Manual Chapter :
Managing BIG-IQ Applications
Applies To:
Show VersionsBIG-IQ Centralized Management
- 8.3.0, 8.2.0, 8.1.0, 8.0.0
Managing BIG-IQ Applications
What is an application and how do I create one?
An application is just a container that houses multiple application
services in the BIG-IQ user interface. There are a number of different application types you
can create depending on what you plan to do with it. The work flow for creating each type
varies a little.
Regardless of what kind of application you create, once all of the
services are live, you can track their aggregate health and performance; or, you can drill
down to track the performance of each application service.
As with every other task you can perform using BIG-IQ, creating
applications requires permissions that are set up by the BIG-IQ admin. At a minimum (unless
you are the Admin), your user ID must be assigned a custom Application Creator role and that
role must be assigned access to the resources you need.
- An application is a collection of application services that all work to support a common business process. By combining these into one container, you can manage all of the services required to operate that process from one place in the BIG-IQ user interface.
- A multi-cloud, or multi-site application distributes multiple versions of a common application service across different physical locations or cloud platforms. With versions hosted on different platforms or locations, your availability improves, and the overall application health is more robust. If one data center or cloud platform goes down, application traffic just flows to the other one. Or, you might just want the performance benefits that can come from processing traffic locally.
Template Applications
The basic work flow for creating a standard application is to:
- Create or modify an AS3 or service catalog template that defines the objects you need in your application service.
- Create a new application. This creates the 'container' along with a single application service.
- Add additional application services needed to perform the business process you need to support.
Multi-Cloud Application
A multi-cloud application is a type of template application. It gets
it's name from the location and type of application services it deploys. The basic work flow
for creating a multi-cloud application is to:
- Create or modify an AS3 or service template that defines the objects you need in your application services.
- Create the application that will house your application services.
- Use the template to deploy an application service to one cloud provider or data center.
- Use the template to deploy the same application service to a second cloud provider or data center.
- Use a template to create a DNS application service that load balances the traffic between the two application services.
If one cloud platform or data center experiences performance issues,
traffic automatically routes to the other platform, so your application continues to
perform.
Legacy
Application
A legacy application uses
virtual servers that you have already
deployed to your managed devices. Pools, pool members, nodes, and certain HTTP and TCP
profiles associated with the deployed virtual servers are also included in a legacy
application. With a legacy application, you can use the application dashboard to view
statistics and analytic metrics without having to redeploy everything.
Although
you can still make changes to these objects using the Configuration tab, there are
limitations on the type of edits you can make to the application itself using the
application dashboard. These limits depend (in part) on the role to which your user name is
assigned. For example, if you are assigned the application manager role for a specific application
service, you can use the dashboard to enable, disable, or force offline virtual servers, pools, and pool members. If you need to make
substantive changes to these objects, F5 recommends you redeploy the services using an AS3
template.
Add a new BIG-IQ user for a custom role
If
you want to authenticate users with an LDAP, RADIUS, or TACACS+ server, you must first
configure that before adding a user.
Using a template to create an application and deploy it to a BIG-IP device, requires a set
of permissions. These permissions attach to a user ID. For a custom role like application
creator, it's easiest to create the user ID before you create the role.
When logged in as a user with a
custom role, you cannot create an application that uses virtual servers that have been
deployed to your managed devices. To create these legacy applications, you need to log
in as admin.
Since custom roles
have access only to certain areas or screens in the BIG-IQ user interface, it's
important to communicate that to the user. When you assign a custom role to a user, be
sure you outline the responsibilities and restrictions for their role. Clarifying this
helps avoid any potential confusion. Also note,these roles do not have access to the
global search functionality: Network Security Manager, Network Security Edit, Network
Security View, and Trust Discovery Import.
- At the top of the screen, clickSystem.
- On the left, click.
- Click theAddbutton.
- From theAuth Providerlist, select the authentication method you want to use for this user.A user must belong to an LDAP group or have an assigned BIG-IQ role, or authentication will fail.
- In theUser Namefield, type the name for this user.
