Manual : Implementing Device Posture Checks

Applies To:

  • BIG-IP APM

    15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0

Implementing Device Posture Checks

A device posture check can be used to continuously check the state of a macOS or Windows client. This feature provides asynchronous desktop client posture checking. Using F5 Access Guard for Mac and Windows, administrators can now include the ability to transmit up-to-date device posture information to Access Policy Manager in a cryptographically signed HTTP header. With a device posture check, you can check several categories of items on a client machine.

  • Antivirus
  • Endpoint State
  • Firewall
  • Hard Disk Encryption
  • Patch Management
  • Public File Sharing
  • System Health Agent

You can add these items in a per-request policy using subroutines only. You can configure any subroutine to be checked against the client either periodically, or on every request.

Continuous client checks in a subroutine are supported only on macOS and Windows. Continuous client checks require that the F5 Access Guard service and browser extension be installed, and that the administrator configures the F5 Access Guard configuration file to specify the items to be checked. Refer to the F5 Access Guard Configuration documentation for more information.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add the Client Information check to a per-request policy to enable the policy to collect the client information specified by F5 Access Guard, and to use this information for client information checks in subroutines.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. On a branch in the per-request policy, click the plus symbol to add an item.

  4. Click the Endpoint Security (Server-Side) tab, and select Client Information, then click Add Item.

  5. From the Certificate Authority field, select the certificate authority used to encrypt the information in HTTP headers.

    The Client Information check is added, and information as specified in the F5 Access Guard configuration file is collected from clients that access the virtual server to which this per-request policy is attached.

  6. Click Save.

Add client check items to subroutines, and add those subroutines to the per-request policy, to check client information.

A per-request policy is required to create and use a subroutine. You must have a per-request policy and create a subroutine to use subroutine settings.

Subroutine settings allow you to specify that a subroutine runs either per-request or at specified intervals, or based on gating criteria.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. Expand the subroutine you want to edit.

  4. Click Subroutine Settings /Rename.

  5. Specify the Inactivity Timeout in seconds.

    This is the number of seconds after which an inactive session is invalidated. The default is 300 seconds (5 minutes).

  6. Specify the Max Subsession Life in seconds.

    This is the number of seconds after the session is validated when the session is considered expired, and the subroutine must be revalidated if a request occurs. The default is 900 seconds (15 minutes). If this is set to 0, the subroutine must be revalidated on every request.

  7. Specify the Subroutine Timeout in seconds. This is the amount of time in which the subroutine must complete, or the subroutine is invalidated. The default is 120 seconds (2 minutes).

  8. Select any Gating Criteria.

    Gating criteria is a value that, when present, starts the subroutine. If you want to use a specific variable to trigger the subsession, specify the variable. Otherwise, any item in the subroutine will start the subsession.

    To restart the subroutine based on changes to the information collected in the user information collected by F5 Access Guard, select perflow.client.information.hash.

    To restart the subroutine if the client IP address changes, type the custom variable perflow.client.ip.address.

  9. Click Save.

The subroutine is saved with the settings you configured.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add endpoint state checking to an access policy to check client machines for a specified antivirus package, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Endpoint State, and click Add Item.

    By default, the Endpoint State check has no configuration.

  7. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

Add an endpoint check to the subroutine following this action.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add antivirus checking to an access policy to check client machines for a specified antivirus package, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Antivirus, and click Add Item.

  7. Configure the Antivirus check settings.

  8. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The Antivirus action checks for antivirus software on the client computer. When checking for multiple antivirus types, if one antivirus type matches the software on the client system, the action passes, regardless of other antivirus conditions that are specified in the action.

An antivirus action in a subroutine is continuously checked, based on the settings configured in the Subroutine Settings.

An Antivirus action provides these settings and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.

Note: A link to a report that includes the antivirus software that Access Policy Manager currently supports is available on the BIG-IP system Welcome page.

Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
State
Specifies one of these states:
  • Enabled - when selected, the action verifies that the antivirus software is enabled
  • Disabled - when selected, the action verifies that the antivirus software is disabled.
  • Unspecified - when selected, the action does not verify the state of the software.
Version
Specifies a version; when specified, the antivirus action verifies the version of the software.
Engine Version
Specifies the engine version number; when specified, the antivirus action verifies this information.
DB Version
Specifies the database version number; when specified, the antivirus action verifies this information.
DB Age Not Older Than (days)
Specifies the database age in days; when specified, the antivirus action verifies this information.
Last Scan Time Not Older Than (days)
Specifies a number of days; when specified, the antivirus action verifies that the last scan did not occur more than the specified number of days ago.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add firewall checking to an access policy to check client machines for a specified firewall package, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Firewall, and click Add Item.

  7. Configure the Firewall check settings.

  8. Click Save.

  9. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The Firewall action checks for firewall software on the client computer. When this action includes checks for multiple firewall types, if one firewall type matches the software on the client computer, the action passes, regardless of other firewall conditions that are specified in the action.

A firewall action provides these settings and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.

Note: A link to a report that includes the firewall software that Access Policy Manager currently supports is available on the BIG-IP system Welcome page.

Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
State
Specifies one of these states:
  • Enabled When selected, the action verifies that the firewall software is enabled
  • Disabled When selected, the action verifies that the firewall software is disabled.
  • Unspecified When selected, the action does not verify the state of the software.
Version
Specifies a version; when specified, the firewall action verifies the version of the software.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add hard disk encruption checking to an access policy to check client machines for hard disk encryption, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Hard Disk Encryption, and click Add Item.

  7. Configure the Hard Disk Encryption check settings.

  8. Click Save.

  9. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The Hard Disk Encryption action checks for hard disk encryption software on a client computer. When this action includes checks for multiple hard disk encryption types, if one of the specified hard disk encryption types matches the software on the client system, the action passes, regardless of other hard disk encryption conditions that are specified in the item.

A Hard Disk Encryption action provides these settings and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.

Note: A link to a report that includes the hard disk encryption software that Access Policy Manager currently supports is available on the BIG-IP system Welcome page.

Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
Encryption State
Specifies one of these states:
  • Enabled When selected, the action verifies that all disk volumes are encrypted on the client.
  • Disabled When selected, the action verifies all disk volumes are not encrypted on the client.
  • Unspecified When selected, the action verifies that hard disk encryption software is installed on the client.
Version
Specifies a version; when specified, the Hard Disk Encryption action verifies the version of the software.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add hard disk encruption checking to an access policy to check client machines for patches, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Patch Management, and click Add Item.

  7. Configure the Patch Management check settings.

  8. Click Save.

  9. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The Patch Management action can check for patch management software on the client system. When this action includes checks for multiple patch management types, if one specified type matches, the action passes, regardless of other conditions that are specified in the action.

The Patch Management action provides the following configuration elements and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.
Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
Automatic Updates
Specifies one of these values:
  • Enabled When selected, the action verifies that patch management software is running on the client system.
  • Disabled When selected, the action verifies that patch management software is not running on the client system.
  • Unspecified When selected, the action does not perform either verification.
Version
Specifies a version; when specified, the Patch Management action verifies the version of the software.
Max Allowed No. of Missing Critical Updates
Specifies a number; when specified, the action verifies that the number of missing critical updates for the software is less than this number.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add public file sharing checking to an access policy to check client machines for file sharing software, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select Public File Sharing, and click Add Item.

  7. Configure the Public File Sharing check settings.

  8. Click Save.

  9. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The Public File Sharing action checks for public file sharing software on a client computer. When this action includes checks for multiple public file sharing types, if one of the specified public file sharing types matches the software on the client system, the action passes, regardless of other public file sharing conditions that are specified in the item.

A Public File Sharing action provides these settings and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.

Note: A link to a report that includes the public file sharing software that Access Policy Manager currently supports is available on the BIG-IP system Welcome page.

Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
State
Specifies one of these states:
  • Running When selected, the action verifies that the file sharing software is running on the client.
  • Stopped When selected, the action verifies that the file sharing software is not running on the client.
  • Unspecified When selected, the action verifies that the file sharing software is installed on the client.
Version
Specifies a version; when specified, the Public File Sharing action verifies the version of the software.

You should have a per-request policy attached to a virtual server. In addition, your virtual server must have an access profile attached, which can be a blank “allow-all” policy.

Add hard disk encruption checking to an access policy to check client machines for system health softeware, either continuously, or on each request.

  1. From the Main tab, click Access > Profiles / Policies > Per-Request Policies.

  2. Find the policy you want to edit, and in the Per-Request Policy column, click Edit.

  3. In the per-request policy, click Add New Subroutine.

  4. Name the subroutine and click Save.

  5. Expand the subroutine, and click the plus to add a new item.

  6. Select Endpoint Security (Client-Side), select System Health Agent, and click Add Item.

  7. Configure the System Health Agent check settings.

  8. Click Save.

  9. To configure subroutine settings such as the session lifetime or gating criteria, click Subroutine Settings / Rename.

The System Health Agent action checks for health agent software on client systems. When this action includes checks for multiple health agent types, if one specified type matches the software on the client system, the action passes, regardless of other health agent conditions that are specified in the action.

A System Health Agent action provides these settings and options:

Platform
Specifies a platform. The default is Any. When a platform is selected, the Vendor ID and Product ID lists update to include the products and vendors that are supported for that platform according to the EPSEC package that is installed on the BIG-IP system.

Note: A link to a report that includes the antivirus software that Access Policy Manager currently supports is available on the BIG-IP system Welcome page.

Vendor ID
Specifies a vendor ID (from the list of supported vendors) or Any.
Product ID
Specifies a product ID (from the list of supported products) or Any.
Version
Specifies a version; when specified, the System Health Agent action verifies the version of the software.
Policy Compliance
Specifies one of these values:
  • Enabled - when selected, the action verifies that the client is compliant with the health policy specified by the site administrator.
  • Disabled - when selected, the agent verifies that the client is out of compliance with the health policy specified by the site administrator.
  • Unspecified - when selected, the gent verifies the existence of the software only.