Maintaining OPSWAT Libraries with a Sync-Failover Device Group

When you have more than one BIG-IP^® device in a local trust domain, you can synchronize BIG-IP configuration data among those devices by creating a device group. A device group is a collection of BIG-IP devices that trust each other and synchronize their BIG-IP configuration data. If you want to exclude certain devices from ConfigSync, you can simply exclude them from membership in that particular device group.

You can synchronize some types of data on a global level across all BIG-IP devices, while synchronizing other data in a more granular way, on an individual application level to a subset of devices.

Before you configure device trust, you should consider the following:

• Only version 11.x or later systems can join the local trust domain.
• You can manage device trust when logged in to a certificate signing authority only. You cannot manage device trust when logged in to a subordinate non-authority device.
• If you reset trust authority on a certificate signing authority by retaining the authority of the device, you must subsequently recreate the local trust domain and the device group.
• As a best practice, you should configure the ConfigSync and mirroring addresses on a device before you add that device to the trust domain.

1. On the Main tab, click Device Management > Device Trust > Device Trust Members .
2. Click Add.
3. From the Device Type list, select Peer or Subordinate.
4. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP^® device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
   • If the BIG-IP device is an appliance, type the management IP address for the device.
   • If the BIG-IP device is a VIPRION^® device that is not licensed and provisioned for vCMP^®, type the primary cluster management IP address for the cluster.
   • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
   • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
5. Click Retrieve Device Information.
6. Verify that the certificate of the remote device is correct, and then click Device Certificate Matches.
7. In the Name field, verify that the name of the remote device is correct.
8. Click Add Device.

1. On the Main tab, click Device Management > Device Trust > Device Trust Members .
2. Click Add.
3. From the Device Type list, select Peer or Subordinate.
4. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP^® device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
   • If the BIG-IP device is an appliance, type the management IP address for the device.
   • If the BIG-IP device is a VIPRION^® device that is not licensed and provisioned for vCMP^®, type the primary cluster management IP address for the cluster.
   • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
   • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
5. Verify that the certificate of the remote device is correct, and then click Device Certificate Matches.
6. In the Name field, verify that the name of the remote device is correct.
7. Click Add Device.

1. On the Main tab, click Device Management > Device Groups .
2. On the Device Groups list screen, click Create.
   The New Device Group screen opens.
3. In the Name field, type a name for the device group.
4. From the Group Type list, select Sync-Failover.
5. In the Description field, type a description of the device group.
   This setting is optional.
6. From the Configuration list, select Advanced.
7. For the Members setting, select a host name from the Available list for each BIG-IP device that you want to include in the device group, including the local device. Use the Move button to move the host name to the Includes list.
   The Available list shows any devices that are members of the device's local trust domain but not currently members of a Sync-Failover device group. A device can be a member of one Sync-Failover group only. Also, for vCMP-provisioned systems on platforms that contain a hardware security module (HSM) supporting FIPS multi-tenancy, the FIPS partitions on the guests in the device group must be identical with respect to the number of SSL cores allocated to the guest's FIPS partition and the maximum number of private SSL keys that the guest can store on the HSM.
8. From the Sync Type list:
   • Select Automatic with Incremental Sync when you want the BIG-IP system to automatically sync the most recent BIG-IP configuration changes from a device to the other members of the device group. In this case, the BIG-IP system syncs the configuration data whenever the data changes on any device in the device group.
   • Select Manual with Incremental Sync when you want to manually initiate a config sync operation. In this case, the BIG-IP system syncs the latest BIG-IP configuration changes from the device you choose to the other members of the device group. We strongly recommend that you perform a config sync operation whenever configuration data changes on one of the devices in the device group.
   • Select Manual with Full Sync when you want to manually initiate a config sync operation. In this case, the BIG-IP system syncs the full set of BIG-IP configuration data from the device you choose to the other members of the device group. We strongly recommend that you perform a config sync operation whenever configuration data changes on one of the devices in the device group.
9. In the Maximum Incremental Sync Size (KB) field, retain the default value of 1024, or type a different value.
   This value specifies the total size of configuration changes that can reside in the incremental sync cache. If the total size of the configuration changes in the cache exceeds the specified value, the BIG-IP system performs a full sync whenever the next config sync operation occurs.
10. For the Network Failover setting, select or clear the check box:
    • Select the check box if you want device group members to handle failover communications by way of network connectivity. This is the default value and is required for active-active configurations.
    • Clear the check box if you want device group members to handle failover communications by way of serial cable (hard-wired) connectivity.
    For active-active configurations, you must select network failover, as opposed to serial-cable (hard-wired) connectivity.
11. In the Link Down Time on Failover field, use the default value of 0.0, or specify a new value.
    This setting specifies the amount of time, in seconds, that interfaces for any external VLANs are down when a traffic group fails over and goes to the standby state. Specifying a value other than 0.0 for this setting causes other vendor switches to use the specified time to learn the MAC address of the newly-active device.