- In thePasswordandConfirm Passwordfields, type the password for this new user.You can change the password any time.At this point, you could add this user to user groups or assign one or more existing roles to this user. But you don't need to do that if you are creating a user just so you can assign that user a custom role. For instructions on assigning groups and roles refer to theRole-Based User Accesschapter of theManaging Authentication, Roles, and Users from BIG-IQguide onsupport.f5.com.
- Click theSave & Closebutton.
BIG-IQ creates a new user ID, but at this point,
there are no privileges and no with the roles associated with it. BIG-IQ will authenticate
this user using the authentication method you have configured.
Before you tell the user about the new ID, you need to create the custom role and assign
it to this user.
If your BIG-IQ is in an HA pair, you must
synchronize this change by refreshing the secondary BIG-IQ.
Define an application creator role
Before you can define an application creator
role, you must have completed the following tasks:
- Define the resources (templates, service scaling groups (SSGs), devices, or device groups that you want to assign to this role.
- Define the user ID that you want to assign to this role.
When you assign a user the application creator role, you specify the
permissions necessary for creating an application and which templates that user can be
use. You can also control which resources the user can use when deploying application
services. By controlling access to these resources, you reduce the number of decisions
the user needs to make to deploy applications and application services.
Assume for example, that you want a user named Sam to use a specific
set of templates to deploy applications to a particular set of BIG-IP devices. You
create an application creator role for Sam and then assign her access to only the
templates and devices you want her to use when she deploys applications.
If an application has been deployed to the tenant
to which you want this Application Creator assignee to deploy applications, then you
must also assign that user an Application Manager role for one of the applications that
deployed to that tenant. For details about how to assign that role, refer to
Assign an existing user access to an application
of
support.f5.com
. When logged in as a user with a
custom role, you cannot create an application that uses virtual servers that have been
deployed to your managed devices. To create these legacy applications, you need to log
in as admin.
- At the top of the screen, clickSystem.
- On the left, click.
- Near the top of the screen, click theAddbutton.
- Give this Application Creator role aNameand an optionalDescription.The name and description can make it clear what this role is for.You could use a name likeSam-Create-HTTP-Appsand a description likeDeploy HTTP services to Seattle devicesto indicate that this role is for Sam to use to create applications that deploy HTTP services to devices located in Seattle.
- From theActive Users and Groupslist, select the check box next toSam, and click the select arrow.
- Scroll down to the Resources area and specify the resources you want this role to access.You can identify the templates, devices, or service scaling groups that you want users with this role to use when deploying applications or application services. When Sam logs in with this role to create applications, she will be able to see only the resources you specified for her. This gives you peace of mind, and Sam can be confident she is using the correct templates and deploying to the correct target.To give access toDo thisService Catalog TemplatesScroll to theService Catalog Templateslist, select the check box next to the templates that you want Sam to use when deploying applications, and then click the select arrow.AS3 TemplatesScroll to theAS3 Templateslist, select the check box next to the templates that you want Sam to use when deploying applications, and then click the select arrow.AS3 APIsScroll to theAS3 Templateslist, and selectAllow using AS3 without Template.Service Scaling GroupsScroll to theService Scaling Groupslist, and select the check box next to the SSGs that you want Sam to deploy applications to, and then click the select arrow.DevicesScroll to either theDevicesorDevice Groupslist, and select the check box next to the devices or device groups that you want Sam to deploy applications to, and then click the select arrow.If you do not identify any devices or device groups, Sam will be able to deploy applications to any managed device.
- Click theSave & Closebutton.
When Sam logs in with the Application Creator
role you created, she will be able to use only the resources you specified to create
applications and application services. This limitation can be quite helpful in reducing
errors due to miscommunication or misunderstanding.
How do I create an application using BIG-IQ?
There are two ways you can use a template to create an application and the configuration objects it needs. If you have deployed legacy applications that you want to manage, you can also import those. The work flow you use mostly depends on what you plan to do with it.
- Using an AS3 template to create your applications provides the greatest control and flexibility.
