Configuring an ATI Profile

Before configuring an ATI profile in the BIG-IP, you need to first add your web application to the ATI Dashboard in the F5 XC Console and choose BIG-IP for the JavaScript injection method.

Configure an ATI profile to get insight into unwanted user connections, devices, and behavior on your web application.

1. On the Main tab, click SaaS Services > Application Traffic Insight > ATI Profiles.

   The ATI Profiles screen displays the list of ATI profiles on the system.

2. Click Create.

   The New ATI Profile screen opens.

3. In the Basic/Advanced Toggle, select Advanced.

   Note: If you are configuring a standard deployment for the U.S. cluster, you can select Basic configuration and assign values for just the Basic settings. In this case, all the default values for the Advanced settings are used and all data traffic is sent and stored in the U.S. cluster.

4. In the Profile Name field, enter a unique name for the ATI profile.

5. Optional: In the Description field, enter a description of the profile.

6. At Use Proxy Server, select Yes if you want to route data via a proxy server so that it won’t be sent directly from the BIG-IP to the ATI backend server.

   Note: Some deployments may require proxy support with basic authentication to control outbound traffic towards internet.

7. If Use Proxy Server is No:

   • At API Domain Pool: If you are creating an ATI profile for the first time, click the + button to create a new pool using the domain you received in JS URL in F5 XC Console (or from F5 Support).

     For example, if you received the following JS URL: https://us.gimp.zeronaught.com/__imp_apg__/js/volt-volterra_abcdefg-12345678.js

     use the domain us.gimp.zeronaught.com when creating the pool.

   • At API Hostname: Enter here the same domain used in API Domain Pool.

8. If Use Proxy Server is Yes:

   • At Proxy Pool: Select a Proxy Pool from the drop-down list, or click the + button to configure a new proxy pool.

     If you click the + button, the pool configuration screen appears. In the pool configuration screen, create a new pool with explicit proxy nodes. When you click Finish in the pool configuration screen, you return to the ATI Profile properties screen.

   • At Proxy Username: Enter a user name for proxy authorization. This setting is needed only if your proxy server requires this.

   • At Proxy Password: Enter a password for proxy authorization. This setting is needed only if your proxy server requires this.

   • At Proxy Destination: Enter here the protocol and domain from the JS URL you received in the F5 XC Console (or from F5 Support).

     For example, if you received the following JS URL: https://us.gimp.zeronaught.com/__imp_apg__/js/volt-volterra_abcdefg-12345678.js,

     enter here: https://us.gimp.zeronaught.com.

     Optionally, you can add a port number if you are using a port that is not standard for http or https. Using the example above, if you want to use port 550, enter here: https://us.gimp.zeronaught.com:550.

9. At SSL Profile, select an SSL profile (or use the default) that will be attached to a new virtual server for routing traffic to the Service Pool.

10. At JavaScript Path, enter the path starting with /__imp_apg__/ in the JS URL that you received in the F5 XC Console (or from F5 Support).

    For example, if you received the following JS URL: https://us.gimp.zeronaught.com/__imp_apg__/js/volt-volterra_abcdefg-12345678.js, use the path /__imp_apg__/js/volt-volterra_abcdefg-12345678.js.

11. At Telemetry Path, do not change the path here unless instructed to do so by F5 Support.

12. Add Connecting IP to Headers, select Yes to add a new header with a connecting IP to the HTTP request.

    Note: If you want the connecting IP to be added to the XFF header, do that in an HTTP profile attached to one of the web application’s virtual servers.

13. At Connecting IP Header Name, do not change the header name unless instructed to do so by F5 Support.

    Note: This setting is displayed only if Add Connecting IP to Headers is Yes.

14. At Injection Location, select either After <head> or After <body> for the location of the JS injection.

15. At Script Attribute, choose an attribute that is added at the end of the injected JS, either Async Defer, Async, Sync, or Defer. This attribute determines how the JavaScript is loaded and executed.

16. At Inject in Specific Paths, select Yes to inject the JS in specific web pages of your web application. Select No to inject the JS in all web pages of your web application.

    • If Inject in Specific Paths is Yes, at Injection Paths enter the relative paths of the webpages in your application to receive the JS injections. You can use * for wildcard pattern matching.

17. At Exclude Injection from Specific Paths, select Yes to exclude the JS injection from specific web pages in your web application.

    • If Exclude Injection from Specific Paths is Yes, enter the relative paths of the web pages in your application that the JS injections should be excluded from. You can use * for wildcard pattern matching.

18. At iRules, select iRules to attach to the API Domain Pool or Proxy Pool. iRules help automate the intercepting, processing, and routing of ATI-related traffic to the ATI backend server.

    • Enabled: Lists the iRules on the system that are already applied to the API Domain Pool or Proxy Pool. The BIG-IP applies iRules in the order that they appear in the list. You can change the order using the up and down buttons.
    • Available: Lists the iRules on the system that are available to apply on the API Domain Pool or Proxy Pool.

19. Click Save.

After you have configured your ATI profile, you need to assign that profile to a virtual server.