    Important: This setting is a system-wide setting, and does not apply to this device group only. Specifying a value in this field causes the BIG-IP system to assign this value to the global bigdb variable failover.standby.linkdowntime.
12. Click Finished.

1. On the Main tab, click Device Management > Overview .
2. In the Device Groups area of the screen, click the arrow next to the name of the relevant device group.
   The screen expands to show a summary and details of the sync status of the selected device group, as well as a list of the individual devices within the device group.
3. In the Devices area of the screen, choose a device.
4. In the Sync Options area of the screen, choose an option:

   Option	Description
   Push the selected device configuration to the group	Select this option when you want to synchronize the configuration of the selected device to the other device group members.
   Pull the most recent configuration to the selected device	Select this option when you want to synchronize the most recent configurations of one or more device group members to the selected device.

5. Click Sync.

1. On the Main tab, click System > Software Management > Antivirus Check Updates .
   The Antivirus Check Updates screen displays a list of OPSWAT packages available on the device.
2. Click the Upload button to add an OPSWAT update.
   The Upload Package screen appears.
3. Click Browse and select an OPSWAT package ZIP file to upload.
4. Select an install option from the list.
   • Select Do Not Install to upload the package to the local device, but without installing the OPSWAT package on the system.
   • Select Install on this device to upload the package to the local device, and then install the OPSWAT package to this device.
   • Select Install on device group to upload the package to the local device, and then install the OPSWAT package on the device group. A list of available device groups appears, and you can select the device group on which to install.
5. Click OK.

1. On the Main tab, click System > Software Management > Antivirus Check Updates .
   The Antivirus Check Updates screen displays a list of OPSWAT packages available on the device.
2. Double-click an OPSWAT package to view details about the update and included firewall or antivirus libraries.
3. Select an OPSWAT package and click Install.
   The Install Package screen opens.
4. Select Install on device group to upload the package to the local device, and then install the OPSWAT package on the device group. A list of available device groups appears, and you can select the device group on which to install.
5. Click Ok.

1. To view the details for the current device group:
   1. Click the F5^® logo to go to the start (Welcome) page.
   2. In the Support area, click the OSWAT application integration support charts link.
      The OPSWAT Integration web page opens in a new browser tab or window. By default, this page shows Antivirus Integration for Windows.
   3. From the lists at the top of the screen, select the page to view. You can select the supported EPSEC feature, and you can select to view supported products for Windows, Mac, or Linux.
   4. Click the Show button to view the list of supported products for the type and platform you selected.
2. To view the details for another device group or another OESIS version:
   1. On the Main tab, click System > Software Management > Antivirus Check Updates .
      The Package Status screen displays a list of OPSWAT packages available on the device.
   2. Click the Device EPSEC Status button.
      The Device EPSEC Status screen appears and shows the installed OPSWAT version.
   3. To select a different device group on which to view the installed OPSWAT version, select the device group from the Local Device/Device Group list.
   4. Under Installed OESIS version, click the version number for which you want to view the OPSWAT features chart.
      The OPSWAT Integration web page opens in a new browser tab or window. By default, this page shows Antivirus Integration for Windows.
   5. From the lists at the top of the screen, select the page to view. You can select the supported EPSEC feature, and you can select to view supported products for Windows, Mac, or Linux.
   6. Click the Show button to view the list of supported products for the type and platform you selected.