- If you are creating an application service that deploys to a service scaling group (SSG), use a service catalog template that defines the objects in that application.
- If you have deployed virtual servers that are performing as applications, you can import those servers to create a legacy application. Once you create this legacy application, you can monitor application performance just as you would for an application created using a template.
The work flow for creating an application service depends on a number of factors. Use the process appropriate for your needs. The following work flows are documented on
support.f5.com
.
What are you trying to create? | AS3 Template | Service Catalog Template | Legacy application | Then use this work flow |
---|---|---|---|---|
A new application for an AWS SSG. | Not supported. | Yes. | Not supported. | Managing Applications in an Auto-Scaled AWS Cloud from BIG-IQ |
A new application for an Azure SSG. | Not supported. | Yes. | Not supported. | Managing Applications in an Auto-Scaled Azure Cloud from BIG-IQ . |
A new application for an VMware SSG. | Not supported. | Yes. | Not supported. | Managing Applications in an Auto-Scaled VMware Cloud from BIG-IQ . |
A new application on a managed device. | Yes, (recommended). | Yes | Not supported. | Create an application using an AS3 template ; or Create an application using a service catalog template . |
An application that uses virtual servers already deployed to a managed device. | No. | No. | Yes. | Create an application using deployed virtual servers . |
Create an application service using an AS3 template
Before you can create and deploy an AS3 application
service, you must be must be assigned a custom Application Creator role, or have user permissions to
access the resources (templates, devices, etc.) needed to deploy the application.
If other application services have been deployed to the tenant you plan to
use, then you must be assigned a user role that has access permissions for every template that has
been used to deploy application services to that tenant before you can deploy an application to
that tenant.
Creating a
new application service from a template allows you to start from the set of objects defined in the
template, modify or add objects, and then deploy the application service to your BIG-IP devices. As
you create the application, you define at least one application service. The application services
specify which of the template objects you want to include and revise the settings that need to be
customized.
- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- ClickCreate.The Create Application Service screen opens.
- Decide whether you want to add a service to an existing application or to create a new application and application service.To add a service to a new application:
- For Grouping, selectNew Application.
- ForApplication Name, type a name for the new application.
- You can type aDescriptionto identify the new application.
To add a service to an existing application:- For Grouping, selectPart of an Existing Application.
- FromApplication Name, select the name of the application to which you want to add this application service.
- You can type aDescriptionto identify the application.
- For Application Service Method, selectUsing Templates.The screen displays additional controls.
- For theTemplate Type, select the AS3 template you want to use to create this application from.
- Use theApplication Service NameandDescriptionfields to identify this application service.
- For theTargetfield, identify the BIG-IP device to which you want the application to deploy.When you choose a target device, bear in mind that when AS3 deploys an application service, it deploys to the tenant partition specified in the AS3 template you are using. As part of the deployment process AS3 removes any objects previously existing in that target partition. For example, if you had manually deployed a number of virtual servers to a partition namedmy-app-serverson a BIG-IP namedmy.server.comand then use AS3 to deploy an application service to that same partition and device, AS3 would remove all of the virtual servers and then deploy the application service.
- Determine the objects that you want to deploy in this application.Required fields for the selected template are marked with a yellow border.
- To omit any of the objects defined in this template, click the (X) icon that corresponds to that object.
- To create additional copies of any of the objects defined in this template, click the (+) icon that corresponds to that object.
- For each object you decide to include in the application, revise the settings that you need to change.If you are deploying an application service to a device that resides in an Amazon or Azure cloud, you must type0.0.0.0/0for theVirtual Address. For both of these cloud environments, F5 recommends that you use an AWS or Azure load balancer in front of the device. The applications you plan to deploy on this device determine the required load balancer listener settings. Use the protocol and port appropriate for the template used to create this application.Use care when you configure a template to create objects that are used by other objects that are created in the same template. (For example, a template might create a service and a pool that the service uses.) If you name an object (you could name the pool Pool1 for example), and allow it to be edited, then when the application deploys, BIG-IQ looks for the name specified in the template; but, the person deploying the application service can edit that name to something else. Continuing the example, if the application deployer edits the pool name to something likeMyPool1, the deployment would fail. It fails because the template creates a pool namedPool1, but the deployment ‘looks for’ a pool namedMyPool1. To ensure successful application deployment, best practice is to leave editable objects in the template un-named so that the application deployer can use the name that best suits their need at the time.
