1. To support certificate inspection:
   1. Obtain a trusted certificate and key that are valid for all fully qualified domain names (FQDNs) used to access the BIG-IP system.
   2. Import the certificate and key into the BIG-IP system.
      You can import SSL certificates from the System area of the product.
2. Obtain the iApps template file for IF-MAP Secure Web Gateway from F5^® DevCentral™at http://devcentral.f5.com:
   1. In the Search field, type IF-MAP and click the search icon.
   2. Download the zip file and extract all contents.
      Template file names end with .tmpl.
3. Import the template:
   1. On the Main tab, click iApps > Templates .
   2. Next, click Import.
   3. Select the Overwrite Existing Templates check box.
   4. Click Choose File, then browse to and choose the template file.
   5. Click Upload.
4. Deploy an application service:
   1. On the Main tab, click iApps Application > Services , and then click Create.
   2. In the Name field, type a name.
      Note: The application service prefixes this name to the names of configuration objects it creates.
   3. From the Template list, select f5.ifmap.
      Note: This iApps template displays on the list only when APM is provisioned.
   4. Follow the instructions on the screen to complete the deployment.
      A summary displays the configuration objects.
   5. Take note of the IP address of the virtual server created by the service. You need to type it into F5 DC Agent initialization file later.
      Note: This virtual server must be accessible by the F5 DC Agent from a routing perspective.
5. To enable clientless HTTP basic authentication, create a user and password in the local user database.
   The purpose of this user account is to authenticate communication between the F5 DC Agent and the BIG-IP system.
   1. On the Main tab, click Access Policy > Local User DB > Manage Users .
      The Manage Users screen displays.
   2. Click Create New User.
      The Create New Local User screen opens and displays User Information settings.
   3. From the Instance list, select the instance created when you deployed the application service.
   4. In the User Name field, type the user name.
      Take note of the user name and password. You need to type them again later when you configure the initialization file for F5 DC Agent.
   5. In the Password and Confirm Password fields, type the user's password.

1. Open a command prompt on the Windows-based server that hosts, or will host, the F5 DC Agent.
2. To verify that the Windows-based server sees all required domains, use the net view command.
   For example, type net view /network
3. To check for DNS issues, use the nslookup command.
   For example, to verify that DNS resolves the host name, testmachine1, type this command: nslookup testmachine1 . If the DNS lookup succeeds, the result is similar to: Server: testdns.test.example.com Address: 10.56.1.4 Name: testmachine1.test.example.com Address: 10.56.100.15
4. To verify that F5 DC Agent will be able to use NetBIOS, try to telnet to a domain controller on port 139.
   If the command is successful, the screen remains blank. If unsuccessful, then:

   • A router, firewall, or other device might be blocking NetBIOS traffic.
   • NetBIOS might not be enabled and the domain controller might not be listening on port 139.
5. If you could not successfully telnet to a domain controller on port 139, verify the status of the port using the netstat command.
   For example, type: netstat -na | find "139"
6. To verify that the F5 DC Agent will be able to communicate with the virtual server on the BIG-IP^® system, telnet to the IP address of the virtual server on port 8096 or on the port that you entered when creating the application service.
   This virtual server was created using an application service based on the f5.ifmap iApps template.

1. Go to the BIG-IP^® system Configuration utility Welcome screen.
   If you are already logged in, click the F5^® logo to open the Welcome screen.
2. In the BIG-IP User Identification Agents area, click the User Identification Agents link.
   A SWGUserIdentificationAgents.exe file downloads.
3. Copy the downloaded file to a Windows-based server that is joined to a domain controller.
   Important: Do not install F5 DC Agent on a domain controller because the F5 DC Agent can put a load on the domain controller.
4. From an account with both local and administrator privileges, click the SWGUserIdentificationAgents.exe file to start the installer.
   The installer displays instructions.
5. Follow the instructions to complete the installation.
   Important: F5^® strongly recommends that you use the default destination folder. On the Destination Folder screen, click Next without making any changes.

   Important: Install either F5 DC Agent or F5 Logon Agent, but not both. This overwrites the omapd user map every time an update is published.
   The program installs a Windows service, F5 DC Agent.

