You can use device management to set up several BIG-IP^® systems running Application Security Manager™ (ASM) so that the systems synchronize their security policies and configurations, and fail over to one another if a system goes offline for any reason. By using application security synchronization, you can set up application security and create security policies on one system, and can propagate them to other systems in an application security device group. In BIG-IP ASM™, a device group is two or more BIG-IP devices using the same configuration and providing consistent security policy enforcement.

You can set up application security synchronization, for example, behind an Application Delivery Controller where multiple BIG-IP systems running Application Security Manager are deployed as members of a pool. The options and security policies on all of the systems stay in sync regardless of where you update them.

When you set up ASM™ synchronization, in addition to security policies, other settings such as custom attack signatures, logging profiles, SMTP configuration, anti-virus protection, system variables, and policy templates, are synchronized with all devices in the ASM-enabled device group.

When using device management with Application Security Manager™ (ASM™), you need to be aware of the following considerations that apply specifically to application security synchronization.

• A BIG-IP^® system with Application Security Manager can be a member of only one ASM-enabled device group.
• All BIG-IP systems in a device group must be running the same version (including hot fix updates) of Application Security Manager (version 11.0 or later).
• The BIG-IP systems in the ASM-enabled device group synchronize application security configuration data and security policies, providing consistent enforcement on all the devices.
• Real Traffic Policy Builder^® can run on only one system per security policy. For example, you can set up automatic security policy building on one system that is a member of an ASM-enabled device group, the policy is built on that system and then automatically updated on all of the systems in the device group.
• If using a VIPRION^® platform (with multiple blades), it is considered one device, and you need to add only the master blade to the device trust and group.

1. Install the same BIG-IP system version (including any hot fixes) on each device.
2. Provision LTM^® and ASM™ on each device ( System > Resource Provisioning ).
3. On each device, create one or more VLANs, depending on your networking configuration ( Network > VLANs ).
4. On each device, create a self IP ( Network > Self IPs ).
   When creating the self IP, set Traffic Group to traffic-group-local-only (non-floating).
5. On each device, create a default gateway, if needed ( Network > Routes ).
6. On each device, configure DNS ( System > Configuration > Device > DNS ) and NTP ( System > Configuration > Device > NTP ) so they are set to the same time.
7. Verify connectivity between the devices (self IP address to self IP address). For example, use this command to ensure communications: ping -I vlan_interface device_self_IP
8. If your company requires special device certificates, install them on each device ( System > Device Certificates and click Import).

1. Confirm that you are logged in to the device you want to configure.
2. On the Main tab, click Device Management > Devices .
   This displays a list of device objects discovered by the local device.
3. In the Name column, click the name of the device to which you are currently logged in.
4. Near the top of the screen, click ConfigSync.
5. From the Local Address list, retain the displayed IP address or select another address from the list.
   F5 Networks recommends that you use the default value, which is the self IP address for the internal VLAN. This address must be a non-floating (static) self IP address and not a management IP address.
   Important: If the BIG-IP device you are configuring is accessed using Amazon Web Services, then the internal self IP address that you select must be an internal private IP address that you configured for this EC2 instance as the Local Address.
6. Click Update.

1. On the Main tab, click Device Management > Device Trust > Device Trust Members .
2. Click Add.
3. From the Device Type list, select Peer or Subordinate.
4. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP^® device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
   • If the BIG-IP device is an appliance, type the management IP address for the device.
   • If the BIG-IP device is a VIPRION^® device that is not licensed and provisioned for vCMP^®, type the primary cluster management IP address for the cluster.
   • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
   • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
5. Click Retrieve Device Information.
6. Verify that the certificate of the remote device is correct, and then click Device Certificate Matches.
7. In the Name field, verify that the name of the remote device is correct.
8. Click Add Device.

1. On the Main tab, click Device Management > Device Groups .
2. On the Device Groups list screen, click Create.
   The New Device Group screen opens.
3. In the Name field, type a name for the device group.
4. From the Group Type list, select Sync-Failover.
5. In the Description field, type a description of the device group.
   This setting is optional.
6. From the Configuration list, select Advanced.
7. For the Members setting, select a host name from the Available list for each BIG-IP device that you want to include in the device group, including the local device. Use the Move button to move the host name to the Includes list.
   The Available list shows any devices that are members of the device's local trust domain but not currently members of a Sync-Failover device group. A device can be a member of one Sync-Failover group only. Also, for vCMP-provisioned systems on platforms that contain a hardware security module (HSM) supporting FIPS multi-tenancy, the FIPS partitions on the guests in the device group must be identical with respect to the number of SSL cores allocated to the guest's FIPS partition and the maximum number of private SSL keys that the guest can store on the HSM.
8. From the Sync Type list:
   • Select Automatic with Incremental Sync when you want the BIG-IP system to automatically sync the most recent BIG-IP configuration changes from a device to the other members of the device group. In this case, the BIG-IP system syncs the configuration data whenever the data changes on any device in the device group.
   • Select Manual with Incremental Sync when you want to manually initiate a config sync operation. In this case, the BIG-IP system syncs the latest BIG-IP configuration changes from the device you choose to the other members of the device group. We strongly recommend that you perform a config sync operation whenever configuration data changes on one of the devices in the device group.
   • Select Manual with Full Sync when you want to manually initiate a config sync operation. In this case, the BIG-IP system syncs the full set of BIG-IP configuration data from the device you choose to the other members of the device group. We strongly recommend that you perform a config sync operation whenever configuration data changes on one of the devices in the device group.
9. In the Maximum Incremental Sync Size (KB) field, retain the default value of 1024, or type a different value.
   This value specifies the total size of configuration changes that can reside in the incremental sync cache. If the total size of the configuration changes in the cache exceeds the specified value, the BIG-IP system performs a full sync whenever the next config sync operation occurs.
10. For the Network Failover setting, select or clear the check box:
    • Select the check box if you want device group members to handle failover communications by way of network connectivity. This is the default value and is required for active-active configurations.
    • Clear the check box if you want device group members to handle failover communications by way of serial cable (hard-wired) connectivity.
    For active-active configurations, you must select network failover, as opposed to serial-cable (hard-wired) connectivity.
11. In the Link Down Time on Failover field, use the default value of 0.0, or specify a new value.
    This setting specifies the amount of time, in seconds, that interfaces for any external VLANs are down when a traffic group fails over and goes to the standby state. Specifying a value other than 0.0 for this setting causes other vendor switches to use the specified time to learn the MAC address of the newly-active device.