- When you have configured the objects that you want to include in this application, clickCreate.BIG-IQ creates the application and deploys the application service to the target you specified.
When you to deploy an AS3
application service, BIG-IQ creates or updates the configuration objects defined by that
service on the managed device you targeted. You can view these objects, as they perform
their function as part of an application service, on the application services
dashboard.
Before you can view these
newly-deployed objects on the Configuration tab, you must rediscover and re-import services
for each service impacted by the deployment. Keep in mind that objects deployed with AS3
are view-only on the Configuration tab. To make changes to these objects, you make changes
to the AS3 application.
Create an application using a service catalog template
Before you can create
and deploy an application service, you must have configured a service catalog
template.
Creating a new application from a template allows
you to start from the set of objects defined in the template, modify or add objects, and
then deploy the application to your BIG-IP devices. As you create the application, you
define at least one application service. The application services specify which of the
template objects you want to include and revise the settings that need to be
customized.
Your service catalog template
must have an HTTP profile associated with its virtual server, or you will not be
able to deploy it.
- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- ClickCreate.The Create Application Service screen opens.
- Decide whether you want to add a service to an existing application or to create a new application and application service.To add a service to a new application:
- For Grouping, selectNew Application.
- ForApplication Name, type a name for the new application.
- You can type aDescriptionto identify the new application.
To add a service to an existing application:- For Grouping, selectPart of an Existing Application.
- FromApplication Name, select the name of the application to which you want to add this application service.
- You can type aDescriptionto identify the application.
- For Application Service Method, selectUsing Templates.The screen displays additional controls.
- For theTemplate Type, select the service catalog template you want to use to create this application from.
- ForNametype a unique name for the application service.
- For theEnvironmentfield, identify where you want the application to deploy:OptionDescriptionService Scaling GroupFrom theService Scaling Groupfield select the name of the service scaling group to which you want to deploy this application.BIG-IP
- From theBIG-IPfield select the name of the device to which you want to deploy this application.
- To gather statistical data about the performance of this application on the device you deploy it to, selectCollect HTTP Statistics.This option only supports applications managed by BIG-IP version 13.1.0.5 or later. If your template is intended for applications from multiple version of BIG-IP, you can manually enable HTTP statistic collection from the Application Properties configuration (:Properties:CONFIGURATION).
- Determine the objects that you want to deploy in this application.Required fields for the selected template are marked with a yellow border.
- To omit any of the objects defined in this template, click the (X) icon that corresponds to that object.
- To create additional copies of any of the objects defined in this template, click the (+) icon that corresponds to that object.
- For each object you decide to include in the application, revise the settings that you need to change.You can select a value for an object that you are creating in this application that is also created as part of this application. That is, if your service catalog template contains a pool member and a node, in most cases you want to use the node you are creating in the application for that pool member in the application. For example a template could define a poolMyPool1and a node45.54.45.54. To specify the application-created object, you select the value that is prefixed with a pound sign (#) when you select the value for that node. (That option would appear as#45.54.45.54in the example cited here.)
- If you have parameters for the servers required for this application saved in a comma separated values (CSV) file, clickLoad from CSV file, then navigate to the file, and clickOpen.The CSV file must list an IP address and a port for each server, and each server must be on it's own line. For example:1.1.1.1, 80 2.2.2.2, 443 3.3.3.3, 668 4.4.4.4, 22
- If this application includes a client-SSL profile, and theCiphersare editable, there are three potential cipher settings you can configure. You can inherit the settings from the parent profile, you can specify a cipher of your own, or you can select a cipher group.
- To inherit the cipher settings from the parent profile:
- ForCiphers, selectInherit.
- ForCipher Group Override as None, selectInherit.
