later TLS versions might generate an alert and close the connection.)
- From the command line on the BIG-IP system, typetmsh list sys dbSSL.OuterRecordTls1_0.Information about the db variable displays. If the db variable is set to its default value of enable, the BIG-IP system specifies TLS version 1.0 in the outer SSL record, and this should cause no problem for a server that does not support later TLS versions.
- If the db variable is set to disable, to make a change that affects only the sessions started through a virtual server with a particular server SSL profile, update the server SSL profile.
- On the Main tab, click.
- Click the name of the profile you want to update.
- ForConfiguration, selectAdvancedand select theCustomcheck box.
- Scroll to theOptions Listsetting.
- From theAvailable Optionslist, selectNo TLSv1.1andNo TLSv1.2and click theEnablebutton.The selected options display on theEnabled Optionslist.
- ClickUpdate.
- If the db variable is set to disable, and you are sure that you should make a system-wide change, typetmsh modify sys dbSSL.OuterRecordTls1_0valueenable.The db variable is restored to its default value.
Refer to
BIG-IP System: SSL Administration
and Release notes for BIG-IP Local Traffic Manager™ on the AskF5
web site located at support.f5.com/
.Modifying APM logging for PingAccess
profile
For troubleshooting purposes, you
might need to modify the log level for PingAccess profile.
Only the
default-log-setting applies to PingAccess profile logging. Log settings in an access
profile do not apply, because Access Policy Manager (APM) does not support an access profile with PingAccess.
- On the Main tab, click.A log settings table screen opens.
- Selectdefault-log-settingand clickEdit.A popup screen opens.
- On the left, selectAccess System Logs.
- From thePingAccess Profilelist, select a value.The default value isNotice. F5 does not recommend selectingDebugunless you are instructed to do so by support engineers.
- ClickOK.The popup screen closes.