To add devices to a device group, all devices must belong to the same local trust domain. If you want to sync access policies with a device that does not belong to the local trust domain, but also belongs to a Sync-Failover group, you must reset the trust between the devices and remove them from the Sync-Failover device group. (For more information, see BIG-IP^® Device Service Clustering: Administration on the AskF5™ web site located at http://support.f5.com/.)

After you establish device trust between your BIG-IP system and the devices, you can add them to a Sync-Failover group again.

Before you configure device trust, you should consider the following:

• Only version 11.x or later systems can join the local trust domain.
• You can manage device trust when logged in to a certificate signing authority only. You cannot manage device trust when logged in to a subordinate non-authority device.
• If you reset trust authority on a certificate signing authority by retaining the authority of the device, you must subsequently recreate the local trust domain and the device group.
• As a best practice, you should configure the ConfigSync and mirroring addresses on a device before you add that device to the trust domain.
• You must configure DNS on all systems.
• You must configure NTP on all systems, preferably to the same NTP server.

1. On the Main tab, click Device Management > Device Trust > Device Trust Members .
2. Click Add.
3. From the Device Type list, select Peer or Subordinate.
4. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP^® device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
   • If the BIG-IP device is an appliance, type the management IP address for the device.
   • If the BIG-IP device is a VIPRION^® device that is not licensed and provisioned for vCMP^®, type the primary cluster management IP address for the cluster.
   • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
   • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
5. Click Retrieve Device Information.
6. Verify that the certificate of the remote device is correct, and then click Device Certificate Matches.
7. In the Name field, verify that the name of the remote device is correct.
8. Click Add Device.

1. On the Main tab, click Device Management > Device Groups .
2. On the Device Groups list screen, click Create.
   The New Device Group screen opens.
3. In the Name field, type a name for the device group.
4. Required: From the Group Type list, select Sync-Only.
5. For the Members setting, select a host name from the Available list for each BIG-IP device that you want to include in the device group. Use the Move button to move the host name to the Includes list.
   The list shows any devices that are members of the device's local trust domain.
6. Required: From the Sync Type list, select one of these options:
   • Automatic with Incremental Sync - F5 Networks recommends that you select this option for optimal performance.
   • Automatic with Full Sync
7. Click Finished.

1. On the Main tab, click Access > Profiles / Policies > Policy Sync .
   A list of policies and related sync status information opens. The sync status is either:

   Policies with no sync pending

   No synchronization is currently in progress for policies on this list.

   Policies with sync pending

   A synchronization is in progress for these policies. Select a policy from this list to view the Sync Details or Resolve Conflicts panel for it.

2. Select a policy and click the Sync Policy button.
   The Policy Sync screen opens.
3. From the Device Group list, select the device group to which to sync the policy.
   This list displays only Sync-Only device groups with automatic sync and full sync enabled.
4. In the Description field, type a description of the reason for the policy sync operation.
5. From the Ignore errors due to Variable Assign Agent during sync list, select whether to ignore errors caused by syncing the variable assign agent.
   Note: If the policy includes a Variable Assign action, errors occur when resources are missing from the target device. If you select Yes, you might need to manually configure the resources on the target device.
6. Click Sync.
   The sync process begins.

1. On the Main tab, click Access > Profiles / Policies > Policy Sync .
   If policies are present and configured for sync, a list of policies and related sync status information opens.
2. Select a policy and click the Sync Policy button.
   The Policy Sync screen opens.
3. Click the Advanced Settings button, then click Static Resources.
   The list displays a name, type, and Location Specific check box for each resource. You might need to configure a location-specific resource differently on a remote system. With the Location Specific check box selected, the first time a resource is synced as part of a policy, you must resolve its configuration on the remote system. Subsequent policy sync operations do not modify a previously synced location-specific resource.

   Important: Many resource types are marked as location-specific by default. If a resource is not location-specific in this configuration, clear the Location Specific check box.
4. Click the OK button.
   The APM Policy Sync screen is displayed.
5. Click the Sync button.

1. On the Main tab, click Access > Profiles / Policies > Policy Sync .
   A list of policies and related sync status information opens.
2. Select a policy and click the Sync Policy button.
   The Policy Sync screen opens.
3. Click the Advanced Settings button, then click Dynamic Resources.
   The list displays a name, type, Dynamic Resource, and Location Specific check box for each resource.
4. Select the dynamic resources by clicking the check boxes.
5. Click the OK button.
   The APM Policy Sync screen is displayed.
6. Click the Sync button.

1. On a target system that requires conflicts to be resolved, on the Main tab, click Access > Profiles / Policies > Policy Sync .
   A list of policies and related sync status information opens.
2. From the Policies with Sync Pending list, select a policy for which you want to resolve conflicts.
   If conflicts exist, the Resolve Conflicts panel displays one entry and an Unresolved link for each location-specific or dynamic resource that is in conflict.
3. Click an Unresolved link.
   A popup window opens displaying two panes.

   • A navigation pane with one or more groups of settings. In the navigation pane, an icon indicates that data is required.
   • A data entry pane in which you can type or select values. The data entry pane displays the values from the source device, with labels for required fields asterisked (*) and filled with yellow.
4. Select a group of settings from the left pane, and type or select the required information in the right pane until you have added the required information.
   You can fill in the required information only, or any other information and settings you wish to configure.
   In the navigation pane, an icon indicates that required information for a group of settings is complete.
5. Click the OK button.
   The popup window closes. If no more Unresolved links remain, the Finish button is active.
6. After you resolve all conflicts, click the Finish button.

The Ignore errors due to Variable Assign Agent during sync setting affects system behavior only when a Variable Assign agent is included in an access policy, and the Variable Assign agent uses resources.

If you set Ignore errors due to Variable Assign Agent during sync to Yes:

• If you do not select any dynamic resources, after the policy sync completes you must create all needed resources on each target system.
• If you select the appropriate dynamic resources, after the policy sync completes, you must resolve any conflicts that exist on the target systems. If you do not select all the dynamic resources that are required, you must create them on each target system.

If you set Ignore errors due to Variable Assign Agent during sync to No:

• If you do not select any dynamic resources, an error is displayed and the policy sync does not start.
• If you select the appropriate dynamic resources, after the policy sync completes, you must resolve any conflicts that exist on the target systems.

To summarize, you now have synchronized access policies between devices in a sync-only device group.