F5 Logo MyF5
Search
  1. MyF5 Home
  2. BIG-IP Access Policy Manager: Edge Client version 7.1.8 and Application Configuration
  3. Configuring Access Policy Manager for MDM applications
Manual Chapter : Configuring Access Policy Manager for MDM applications

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0
Manual Chapter

Configuring Access Policy Manager for MDM applications

Overview: Configuring APM for device posture checks with endpoint management systems

MDM solutions are responsible for managing user devices, where a user enrolls a device (or devices) and sets certain compliance policy which dictates whether a device is compliant or non-compliant. The endpoint management system determines whether the APM recognizes the device before allowing access from the access policy. An endpoint management system also controls the corporate data on mobile devices. Edge Client establishes a VPN connection with APM, and an endpoint management system (Airwatch, MaaS360, or Intune) manages and sends device details to APM.
To reduce the number of queries to the MDM server, the Database Synchronization Manager lists all the compliant devices in the case of Airwatch and MaaS360 & non-compliant devices in the case of Microsoft Intune and stores the information in the local cache. The synchronization interval is configurable to fit your situation and is refreshed after every 4 hours by default to get a new list of devices. When a device tries to connect through the F5 Access client, the local cache is queried for the device ID. When the device ID is not found, the device is verified by the MDM server. When the device is found compliant, the device ID is added to the local cache after the user logs in.
Supported Devices
Only iOS devices and Android devices with VPN access to APM from specific mobile device apps that are being managed by MDM (F5 Access Client Apps) are supported. For example, if you connect to APM WebTop from a browser in a device, then APM will not get a device ID and cannot check for device compliance.
F5 Access for macOS and Windows are currently not supported.
For devices with iOS 12 and later, F5 Access client could not retrieve device ID from iOS due to Apple imposed constraints, and compliance check failed. Microsoft's Network Access Control (NAC) integration with Intune provides a new temporary NAC ID to identify the device. This ID is pushed to the F5 Access client through the F5 Access profile in Intune. For iOS devices, the device is always verified by the MDM server as the NAC ID is not stored in the local cache.
To use NAC on iOS devices, the
Enable network access control (NAC)
 option must be selected when configuring the VPN profile for F5 Access in Microsoft Intune.

Creating an endpoint management system connector with Airwatch

You must create a Server SSL profile on a BIG-IP system and have access to an Airwatch system.
An endpoint management system on BIG-IP Access Policy Manager(APM) is an object that stores information about the device management server, such as IP addresses and API credentials. You can configure more than one endpoint management system on the same BIG-IP system. APM polls devices connected to configured endpoint management systems.
  1. Log in to the Airwatch console using the administrator user name and password.
  2. On the left panel, click
    Accounts
    .
    The View Role screen displays.
  3. For the
    Categories
     setting, click
    API
    REST
    .
  4. Enable API access for the administrator.
  5. On the left panel on the main screen, click
    Groups & Settings
    .
    The Settings popup screen opens.
  6. Under the System tab, click
    API
    REST API
    The System/Advanced/API/REST popup screen opens.
  7. On the System/Advanced/API/REST screen, select the
    General
     tab.
  8. Select the
    Override
     setting.
  9. Select
    Enable API Access
    .
  10. Copy the API key displayed next to
    API key
    .
  11. Click
    Save
    .
  12. On the BIG-IP system, on the Main tab, click
    Access Policy
    Authentication
    Endpoint Management Systems
    .
    The Endpoint Management Systems screen opens.
  13. Click
    Create
    .
  14. In the
    Name
     field, type a name for the endpoint management system.
  15. In the
    Type
     list, select
    Airwatch
     for the endpoint management system.
  16. In the
    FQDN
     field, type a fully qualified domain name.
  17. In the
    Port
     field, type
    443
    .
  18. From the
    Server SSL Profile
     list, select a previously created Server SSL profile in BIG-IP Local Traffic Manager.
  19. In
    Update Interval (minutes)
     field, type a number in minutes that represents how often APM updates the device database.
  20. In the
    Username
     field, type the Airwatch administrator user name.
  21. In the
    Password
     field, type the Airwatch administrator password.
  22. In the
    API Token
    field, type or paste the API key copied from the Airwatch screen.
  23. Click
    Finished
    .
You have created an endpoint management system. APM tests the connection to the device management server, and prints a test status in the
Status
 field. If the status displays
OK
, APM starts the device database synchronization for the created endpoint management system.
The Airwatch interface might change.