1. On the Windows-based server, create a user account for F5 DC Agent:
   1. Assign the new account domain administrator privileges in all domains.
   2. Assign the same password to this account in all domains.
      Make a note of the password. You must type it again in step 2.
   3. Set the password to never expire.
2. Configure the F5 DC Agent service to log on as the user account you just configured:
   1. Open the Windows Services dialog box.
      From the Control Panel, select Administrative Tools > Services .
   2. Locate the F5 DC Agent service, right-click the service name, and select Stop.
   3. Double-click the service name, and then select the Log On tab.
   4. Select This account and type the account name and password for the account you created in step 1.
      Note: Some domains require that you type the account name in the format domain\username.
   5. Close the Services dialog box.

1. Log on to the Windows-based server where you installed the F5^® DC Agent.
2. Navigate to this directory: C:\Program Files\F5 Networks\User Identity Agents\config.
3. Using a text editor, open the transid.ini file.
   The file contains one section, [DC Agent].
4. For IFMapServer, type the protocol, host address, and port for the server.
   This is the virtual server that was created by the application service. Port 8096 is the default port. You might have specified another port number when you deployed the application service.
   For example, IFMapServer=https://AA.BB.CC.DD:8096, where AA.BB.CC.DD is the IP address of the virtual server created by the application service.
5. To authenticate to the BIG-IP system using clientless HTTP authentication, type values for these parameters.
   1. For IFMapUsername, type the name of the user that logs on to the IF-MAP server on behalf of the F5 DC Agent.
      This is the name of a user you created in the local user database on the BIG-IP system.
   2. For IFMapPassword, type the password for the user.
      This is the password you typed in the local user database.
6. Optional: To authenticate using a certificate, for IFMapCertClient, type the path to the SSL certificate file to use for authenticating to the BIG-IP system.
   This must match the name of the certificate you specified in the application service on the BIG-IP system. Make sure that this certificate is imported into the certificate store on the BIG-IP system.
7. For the remainder of the parameters, you can retain the default values or change them.
   1. For IFMapLifeTimeType, retain the default value, forever.
      IFMapLifeTimeType specifies whether to keep or purge a user entry from the IF-MAP server when a session ends or times out. The alternative value is session.

      Note: You can specify an absolute lifetime for a user entry in the IPCleanLifetime property.
   2. For PurgeOnStart, retain the default value, true.
      PurgeOnStart specifies whether the IF-MAP server should purge user records after the F5 DC Agent restarts.
   3. For IdleUpdate, you can retain the default value of 120 seconds.
      IdleUpdate specifies the interval between keep-alive pings from the F5 DC Agent to the IF-MAP server.
   4. For DiscoveryInterval, retain the default value of 84600 seconds (24 hours).
      DiscoveryInterval specifies the interval at which the domain auto-discovery process runs.
   5. For DC AgentEnable, retain the default value of true.
      DC AgentEnable specifies whether domain auto-discovery is enabled (true) or disabled (false).
   6. For QueryInterval, you can retain the default value of 10 seconds.
      QueryInterval specifies the interval at which the F5 DC Agent queries domain controllers in seconds. Valid values are between 5 and 90 seconds.
   7. For IPCleanLifetime, you can retain the default value of 7200 seconds (2 hours).
      IPCleanLifetime specifies the amount of time a user entry remains in the IF-MAP server before it is removed, in seconds. Valid values are integers greater than 3600; specify 0 to disable.
8. Start or restart the F5 DC Agent service.

1. Log on to the Windows-based server where you installed the F5^® DC Agent.
2. Navigate to this directory: C:\Program Files\F5 Networks\User Identity Agents\.
3. If the dc_config.txt file already exists, make a backup copy in another location.
4. Create or open the dc_config.txt file using a text editor.
5. Verify that all domains and controllers are on the list.
   This example shows two domain controller entries in each of two domains, WEST_DOMAIN and EAST_DOMAIN; polling is enabled on each domain controller. Note the blank line at the end of the file; it is required.

