This illustration shows an example of the entire secure logging configuration. The logging traffic proceeds from top to bottom in the illustration.

In the example:

• Each BIG-IP^® system has one or more HSL filters directing certain kinds of log messages to an HSL destination. The HSL destination forwards the messages to both the local syslog server (for local log retention, in case the external syslog server is unreachable), and an HSL syslog destination, whose purpose is to add the timestamp and other information expected by RFC5424-compliant syslog servers. The HSL syslog destination then sends the decorated log messages to an HSL pool destination, which directs them to the local syslog encryptor pool containing the IP address of a local encrypting virtual server.
• The two BIG-IP systems include identically-configured local syslog encrypting virtual servers. The virtual servers are configured using a non-floating IP address on a private VLAN that is internal to each BIG-IP system, with no external interfaces attached. This VLAN exists solely to provide a private communications link between the local syslog encryptor pool, the local syslog server, and the local encrypting virtual server. For messages that are not currently processed by the HSL subsystem, the local syslog server uses this VLAN to send selected messages directly to the local encrypting virtual server, to be encrypted and sent on to the remote secure syslog server.
• The local encrypting virtual server is configured with a Server SSL profile for the purpose of sending the BIG-IP system's client certificate to the server for X.509 validation, as well as for validating the server's X.509 certificate using a locally-installed CA certificate bundle. Once authenticated and connected to the server listed in the remote secure syslog server pool, the local syslog encrypting virtual server sends the outbound encrypted syslog messages to the remote syslog server. The outbound TCP sessions are retained for subsequent syslog messages until the TCP timeout on the virtual server expires; then the next syslog message initiates a new TCP session.

The result is that when the high speed logging subsystem or the standard syslog service of either BIG-IP system sends TCP syslog traffic, the messages are forwarded to the remote syslog server over an authenticated and encrypted, secure channel.

Before configuring secure logging, you must perform these tasks on the BIG-IP^® systems in the configuration.

One of the required elements of the secure logging configuration is the mutual validation of the X.509 certificate for each device in the configuration (that is, each BIG-IP^® device, as well as the secure logging server). Each device must have a valid X.509 certificate and key assigned, where the Common Name attribute of the certificate resolves to the Fully Qualified Domain Name (FQDN) of that device's IP address on the shared secure logging VLAN. For the certificate on each of the two BIG-IP systems, this IP address is a self IP address. For the certificate of the secure, remote syslog server, this IP address is the IP address of that server.

For either BIG-IP system to successfully validate the certificate of the other device, all X.509 certificates must be signed by a parent certificate authority (CA) whose certificate chain is included in the certificate bundle referenced in the SSL profile of each of the BIG-IP encrypting virtual servers. The CA's certificate chain must also be included in the certificate bundle of the secure syslog server's configuration.

1. On the Main tab, click System > Device Certificates .
   The Device Certificate screen opens.
2. Click Import.
3. From the Import Type list, select Certificate and Key.
4. For the Certificate Source setting, select Upload File and browse to select the certificate signed by the CA server.
5. For the Key Source setting, select Upload File and browse to select the device key file.
6. Click Import.

1. At the tmsh prompt, create a pool containing a remote syslog server. For example:

   create ltm pool pool_remote_secure_syslog {
      members replace-all-with { 192.0.2.10:6514 { address 192.0.2.10 } }
      monitor tcp_half_open
   }

   In this example, 192.0.2.10:6514 represents the IP address of the remote syslog server.
2. Save the configuration by typing save /sys config.

1. Create an SSL Server profile to encrypt traffic destined for the syslog server pool. For example:

   create ltm profile server-ssl profile_serverssl_syslog-1 {
      ca-file F5secureLoggingCA_bundle.crt
      cert b3-1.logging.f5cc.com.crt
      defaults-from serverssl
      key b3-1.logging.f5cc.com.key
      peer-cert-mode require
   }

   In this example, profile_serverssl_syslog-1 represents the name of the Server SSL profile.