- ForCipher Group, selectInherit.
- To specify a cipher for this application:
- ForCiphers, selectOther, and then type the cipher text in the adjacent field.
- ForCipher Group Override as None, selectOtherandNone.
- ForCipher Group, selectInherit.
- To specify a cipher group for this application:
- ForCiphers, selectOther, and then leave the adjacent field blank.
- ForCipher Group Override as None, selectInherit.
- ForCipher Group, selectOther, and then select the group from the adjacent list.
- When you have configured the objects that you want to include in this application, clickCreate.BIG-IQ creates the application and deploys the application service to the target you specified.
Create a legacy application using deployed virtual servers
Before you can create a legacy application service, you must deploy the virtual servers that host your application to a managed BIG-IP device. If you want to view statistical and analytic data for this application, you need:
Just as you must log in as Admin to deploy or configure virtual servers or their associated configuration objects, you must log in as Admin to deploy a legacy application service.
- at least one data collection device to this BIG-IQ system.
- an analytics profile attached to the deployed virtual server application.
- Application Visibility & Reporting (AVR) provisioned on the BIG-IP device on which the application resides must be provisioned.
- statistics data collection enabled on the BIG-IP device on which the application resides.
- devices on which the virtual servers are deployed must be at BIG-IP version 13.1.0 or higher.
For the most current and complete requirements detailing the prerequisites for viewing statistical and analytic data for a legacy application refer to the F5 Knowledge Base article K02142132.
An application that uses virtual servers that have already been deployed to your managed devices is referred to as a legacy application. When you create a legacy application, you are just creating a container that BIG-IQ uses to group these objects so you can monitor their performance just like you can monitor applications created using a template. You can view statistics and analytical data about the application performance without having to reconfigure or redeploy the virtual servers and specific configuration objects (pools, pool members, nodes, and some HTTP and TCP profiles) associated with them.
If you plan to use Analytics
to monitor a legacy application, it is strongly recommended to
configure the host virtual server to its own pool. If a legacy
application's virtual server shares a pool with other virtual
servers, this may affect certain data parameters that appear in your
monitoring screens.
If you create a legacy application without statistical and analytics capability, you can still use the application to manage the pool members assigned to the application's virtual servers.
- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- ClickCreate.The Create Application Service screen opens.
- Decide whether you want to add a service to an existing application or to create a new application and application service.To add a service to a new application:
- For Grouping, selectNew Application.
- ForApplication Name, type a name for the new application.
- You can type aDescriptionto identify the new application.
To add a service to an existing application:- For Grouping, selectPart of an Existing Application.
- FromApplication Name, select the name of the application to which you want to add this application service.
- You can type aDescriptionto identify the application.
- For Application Service Method, selectUsing Existing Device Configuration.The screen displays additional controls.
- UseApplication Service Nameto identify this application service.
- For theBIG-IPfield, identify the BIG-IP device on which the virtual servers you want to include in this application service are deployed.The screen lists the virtual servers that reside on the device you selected.
- UseApplication Service Typeto identify whether this is an HTTP and TCP application or just a TCP application.
- For Virtual Servers, double click the name of each server that you want to include in this application service.
- When you finish selecting the virtual servers that you want to include in this application, clickCreate.
BIG-IQ adds the legacy application service to the Applications dashboard. If you satisfied the analytics prerequisites, you can monitor the application performance just like applications created using a template.
If you use the BIG-IQ to make and deploy changes to the virtual servers that comprise this legacy application service, or if you import changes made on the BIG-IP to these virtual servers, BIG-IQ automatically syncs the application service with those changes.
Assign a new user access to an application
If
you want to authenticate users with an LDAP, RADIUS, or TACACS+ server, you must first
configure that before adding a user.
When you create an application or an application service, BIG-IQ creates custom roles for
them. To provide access to an application or application service, you assign users to these
roles. Each application or application service has both a manager and a viewer role. The
manager role is read-write; the viewer role is read only.