   [WEST_DOMAIN]
   dcWEST1=on
   dcWEST2=on
   [EAST_DOMAIN]
   dcEAST1=on
   dcEAST2=on
                       

6. If domains or domain controllers are missing, add them.
   To make sure that F5 DC Agent can see a domain, run the net view /domain command before you add the domain.
7. If the list contains domain controllers that F5 DC Agent should not poll, change the entry value from on to off.
   If you configure F5 DC Agent to avoid polling an active domain controller, the agent cannot transparently identify the users that log on to it.

   Important: Rather than deleting a domain controller, change the setting to off. Otherwise, F5 DC Agent adds it to the file again after it next discovers domain controllers.
   In this example, polling is disabled for the dcEAST2 domain controller.

   dcEAST2=off

8. Make sure that the file includes a carriage return after the last entry, creating a blank line at the end of the file.
   If you do not include the hard return, the last entry in the file get truncated, and an error message is written.
9. Save the changes and close the file.
10. Use the Windows Services dialog box to restart the F5 DC Agent service.

1. Log on to the Windows-based server from a user account with local and domain administrator privilege.
2. From the Windows Programs and Features dialog box, uninstall the F5 Installer application.
3. From Windows Explorer, click the SWGUserIdentificationAgents.exe file and follow the instructions to install F5 DC Agent again.

1. Log on to the Windows-based server where you installed the F5^® DC Agent.
2. Navigate to this directory: C:\Program Files\F5 Networks\User Identity Agents\config.
3. Using a text editor, open the diagnostics.cfg file.
4. Look for log4j.threshold in Global configuration.
5. Note the value for log4j.threshold; you will need it when you complete troubleshooting tasks.
6. Modify the value to DEBUG.
7. Restart the DC agent service.
   Debug errors start to be logged.
8. When you are done with troubleshooting, edit the diagnostics.cfg file, reset log4j.threshold to the previous value, and restart the DC agent service.

1. Log on to the client system that belongs to the user.
2. Open a browser and navigate to four or more distinctive web sites.
3. Log on to the Windows-based server where the F5^® DC Agent is installed.
4. Look for error messages in the Windows Event Viewer.
5. Proceed based on any error messages that you discover.

Error messages from the F5^® DC Agent display in the Event Viewer on the Windows-based server where DC Agent is installed.

System error while enumerating the domain controllers. domain: (****)ecode: 71 : 
message: No more connections can be made to this remote computer at this time because there 
are already as many connections as the computer can accept.

1. Set up to support certificate inspection:
   1. Obtain a trusted certificate and key that are valid for all fully qualified domain names (FQDNs) used to access the BIG-IP system.
   2. Import the certificate and key into the BIG-IP system.
      You can import SSL certificates from the System area of the product.
2. Obtain the IF-Maps iApps template file from F5^® DevCentral™at http://devcentral.f5.com/wiki/iapp.Codeshare.ashx.
3. Import the template:
   1. On the Main tab, click iApps > Templates .
   2. Click Import.
   3. Select the Overwrite Existing Templates check box.
   4. Click Browse, then browse to and select the template file.
   5. Click Upload.
4. Deploy an application service:
   1. On the Main tab, click iApps > Application Services , and then click Create.
   2. In the Name field, type a name.
      Note: The application service prefixes this name to the names of configuration objects it creates.
   3. From the Template list, select f5.ifmap.
      Note: This iApps template displays on the list only when APM is provisioned.
   4. Follow the instructions on the screen to complete the deployment.
      A summary displays the configuration objects.
   5. Take note of the IP address of the virtual server created by the service. You need to type it into F5 Logon Agent initialization file later.
      Note: This virtual server must be accessible by the F5 Logon Agent from a routing perspective.
5. To enable clientless HTTP basic authentication, create a user and password in the local user database.
   The purpose of this user account is to authenticate communication between the F5 Logon Agent and the BIG-IP system.
   1. On the Main tab, click Access Policy > Local User DB > Manage Users .
      The Manage Users screen displays.
   2. Click Create New User.
      The Create New Local User screen opens and displays User Information settings.
   3. From the Instance list, select the instance created when you deployed the application service.
   4. In the User Name field, type the user name.
      Take note of the user name and password. You need to type them again later when you configure the initialization file for F5 Logon Agent.
   5. In the Password and Confirm Password fields, type the user's password.