Creating an endpoint management system connector with MaaS360

You must create a Server SSL profile on a BIG-IP system and have access to an MaaS360 system.
An endpoint management system on BIG-IP Access Policy Manager(APM) is an object that stores information about the device management server, such as IP addresses and API credentials. You can configure more than one endpoint management system on the same BIG-IP system. APM polls devices connected to configured endpoint management systems.
  1. Contact MaaS360 to obtain information needed to access the API.
    The information required includes the following data:
    • Application ID
    • Platform version
    • Version number
    • Access key
    • Service URL
  2. Log in to the MaaS360 console using the administrator user name and password.
  3. At the bottom of the screen, copy the Account ID.
  4. On the BIG-IP system, on the Main tab, click
    Access
    Authentication
    Endpoint Management Systems
    .
    The Endpoint Management Systems screen opens.
  5. Click
    Create
    .
    The New endpoint management system screen opens.
  6. In the
    Name
     field, type a name for the endpoint management system.
  7. In the
    Type
     list, select
    MaaS360
     for the endpoint management system.
    The Network location and API Credentials sections display.
  8. In the
    FQDN
     field, type the service URL provided by MaaS360.
  9. In the
    Port
     field, type
    443
    .
  10. From the
    Server SSL Profile
     list, select a previously created Server SSL profile in BIG-IP Local Traffic Manager.
  11. In
    Update Interval (minutes)
     field, type a number in minutes that represent how often APM updates the device database.
  12. In the
    Username
     field, type the MaaS360 administrator user name.
  13. In the
    Password
     field, type the MaaS360 administrator password.
  14. In the
    Billing Id
     field, type or paste the billing ID copied from the MaaS360 screen.
  15. In the
    Application Id
     field, type the application ID provided by MaaS360.
  16. In the
    Access Key
     field, type the access key provided by MaaS360.
  17. In the
    Platform
     field, type the platform version of the MaaS360 console.
  18. In the
    App Version
     field, type the current version number of the application that is linked to the account.
  19. Click
    Finished
    .
You have created an endpoint management system. APM tests the connection to the device management server, and prints a test status in the
Status
 field. If the status displays
OK
, APM starts the device database synchronization for the created endpoint management system.
The MaaS360 interface might change.

Creating an Azure web application with Microsoft Intune for APM

Before you can configure a web application, contact Microsoft to purchase a Microsoft Intune subscription.
BIG-IP APM integrates Microsoft Intune by configuring a Microsoft Azure Client web application on the Microsoft Azure portal. This topic describes how to create a web application to obtain a client ID and a client secret.
  1. On Microsoft Azure, on the main tab, click
    Azure Active Directory
    .
    The Azure Active Directory screen opens.
  2. Click
    App registration
    .
    The App registrations screen opens.
  3. Click
    New registration
    .
    The Register an application screen opens.
  4. In the
    Name
     field, type a name for the new web application.
  5. From the
    Application
     type dropdown menu, select
    Web app / API
    .
  6. In the
    Sign-on URL
     field, type a URL.
    This can be any URL, such as
    https://localhost
    .
  7. Click
    Register
    .
    A newly-created application's page displays the registration details.
  8. Copy the Application ID to your records.
    You use this ID as a client id when configuring an EMS object on the BIG-IP system.
  9. In the
    Manage
     section, click
    Certificates & secrets
    .
    The
    Certificates & secrets
     screen opens.
  10. Under Client secrets, click
    New Client Secret
     to create a secret key.
  11. In the
    Description
     field, enter any description for this secret key.
  12. In the
    Expires
     section, select
    Never
    .
  13. Click
    Add
    .
    You should copy the key to the administrator records. You use this key as a client secret when configuring an EMS object on the BIG-IP system.
    A new key displays in the
    Certificates & secrets
     screen.
  14. Click
    Overview
     to navigate to the app screen with registration details. In the
    Manage
     section, click
    API permissions
    .
    The API permissions screen opens.
  15. Click
    Add a permission
    .
    The Request API permissions screen opens.
  16. Select
    Intune
     from the list of Microsoft APIs, and then select
    Application Permissions
    .
  17. From the
    Permissions
     list, select
    Get device state and compliance information from Microsoft Intune
    .
  18. Click
    Add a permissions
    .
    A list of added permissions displays.
  19. Click
    Add a Permission
     again.
  20. Select
    Microsoft Graph
     from the list of Microsoft APIs, and then select
    Application Permissions
    .
  21. Select one of the following under Application dropdown:
    • Application.Read.All
       (This is required for Microsoft Graph)
    • Application.ReadWrite.All
    • Application.OwnedBy
    • Directory.Read.All
    Click
    Add Permissions
    .
    A list of added permissions displays.
  22. On the API permissions screen, click
    Grant admin consent for
     button. When asked to confirm grant consent for all accounts in the Azure domain, click
    Yes
    .
You now have a tenant ID, client ID, and client secret.
Note:
 In June 2020, Microsoft announced the deprecation of the Azure Active Directory (AD) Graph API. The Microsoft Graph will replace the Azure AD Graph, offering improved security and resilience, starting June 30, 2022. When adding new API permission, the Azure Active Directory Graph option is greyed out and is not available as Microsoft recommends using Microsoft Graph APIs for new permission requests. If you still want to continue adding Azure Active Directory Graph permission, click
Add a Permission
APIs my organization users
Search for "Windows Azure Active Directory"
and grant legacy permissions as per your requirement.