One situation in which
you need to assign the Application Manager role is when you delegate permissions to
deploy applications to a tenant that already has applications deployed to it. If the
template assigned to this Application Creator specifies a tenant that has an application
already deployed to it, then before that user can deploy additional applications to the
tenant, they must have the Application Manager role for one of those deployed
applications.
Because some roles have
access only to certain areas or screens in the BIG-IQ user interface, it's important to
communicate these constraints to the user. When you assign a role to a user, be sure you
outline the responsibilities and restrictions for their role. Clarifying this helps
avoid any potential confusion. Also note, these roles do not have access to the global
search functionality: Network Security Manager, Network Security Edit, Network Security
View, and Trust Discovery Import.
- At the top of the screen, clickSystem.
- On the left, click.
- Click theAddbutton.
- From theAuth Providerlist, select the authentication method you want to use for this user.A user must belong to an LDAP group or have an assigned BIG-IQ role, or authentication will fail.
- In theUser Namefield, type the name for this user.
- In thePasswordandConfirm Passwordfields, type the password for this new user.You can change the password any time.
- To associate this user with an existing user group, select the group from theUser Groupslist.You aren't required to associate a user group at this point; you can do that later if you want. If you want to associate another user group with this user, click+.
- For theRolessetting, from theAvailablelist, select the roles to which you want to grant access, and move them to theSelectedlist.You can find the custom roles that BIG-IQ created for the new application by looking for the application, tenant name, and application service names in the list of roles.
- The application role names uses the syntax: <application-name> Manager/Viewer.
- The application service role names uses the syntax: <tennant-name_application-service-name> Manager/Viewer.
For example, if you created an application namedMyAwesomeAppand defined an application service for it namedMyAwesomeServicethat uses a tenant namedMyTennant, BIG-IQ would create four new custom roles.Role NameAccess PermissionsMyAwesomeApp ManagerRead-write permissions for the application and "all" of it's application services.MyAwesomeApp ViewerRead-only permissions for the application and "all" of it's application services.MyTennant_MyAwesomeService ManagerRead-write permissions for the application and "all" of it's application services.MyTennant_MyAwesomeApp ViewerRead-only permissions for the application and "all" of it's application services.Be sure to let your users know that their access to certain parts of the BIG-IQ user interface depends on which role they are assigned. - Click theSave & Closebutton.
This user now has the privileges associated with
the role(s) you selected and BIG-IQ will authenticate this user using the authentication
method you have configured.
You can now tell this user how their BIG-IQ access aligns with their responsibilities.
Make sure they understand they might not see every screen you or one of their peers does.
Also let them know that if they try to log in more than 5 times in 5 minutes with the wrong
user name and/or password, they might get the following error:
Maximum number of login attempts exceeded.
If
that happens, the user must wait 5 minutes before trying to log back in.If your BIG-IQ is in an HA pair, you must synchronize this change
by refreshing the secondary BIG-IQ.
Assign an existing user access to an application
If
you want to authenticate users with an LDAP, RADIUS, or TACACS+ server, you must first
configure that before adding a user.
When you create an application or an application service, BIG-IQ creates custom roles for
them. To provide access to an application or application service, you assign users to these
roles. Each application or application service has both a manager and a viewer role. The
manager role is read-write; the viewer role is read only.
One situation in which
you need to assign the Application Manager role is when you delegate permissions to
deploy applications to a tenant that already has applications deployed to it. If the
template assigned to this Application Creator specifies a tenant that has an application
already deployed to it, then before that user can deploy additional applications to the
tenant, they must have the Application Manager role for one of those deployed
applications.
Because some roles have
access only to certain areas or screens in the BIG-IQ user interface, it's important to
communicate these constraints to the user. When you assign a role to a user, be sure you
outline the responsibilities and restrictions for their role. Clarifying this helps
avoid any potential confusion. Also note, these roles do not have access to the global
search functionality: Network Security Manager, Network Security Edit, Network Security
View, and Trust Discovery Import.
- At the top of the screen, clickSystem.
- On the left, click.
