When you have more than one BIG-IP device in a local trust domain, you can synchronize BIG-IP configuration data among those devices by creating a device group. A device group is a collection of BIG-IP devices that trust each other and synchronize their BIG-IP configuration data. If you want to exclude certain devices from ConfigSync, you can simply exclude them from membership in that particular device group.

You can synchronize some types of data on a global level across all BIG-IP devices, while synchronizing other data in a more granular way, on an individual application level to a subset of devices.

Before you configure device trust, you should consider the following:

• Only version 11.x or later systems can join the local trust domain.
• You can manage device trust when logged in to a certificate signing authority only. You cannot manage device trust when logged in to a subordinate non-authority device.
• If you reset trust authority on a certificate signing authority by retaining the authority of the device, you must subsequently recreate the local trust domain and the device group.
• As a best practice, you should configure the ConfigSync and mirroring addresses on a device before you add that device to the trust domain.
• You must configure DNS on all systems.
• You must configure NTP on all systems, preferably to the same NTP server.

1. On the Main tab, click Device Management > Device Trust, and then either Peer List or Subordinate List.
2. Click Add.
3. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
   • If the BIG-IP device is a non-VIPRION device, type the management IP address for the device.
   • If the BIG-IP device is a VIPRION device that is not licensed and provisioned for vCMP, type the primary cluster management IP address for the cluster.
   • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
   • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
4. Click Retrieve Device Information.
5. Verify that the certificate of the remote device is correct.
6. Verify that the name of the remote device is correct.
7. Verify that the management IP address and name of the remote device are correct.
8. Click Finished.

1. On the Main tab, click Device Management > Device Groups.
2. On the Device Groups list screen, click Create. The New Device Group screen opens.
3. Type a name for the device group, select the device group type Sync-Only, and type a description for the device group.
4. For the Members setting, select an IP address and host name from the Available list for each BIG-IP device that you want to include in the device group. Use the Move button to move the host name to the Includes list. The list shows any devices that are members of the device's local trust domain.
5. Required: Select the Automatic Sync check box.
6. Required: Select the Full Sync check box.
7. Click Finished.

1. On the Main tab, click Access Policy > Access Profiles > Policy Sync. A list of access policies and related sync status information opens. The sync status is either:

   Policies with no sync pending

   No synchronization is currently in progress for access policies on this list.

   Policies with sync pending

   A synchronization is in progress for these access policies. Select an access policy from this list to view the Sync Details or Resolve Conflicts panel for it.

2. Select an access policy and click the Sync Access Policy button. The Policy Sync screen opens.
3. From the Device Group list, select the device group to which to sync the access policy. This list displays only Sync-Only device groups with automatic sync and full sync enabled.
4. In the Description field, type a description of the reason for the access policy sync operation.
5. From the Ignore errors due to Variable Assign Agent during sync list, select whether to ignore errors caused by syncing the variable assign agent.
   Note: If the access policy includes a Variable Assign action, errors occur when resources are missing from the target device. If you select Yes, you might need to manually configure the resources on the target device.
6. Click Sync. The sync process begins.

1. On the Main tab, click Access Policy > Access Profiles > Policy Sync. If policies are present and configured for sync, a list of access policies and related sync status information opens.
2. Select an access policy and click the Sync Access Policy button. The Policy Sync screen opens.
3. Click the Advanced Settings button, then click Static Resources. The list displays a name, type, and Location Specific check box for each resource. You might need to configure a location-specific resource differently on a remote system. With the Location Specific check box selected, the first time a resource is synced as part of a policy, you must resolve its configuration on the remote system. Subsequent access policy sync operations do not modify a previously synced location-specific resource.
   Important: Many resource types are marked as location-specific by default. If a resource is not location-specific in this configuration, clear the Location Specific check box.
4. Click the OK button. The APM Policy Sync screen is displayed.
5. Click the Sync button.

1. On the Main tab, click Access Policy > Access Profiles > Policy Sync. A list of access policies and related sync status information opens.
2. Select an access policy and click the Sync Access Policy button. The Policy Sync screen opens.
3. Click the Advanced Settings button, then click Dynamic Resources. The list displays a name, type, Dynamic Resource, and Location Specific check box for each resource.
4. Select the dynamic resources by clicking the check boxes.
5. Click the OK button. The APM Policy Sync screen is displayed.
6. Click the Sync button.

1. On a target system that requires conflicts to be resolved, on the Main tab, click Access Policy > Access Profiles > Policy Sync. A list of access policies and related sync status information opens.
2. From the Policies with Sync Pending list, select an access policy for which you want to resolve conflicts. If conflicts exist, the Resolve Conflicts panel displays one entry and an Unresolved link for each location-specific or dynamic resource that is in conflict.
3. Click an Unresolved link. A popup window opens displaying two panes.
   • A navigation pane with one or more groups of settings. In the navigation pane, an icon indicates that data is required.
   • A data entry pane in which you can type or select values. The data entry pane displays the values from the source device, with labels for required fields asterisked (*) and filled with yellow.
4. Select a group of settings from the left pane, and type or select the required information in the right pane until you have added the required information. You can fill in the required information only, or any other information and settings you wish to configure. In the navigation pane, an icon indicates that required information for a group of settings is complete.
5. Click the OK button. The popup window closes. If no more Unresolved links remain, the Finish button is active.
6. After you resolve all conflicts, click the Finish button.

The Ignore errors due to Variable Assign Agent during sync setting affects system behavior only when a Variable Assign agent is included in an access policy, and the Variable Assign agent uses resources.

If you set Ignore errors due to Variable Assign Agent during sync to Yes:

• If you do not select any dynamic resources, after the policy sync completes you must create all needed resources on each target system.
• If you select the appropriate dynamic resources, after the policy sync completes, you must resolve any conflicts that exist on the target systems. If you do not select all the dynamic resources that are required, you must create them on each target system.

If you set Ignore errors due to Variable Assign Agent during sync to No:

• If you do not select any dynamic resources, an error is displayed and the policy sync does not start.
• If you select the appropriate dynamic resources, after the policy sync completes, you must resolve any conflicts that exist on the target systems.

To summarize, you now have synchronized access policies between devices in a sync-only device group.