Creating an endpoint management system connector with Microsoft Intune

You must create a Server SSL profile on a BIG-IP system and have access to a Microsoft Intune system.
An endpoint management system on BIG-IP Access Policy Manager(APM) is an object that stores information about the device management server, such as IP addresses and API credentials. You can configure more than one endpoint management system on the same BIG-IP system. APM polls devices connected to configured endpoint management systems.
  1. On the BIG-IP system, on the Main tab, click
    Access
    Authentication
    Endpoint Management Systems
    .
    The Endpoint Management Systems screen opens.
  2. Click
    Create
    .
    The New endpoint management system screen opens.
  3. In the
    Name
     field, type a name for the endpoint management system.
  4. In the
    Type
     list, select
    Microsoft Intune
     for the endpoint management system.
    The Network location and API Credentials sections display.
  5. From the
    Server SSL Profile
     list, select a previously created Server SSL profile in BIG-IP Local Traffic Manager.
  6. From the
    DNS Resolver
     list, select a previously created DNS Resolver in BIG-IP Local Traffic Manager.
    Create a DNS Resolver the same way you create a Server SSL profile.
  7. In
    Update Interval (minutes)
     field, type a number in minutes that represent how often APM updates the device database.
  8. In the
    Tenant Id
     field, type the tenant ID that comes with a Microsoft Intune subscription.
  9. In the
    Client Id
     field, type the client ID that becomes available after creating a web application.
  10. In the
    Client Secret
     field, type the client secret that becomes available after creating a web application.
  11. Click
    Finished
    .
You have created an endpoint management system. APM tests the connection to the device management server, and prints a test status in the
Status
 field. If the status displays
OK
, APM starts the device database synchronization for the created endpoint management system.

Editing an endpoint management system configuration

You can create an endpoint management system on BIG-IP APM with either Airwatch, MaaS360 or Intune.
An endpoint system management system connector object on BIG-IP Access Policy Manager(APM) is an object that stores information about the device management server, such as IP addresses and API credentials. You can configure more than one endpoint management system on the same BIG-IP system. APM polls devices connected to configured endpoint management systems.
  1. On the BIG-IP system, on the Main tab, click
    Access
    Authentication
    Endpoint Management Systems
    .
    The Endpoint Management Systems screen with a list of endpoint management systems opens.
  2. In the Name column, click the name of the endpoint management system you want to edit.
    The properties screen for that endpoint management system opens.
  3. Edit one or more fields.
    The status of the endpoint management system updates during each sync interval. If you edit the
    Username
    ,
    FQDN
    , or
    Port
     fields, the
    Status
     field displays the same status as the actual configuration status. If you edit other property fields, the
    Status
     field might be different than the actual configuration status. The correct status appears when the next sync interval begins
  4. Click
    Update
    .
You have updated an endpoint management system.