- For theRolessetting, from theAvailablelist, select the roles to which you want to grant access, and move them to theSelectedlist.You can find the custom roles that BIG-IQ created for the new application by looking for the application, tenant name, and application service names in the list of roles.
- The application role names uses the syntax: <application-name> Manager/Viewer.
- The application service role names uses the syntax: <tennant-name_application-service-name> Manager/Viewer.
For example, if you created an application namedMyAwesomeAppand defined an application service for it namedMyAwesomeServicethat uses a tenant namedMyTennant, BIG-IQ would create four new custom roles.Role NameAccess PermissionsMyAwesomeApp ManagerRead-write permissions for the application and "all" of it's application services.MyAwesomeApp ViewerRead-only permissions for the application and "all" of it's application services.MyTennant_MyAwesomeService ManagerRead-write permissions for the application and "all" of it's application services.MyTennant_MyAwesomeApp ViewerRead-only permissions for the application and "all" of it's application services.Be sure to let your users know that their access to certain parts of the BIG-IQ user interface depends on which role they are assigned. - Click theSave & Closebutton.
This user now has the privileges associated with
the role(s) you selected and BIG-IQ will authenticate this user locally.
You can now tell this user how their BIG-IQ access aligns with their responsibilities.
Make sure they understand they might not see every screen you or one of their peers does.
Also let them know that if they try to log in more than 5 times in 5 minutes with the wrong
user name and/or password, they might get the following error:
Maximum number of login attempts exceeded.
If
that happens, the user must wait 5 minutes before trying to log back in.If your BIG-IQ is in an HA pair, you must synchronize this change
by refreshing the secondary BIG-IQ.
Review and edit an application service's Traffic Management
services
Before you can review or revise an
application, you must have created an application using a template with traffic
management services.
You cannot use this work flow
to make substantive changes to a legacy application (one that uses virtual servers
previously deployed to a managed device). Except for enabling, disabling or forcing
offline virtual servers, pools, or pool members, you make changes to legacy applications
by editing the virtual server settings. Refer to
Managing
Virtual Servers
in the BIG-IQ Centralized
Management: Local Traffic and Network Implementations
guide on support.f5.com
. An application service specifies a set of objects
that are deployed to a BIG-IP device or to the devices in a service scaling group. It's
a good idea to review an application after you deploy it to make sure that the
application's traffic management services have precisely the right objects and parameter
settings. If you find issues with the application service that you want to resolve,
there are two ways to make changes:
- If you discover minor issues (for example, you might decide you want to change the value for some of the existing objects in the application service, or maybe you want to change the state of a pool member), you can make direct edits to the application service as described here.
- For more substantive changes (for example, if you find that there are objects you need to add or remove), you should make your changes by revising the template upon which the application service is based. For details, refer toModify an application serviceonsupport.f5.com.
- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- Click the name of the application that you want to edit.BIG-IQ displays the Application dashboard for the selected application and lists the application services that comprise it.
- In the Application Configuration Map, under APPLICATION SERVICES, clickTraffic Management.
- ClickCONFIGURATIONnear the middle of the screen.The objects defined for this application for the service type you selected are listed.
- Click each of the object types (Virtual Server or Pool) defined in this application to review the settings.The right side of the configuration area displays an application map portraying the selected object type.
- To change a setting for a selected object, clickQuick Editand the object is defined as editable in the service catalog template, then revise the parameters that you want to change.If you have administrative access, you can make additional changes to the application template's settings. You can see the application template title when you click APPLICATION Properties at the center left of the screen (make sure you select the CONFIGURATION area). For more information about template configuration, see the sectionManaging Service Catalog Templates.
- When your edits are complete, clickSave & Close.The system updates the application with the settings you specified.
Modifying a template-based application service
Before you can edit an application service, you
must be assigned a role that has permissions to access the template that was used to
deploy the application service.
If the application service
you need to modify is deployed to a tenant to which other application services have
been deployed, then you must be assigned a user role that has access permissions for
every template that has been used to deploy application services to that tenant
before you will be able to modify this application.
Modifying an application service changes the
configuration objects deployed to your devices or service scaling group.