1. Open a command prompt on the Windows-based server that hosts, or will host, the F5 Logon Agent.
2. To verify that the Windows-based server sees all required domains, use the net view command.
   For example, type net view /network .
3. To check for DNS issues, use the nslookup command.
   For example, to verify that DNS resolves the host name, testmachine1, type this command: nslookup testmachine1 . If the DNS lookup succeeds, the result is similar to: Server: testdns.test.example.com Address: 10.56.1.4 Name: testmachine1.test.example.com Address: 10.56.100.15
4. To verify that F5 Logon Agent will be able to use NetBIOS, try to open a Telnet session to a domain controller on port 139.
   If the command is successful, the screen remains blank. If unsuccessful, then:

   • A a router, firewall, or other device might be blocking NetBIOS traffic.
   • NetBIOS might not be enabled and the domain controller might not be listening on port 139.
5. If you could not successfully use a Telnet connection to a domain controller on port 139, verify the status of the port using the netstat command.
   For example, type netstat -na | find "139" .)
6. To verify that the F5 Logon Agent will be able to communicate with the virtual server on the BIG-IP^® system, use a Telnet connection to the IP address of the virtual server on port 8096 or on the port that you entered when creating the application service.
   This virtual server was created using an application service based on the f5.ifmap iApps^® template.

1. Go to the BIG-IP Configuration utility Welcome screen.
   If you are already logged in, click the F5^® logo to open the Welcome screen.
2. In the Secure Web Gateway User Identification Agents area, click the User Identification Agents link.
   A SWGUserIdentificationAgents.exe file downloads.
3. Copy the downloaded file to a Windows-based server that is joined to a domain controller.
   Important: Do not install F5 Logon Agent on a domain controller because the F5 Logon Agent can put a load on the domain controller.
4. From an account with both local and administrator privileges, click the SWGUserIdentificationAgents.exe file to start the installer.
   The installer displays instructions.
5. Follow the instructions to complete the installation.
   Important: F5^® strongly recommends that you use the default destination folder. On the Destination Folder screen, click Next without making any changes.

   Important: Install either F5 DC Agent or F5 Logon Agent, but not both. This overwrites the omapd user map every time an update is published.
   The program installs a Windows service, F5 Logon Agent.

1. On the Windows-based server, create a user account for F5 Logon Agent:
   1. Assign the new account domain administrator privileges in all domains.
   2. Assign the same password to this account in all domains.
      Make a note of the password. You must type it again in step 2.
   3. Set the password to never expire.
2. Configure the F5 Logon Agent service to log on as the user account you just configured:
   1. Open the Windows Services dialog box.
      From the Control Panel, select Administrative Tools > Services .
   2. Locate the F5 Logon Agent service, right-click the service name, and select Stop.
   3. Double-click the service name, and then select the Log On tab.
   4. Select This account and type the account name and password for the account you created in step 1.
      Note: Some domains require that you type the account name in the format domain\username.
   5. Close the Services dialog box.

1. Log on to the Windows-based server where you installed the F5^® DC Agent.
2. Navigate to this directory: C:\Program Files\F5 Networks\User Identity Agents\config.
3. Using a text editor, open the authserver.ini file.
   The file contains one section, [Logon Agent].
4. For IFMapServer, type the protocol, host address, and port for the server.
   This is the virtual server that was created by the application service. Port 8096 is the default port. You might have specified another port number when you deployed the application service.
   For example, IFMapServer=https://AA.BB.CC.DD:8096, where AA.BB.CC.DD is the IP address of the virtual server created by the application service.
5. To authenticate to the BIG-IP system using clientless HTTP authentication, type values for these parameters.
   1. For IFMapUsername, type the name of the user that logs on to the IF-MAP server on behalf of the F5 Logon Agent.
      This is the name of a user you created in the local user database on the BIG-IP system.
   2. For IFMapPassword, type the password for the user.
      This is the password you typed in the local user database.
6. Optional: To authenticate using a certificate, for IFMapCertClient, type the path to the SSL certificate file to use for authenticating to the BIG-IP system.
   This must match the name of the certificate you specified in the application service on the BIG-IP system. Make sure that this certificate is imported into the certificate store on the BIG-IP system.
7. For the remainder of the parameters, you can retain the default values or change them.
   1. For IFMapLifeTimeType, retain the default value, forever.
      IFMapLifeTimeType specifies whether to keep or purge a user entry from the IF-MAP server when a session ends or times out. The alternative value is session.