Creating an access profile

You create an access profile to provide the access policy configuration for a virtual server that establishes a secured session.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. Click
    Create
    .
    The New Profile screen opens.
  3. In the
    Name
     field, type a name for the access profile.
    A access profile name must be unique among all access profile and any per-request policy names.
  4. From the
    Profile Type
     list, select one these options:
    • LTM-APM
      : Select for a web access management configuration.
    • SSL-VPN
      : Select to configure network access, portal access, or application access. (Most access policy items are available for this type.)
    • ALL
      : Select to support LTM-APM and SSL-VPN access types.
    • SSO
      : Select to configure matching virtual servers for Single Sign-On (SSO).
      No access policy is associated with this type of access profile
    • RDG-RAP
      : Select to validate connections to hosts behind APM when APM acts as a gateway for RDP clients.
    • SWG - Explicit
      : Select to configure access using Secure Web Gateway explicit forward proxy.
    • SWG - Transparent
      : Select to configure access using Secure Web Gateway transparent forward proxy.
    • System Authentication
      : Select to configure administrator access to the BIG-IP system (when using APM as a pluggable authentication module).
    • Identity Service
      : Used internally to provide identity service for a supported integration. Only APM creates this type of profile.
      You can edit Identity Service profile properties.
    Depending on licensing, you might not see all of these profile types.
    Additional settings display.
  5. In the Language Settings area, add and remove accepted languages, and set the default language.
    A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
  6. Click
    Finished
    .
The access profile displays in the Access Profiles List. Default-log-setting is assigned to the access profile.

Configuring an access policy to include endpoint management integration

You can configure an access policy to perform compliance checks for connected devices. The Managed Endpoint Status action determines whether APM recognizes a device with a device ID. The Managed Endpoint Notification action sends a push notification message to a device. You can create access policy checks using session variables and device posture information to allow or deny access.
  1. On the Main tab, click
    Access
    Profiles / Policies
    .
    The Access Profiles (Per-Session Policies) screen opens.
  2. In the Access Policy column, click the
    Edit
     link for the endpoint management type access profile you want to configure.
    The visual policy editor opens the access policy in a separate screen.
  3. Click the
    (+)
     icon anywhere in the access policy to add a new item.
    Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. Add a Managed Endpoint Status action:
    1. From the Endpoint Security (Server-Side) list, select
      Managed Endpoint Status
       and click
      Add Item
      .
      A popup Properties screen opens.
    2. In the
      Name
       field, type a name for the access policy action.
    3. For the
      Endpoint Management System
      , select the endpoint management system that you previously created.
    4. Click
      Save
      .
    The visual policy editor screen displays.
  5. In both the compliant branch and not compliant branch of the Managed Device Status action, click the
    (+)
     icon anywhere in the access policy to add a new action item.
    For example, as shown in the
    Access policy with endpoint management integration
     image below, the Managed Device Status action performs the compliance checks on the device for allowing network access and sends notification messages to the non-compliant device.
  6. To add a Managed Endpoint Notification action, perform the following steps:
    1. From the Endpoint Security (Server-Side) list, select
      Managed Endpoint Notification
      .
      A popup Properties screen opens.
    2. In the
      Name
       field, type a name for the access policy action.
    3. From the endpoint management system list, select the endpoint management system that you previously created.
      The Intune endpoint management system does not support Endpoint Notification agent.
    4. In the
      Message
       field, type a message that displays on a device.
    5. Click
      Save
      .
    The visual policy editor screen displays.
You have an access policy that presents endpoint management integration with VPN access.
Access policy with endpoint management integration
access policy with managed device status for Edge Client and managed device notification

Creating a virtual server

  1. On the Main tab, click
    Local Traffic
    Virtual Servers
    .
    The Virtual Server List screen opens.
  2. Click
    Create
    .
    The New Virtual Server screen opens.
  3. In the
    Name
     field, type a unique name for the virtual server.
  4. From the
    Configuration
     list, select
    Advanced
    .
  5. In the
    Destination Address
     field, type the IP address for the Virtual Server.
    When you type the IP address for a single host, it is not necessary to append a prefix to the address.
  6. In the
    Service Port
     field, type the port number.
  7. From the
    SSL Profile (Client)
     list, select
    clientssl
    .
  8. From the
    Source Address Translation
     list, select
    Auto Map
    .
  9. Click
    Finished
    .
  10. From the Access Profile list, select the access profile that you previously created.
  11. From the Connectivity Profile list, select the connectivity profile that you previously created.
Your access policy is now associated with the newly created virtual server.
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information