    Important: This setting is a system-wide setting, and does not apply to this device group only. Specifying a value in this field causes the BIG-IP system to assign this value to the global bigdb variable failover.standby.linkdowntime.
12. Click Finished.

1. On the Main tab, click Device Management > Overview .
2. In the Device Groups area of the screen, click the arrow next to the name of the relevant device group.
   The screen expands to show a summary and details of the sync status of the selected device group, as well as a list of the individual devices within the device group.
3. In the Devices area of the screen, choose the device that shows a sync status of Changes Pending.
4. In the Sync Options area of the screen, select Push the selected device configuration to the group.
5. Click Sync.
   The BIG-IP system syncs the configuration data of the selected device to the other members of the device group.

1. Confirm that you are logged in to the device you want to configure.
2. On the Main tab, click Device Management > Devices .
   This displays a list of device objects discovered by the local device.
3. In the Name column, click the name of the device to which you are currently logged in.
4. Near the top of the screen, click Failover Network.
5. Click Add.
6. From the Address list, select an IP address.
   The unicast IP address you select depends on the type of device:

   Platform	Action
   Appliance without vCMP	Select a static self IP address associated with an internal VLAN (preferably VLAN HA) and the static management IP address currently assigned to the device.
   Appliance with vCMP	Select a static self IP address associated with an internal VLAN (preferably VLAN HA) and the unique management IP address currently assigned to the guest.
   VIPRION without vCMP®	Select a static self IP address associated with an internal VLAN (preferably VLAN HA). If you choose to select unicast addresses only (and not a multicast address), you must also specify the existing, static management IP addresses that you previously configured for all slots in the cluster. If you choose to select one or more unicast addresses and a multicast address, then you do not need to select the existing, per-slot static management IP addresses when configuring addresses for failover communication.
   VIPRION with vCMP	Select a self IP address that is defined on the guest and associated with an internal VLAN on the host (preferably VLAN HA). If you choose to select unicast failover addresses only (and not a multicast address), you must also select the existing, virtual static management IP addresses that you previously configured for all slots in the guest's virtual cluster. If you choose to select one or more unicast addresses and a multicast address, you do not need to select the existing, per-slot static and virtual management IP addresses when configuring addresses for failover communication.

   Important: Failover addresses should always be static, not floating, IP addresses.
7. From the Port list, select a port number.
   We recommend using port 1026 for failover communication.
8. To enable the use of a failover multicast address on a VIPRION^® platform (recommended), then for the Use Failover Multicast Address setting, select the Enabled check box.
9. If you enabled Use Failover Multicast Address, either accept the default Address and Port values, or specify values appropriate for the device.
   If you revise the default Address and Port values, but then decide to revert to the default values, click Reset Defaults.
10. Click Finished.

1. On the Main tab, click Security > Options > Application Security > Synchronization .
   The system displays a list of device groups of which this device is a member.
2. For Device Group, select the device group whose members you want to synchronize.
3. Click Save.

1. On one system in the ASM-enabled failover device group, create an application security policy.
   Because the two systems are not in sync, you see a Changes Pending status message on the screen.
2. Click the Changes Pending message.
   Tip: You can also click Device Management > Overview .
   The Overview screen opens.
3. In the Device Groups area of the screen, click the arrow next to the name of the relevant device group.
   The screen expands to show a summary and details of the sync status of the selected device group, as well as a list of the individual devices within the device group.
4. In the Devices area of the screen, choose the device that shows a sync status of Changes Pending.
5. In the Sync Options area of the screen, select Push the selected device configuration to the group.
6. Click Sync.
   The BIG-IP system syncs the configuration data of the selected device to the other members of the device group.
7. Verify that the devices are synchronized.
   For example, log in to another device in the device group and verify that the security policy you created also resides on that system. Click Security > Application Security > Security Policies and see if the policy is listed.