The web access management access type does not have a logout mechanism; as a result configuring a timeout is important. Access Policy Manager^® (APM^®) provides these options.

The Windows Cache and Session Control access policy item

Terminates a user session when it detects that the browser screen has closed. You can also configure it to provide inactivity timeouts for the user session using the Terminate session on user inactivity setting.

Maximum Session Timeout access profile setting

Provides an absolute limit for the duration of the access policy connection, regardless of user activity. To ensure that a user session closes after a certain number of seconds, configure this setting.

Inactivity Timeout access profile setting

Terminates the session after there is no traffic flow for a specified number of seconds.

Note: Depending on the application, you might not want to set this to a very short duration, because many applications cache user typing and generate no traffic for an extended period. In this scenario, a session can time out while the application is still in use, but the content of the user input is not relayed back to the server.

.

1. On the Main tab, click Local Traffic > Pools .
   The Pool List screen opens.
2. Click Create.
   The New Pool screen opens.
3. In the Name field, type a unique name for the pool.
4. In the Resources area, for the New Members setting, add to the pool the application servers that host the web application:
   1. Type an IP address in the Address field.
   2. In the Service Port field, type a port number (for example, type 80 for the HTTP service), or select a service name from the list.
   3. Click Add.
5. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.
   The New Profile screen opens.
3. In the Name field, type a name for the access profile.
   Note: A access profile name must be unique among all access profile and any per-request policy names.
4. From the Profile Type list, select LTM-APM.
   With this type selected, when you configure the access policy, only access policy items that are applicable for web access management are displayed.
5. In the Inactivity Timeout field, type the number of seconds that should pass before the access policy times out. Type 0 to set no timeout.
   The web access management connection type does not provide a logout mechanism. You should configure at least one timeout for the connection, either in this access profile, or by including the Windows Cache and Session Control item in the access policy and configuring a timeout in it.
6. In the Maximum Session Timeout field, type the maximum number of seconds the session can exist.
   Type 0 to set no timeout.
7. In the Language Settings area, add and remove accepted languages, and set the default language.
   A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
8. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. On the menu bar, click Logs.
   The access profile log settings display.
4. Move log settings between the Available and Selected lists.
   You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.

   Note: Logging is disabled when the Selected list is empty.
5. Click Update.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. On a policy branch, click the (+) icon to add an item to the policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
4. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
5. Make any changes that you require to the logon page properties and click Save.
   The properties screen closes and the policy displays.
6. On a policy branch, click the (+) icon to add an item to the policy.
   Repeat this action from the visual policy editor whenever you want to add an item to the policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
7. From the Authentication tab, select an authentication item.
8. Configure the properties for the authentication item and click Save when you are done.
   You can configure multiple authentication items in an access policy.
   You have now configured a basic access policy.
9. Add endpoint security checks or other items that you require to the access policy.
   Optionally, you can assign a pool of web servers in the access policy using the Pool Assign action; if you do, this pool takes precedence over the pool you assign to the virtual server configuration.

   Note: You can add a Windows Cache and Session Control item to configure a way to terminate the session.
10. To grant access at the end of any branch, change the ending from Deny to Allow:
    1. Click Deny.
       The default branch ending is Deny.
       A popup screen opens.
    2. Select Allow and click Save.
       The popup screen closes. The Allow ending displays on the branch.
11. Click the Apply Access Policy link to apply and activate the changes to the policy.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server.
   This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
5. In the Service Port field, type 80 (for HTTP) or 443 (for HTTPS), or select HTTP or HTTPS from the list.
6. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
7. Optional: For the SSL Profile (Client) setting, select a client SSL profile.
   If the web server uses SSL, the client should use SSL.
8. Optional: For the SSL Profile (Server) setting, select an SSL server profile.
   If the web server uses SSL, the virtual server should use SSL.
9. In the Content Rewrite area, retain the default settings.
   The web access management access type eliminates the need for content rewriting. The default values for the Rewrite Profile and the HTML Profile settings are None.
10. In the Access Policy area, from the Access Profile list, select the access profile you configured previously.
    Retain the default values for other settings in the Access Policy area.
11. Optional: From the HTTP Compression Profile list, select httpcompression.
    You can use compression to provide a better end user experience, particularly where there is limited bandwidth or high latency between the virtual server and the client.
12. In the Resources area of the screen, from the Default Pool list, select the relevant pool name.
13. Click Finished.