      Note: You can specify an absolute lifetime for a user entry in the IPCleanLifetime property.
   2. For PurgeOnStart, retain the default value, false.
      PurgeOnStart specifies whether the IF-MAP server should purge user records after the F5 Logon Agent restarts.
   3. For IdleUpdate, you can retain the default value of 120 seconds.
      IdleUpdate specifies the interval between keep-alive pings from the F5 Logon Agent to the IF-MAP server.
   4. For QueryInterval, you can retain the default value of 900 seconds.
      QueryInterval specifies the interval at which the F5 Logon Agent queries domain controllers in seconds. Valid values are between 5 and 90 seconds.
   5. For EntryLifetime, retain the default value of 86400 seconds.
      EntryLifetime specifies the interval at which the domain auto-discovery process runs.
   6. For ReconfigPeriod, you can retain the default value of 60 seconds.
      ReconfigPeriod specifies the amount of time between agent reconfiguring during an initialization file update.
   7. For LogonAgentIP, type the address.
      LogonAgentIP specifies the address that the server should bind to.
   8. For LogonAgentPort, you can retain the default value of 15880 seconds.
      LogonAgentPort specifies the TCP/IP Port that the agent should listen on.
8. Start or restart the F5 Logon Agent service.

1. Log on to the Windows-based server from a user account with local and domain administrator privilege.
2. From the Windows Programs and Features dialog box, uninstall the F5 Installer application.
3. From Windows Explorer, click the SWGUserIdentificationAgents.exe file and follow the instructions to install F5 Logon Agent again.

1. Log on to the Windows-based server where you installed the F5^® DC Agent.
2. Navigate to this directory: C:\Program Files\F5 Networks\User Identity Agents\.
3. Using a text editor, open the diagnostics.cfg file.
4. Look for log4j.threshold in Global configuration.
5. Note the value for log4j.threshold; you will need it when you complete troubleshooting tasks.
6. Modify the value to DEBUG.
7. Restart the Logon Agent service.
   Debug errors start to be logged.
8. When you are done with troubleshooting, edit the diagnostics.cfg file, reset log4j.threshold to the previous value, and restart the Logon Agent service.

1. Log on to the client system that belongs to the user.
2. Open a browser and navigate to four or more distinctive web sites.
3. Log on to the Windows-based server where the F5^® Logon Agent is installed.
4. Look for error messages in the Windows Event Viewer.
5. Proceed based on any error messages that you discover.

This table explains the relevant files used by F5^® Logon Agent after you install the installation file from the BIG-IP^® system Configuration utility Welcome screen.

1. On your Windows screen, click Start > Accessories > Notepad
2. In the untitled Notepad menu, click File > Open
3. Navigate to the directory with the logon.bat file. For example:C:\Program Files\F5 Networks\User Identity Agents\LogonApp\Windows\logon.bat.
   The .bat file displays logon script examples.
4. Open a new Notepad file.
5. Using the examples in logon.bat, create a script for either F5 Logon Agent logon or logout options.
6. Click Save and select .bat as the file extension.

1. On the Active Directory machine, click Control Panel.
   The Control Panel window displays.
2. From the window, select Administrative Tools > Active Directory Users and Computers .
3. Right-click the domain and select Properties.
4. On the Group Policy tab, click New.
5. In the New Group Policy screen, create a new policy.
6. Click Edit.
   A window displaying a tree structure displays.
7. Expand User Configuration.
8. For Windows Settings option, click Scripts (Logon/Logoff).
9. On the right screen, double-click Logon.
10. Click Show Files.
    The folder that contains the logon script opens in Windows Explorer.
11. Copy the files logon.bat and LogonApp.exe to the folder.
12. Close the Windows Explorer window.
13. In the Logon Properties dialog box, click Add.
14. For the Script Name field, type logon.bat.
15. Click OK.
16. In the domain Properties dialog box, click OK.

This table explains the relevant parameters used by a logon or logout script for F5^® Logon Agent.