You cannot use this work flow
to make substantive changes to a legacy application (one that uses virtual servers
previously deployed to a managed device). Except for enabling, disabling or forcing
offline virtual servers, pools, or pool members, you make changes to legacy applications
by editing the virtual server settings. Refer to
Managing
Virtual Servers
in the BIG-IQ Centralized
Management: Local Traffic and Network Implementations
guide on support.f5.com
. - At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- Select the name of the application that you want to modify.BIG-IQ lists the application services defined for the selected application.
- Select the name of the application service that you want to modify.
- On the lower part of the screen, select the Configuration tab and make a note of the template listed next toCreated from Template.
- ClickCancelthen click to list the templates defined on this BIG-IQ system so you can select the check box for the template identified in the last step.
- Click, then type a name for the cloned template and clickCloneagain. The system creates a clone of the service template and then opens the new template so you can make changes.
- Determine the objects that you want to revise for this application, and then specify values for those objects.
- When you have configured the objects that you want to revise for this application, clickPublish.BIG-IQ creates the new template and assigns it the read-only status of published, which makes it available to use to create an application.
- ClickApplicationsthen, on the left, clickAPPLICATIONSand select the name of the application you want to revise.BIG-IQ lists the application services defined for the selected application.
- Select the name of the application service that you want to modify.
- ClickSwitch to template; then select the name of the template clone you just created.Objects that you did not revise when you created the clone are left unchanged and the list of editable objects for the cloned template are displayed.
- Revise the settings for the editable objects, and then clickSave.The application service deploys with the changes you specified.
Move an application service
You can move an application service from one
application to another so you can get your services organized the way you want
them.
One potentially common
scenario that requires moving or merging application services occurs when you use an API
to create an AS3 application service. The AS3 API creates these services as components
of an application named
Unknown
Applications
. You can organize these API-created services (using the
Move
or Merge
button) to organize these
services into the application that works best for you.- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- Select the name of the application that contains the application service(s) you want to move.BIG-IQ lists the application services defined for the selected application.
- Select the check box for the application service(s) that you want to move.
- ClickMove.BIG-IQ displays the Move Application Services popup.
- For Grouping, decide where you want to move the application service.
- To create a new application and move the application service into it,
- ClickNew Application.
- Type theApplication Namefor the new application.
- To move the application service to another application:
- ClickPart of an Existing Application.
- Type theApplication Nameto which you want it to move.
- If you are moving all of the application services from this application and you want to delete the empty application, clickRemove applications without services.
- ClickOKto move the application service(s).BIG-IQ moves the application services and (if you asked it to) deletes the empty application.
Merge applications
You can merge application services from multiple
applications. You can either merge them into an existing application, or create a new
application depending on what works best for you.
One potentially common
scenario that requires moving or merging application services occurs when you use an API
to create an AS3 application service. The AS3 API creates these services as components
of an application named
Unknown
Applications
. You can organize these API-created services (using the
Move
or Merge
button) to organize these
services into the application that works best for you.You cannot merge or move an
application service to an application created with a different template type. That is, a
service catalog application service cannot be a part of an AS3 application, and vice
versa. Further, a legacy application service cannot be part of an application created
with either type of template.
- At the top of the screen, clickApplicationsthen, on the left, clickAPPLICATIONS.The screen lists the applications currently defined on this device.
- Select the names of the applications that you want to merge.BIG-IQ lists the application services defined for the selected application.
- Select the check box for the application service(s) that you want to move.
- ClickMerge.BIG-IQ displays the Merge Applications popup.
- For Grouping, decide how you want to merge the applications.
- To merge all of the application services into a new application:
- ClickNew Application.
- Type theApplication Namefor the new application.
- To merge all of the application services into another application:
- ClickPart of an Existing Application.
- Type theApplication Nameinto which you want the application services to merge.
- If you want to delete the empty applications that result from the merge, clickRemove applications without services.
- ClickOKto merge the application service(s).BIG-IQ merges the applications and (if you asked it to) deletes the empty applications.