   Important: The certificate bundle that you specify must include the certificate chain of the certificate authority.
2. Create a VLAN on the private, internal network, with no interfaces assigned. For example: create net vlan vlan_securelog .
3. Create a self IP address in the traffic group traffic-group-local-only and associate it with VLAN vlan_securelog. For example: create net self 203.0.113.1/24 vlan vlan_securelog .
   Important: The IP address that you specify must be a non-routable address and must be identical on all BIG-IP systems in the configuration.
4. Create a non-floating virtual address on the private, internal network. For example:

   create ltm virtual-address 203.0.113.100
      traffic-group traffic-group-local-only
      auto-delete false

   Important: You must use tmsh to create the virtual address, and you must create the virtual address prior to creating the associated virtual server. Also, the IP address you specify must be the same virtual address that you specify on the peer BIG-IP system.
5. Create a virtual server network for the virtual address, assigning the pool, SSL Server profile, and private VLAN. For example:

   create ltm virtual vs_secure_syslog_target-1 {
      destination 203.0.113.100:514
      ip-protocol tcp
      pool pool_remote_secure_syslog
      profiles replace-all-with { profile_serverssl_syslog-1 tcp }
      vlans replace-all-with { vlan_securelog }
      vlans-enabled 

   Important: In this example, vs_secure_syslog_target-1 represents the name of the virtual server, and the destination IP address is 203.0.113.100:514. The destination IP address and port that you specify must be the same destination IP address and port that you specify on the peer BIG-IP system.
6. Create a VLAN on the shared, external network with all appropriate BIG-IP interfaces assigned. For example: create net vlan vlan_logging { tag 4089 interfaces add { 1.1 {tagged} } } .
7. Create a self IP address in the traffic group traffic-group-local-only and associate it with VLAN vlan_logging. For example: create net self 192.0.2.100 vlan vlan_logging .

1. Create an SSL Server profile to encrypt traffic destined for the syslog server pool. For example:

   create ltm profile server-ssl profile_serverssl_syslog-2 {
      ca-file F5secureLoggingCA_bundle.crt
      cert b3-2.logging.f5cc.com.crt
      defaults-from serverssl
      key b3-2.logging.f5cc.com.key
      peer-cert-mode require
   }

   In this example, profile_serverssl_syslog-2 represents the name of the Server SSL profile.

   Important: The certificate bundle that you specify must include the certificate chain of the certificate authority.
2. Create a VLAN on the private, internal network, with no interfaces assigned. For example: create net vlan vlan_securelog .
3. Create a self IP address in the traffic group traffic-group-local-only and associate it with the VLAN. For example: create net self 203.0.113.1/24 vlan vlan_securelog .
   Important: The IP address that you specify must be a non-routable address and must be identical on all BIG-IP systems in the configuration.
4. Create a non-floating virtual address on the private, internal network. For example:

   create ltm virtual-address 203.0.113.100
      traffic-group traffic-group-local-only
      auto-delete false

   Important: You must use tmsh to create the virtual address, and you must create the virtual address prior to creating the associated virtual server. Also, the IP address you specify must be the same virtual address that you specify on the peer BIG-IP system.
5. Create a virtual server for the virtual address, assigning the pool, SSL Server profile, and private VLAN. For example:

   create ltm virtual vs_secure_syslog_target-2 {
      destination 203.0.113.100:514
      ip-protocol tcp
      pool pool_remote_secure_syslog
      profiles replace-all-with { profile_serverssl_syslog-2 tcp }
      vlans replace-all-with { vlan_securelog }
      vlans-enabled

   In this example, vs_secure_syslog_target-2 represents the name of the virtual server, and the destination IP address is 203.0.113.100:514. The destination IP address and port that you specify must be the same destination IP address and port that you specify on the peer BIG-IP system.
6. Create a VLAN on the shared, external network with all appropriate BIG-IP interfaces assigned. For example: create net vlan vlan_logging { tag 4089 interfaces add { 1.1 {tagged} } } .
7. Create a self IP address in the traffic group traffic-group-local-only and associate it with VLAN vlan_logging. For example: create net self 192.0.2.200 vlan vlan_logging .

1. At the tmsh prompt, create a pool with the address and port of the encrypting virtual servers as the pool member. For example:

   create ltm pool pool_syslog_encryptor {
      members replace-all-with {
         203.0.113.100:514 { address 203.0.113.100 }
      }
      monitor tcp_half_open 
   }

   In this example, pool_syslog_encryptor represents the name of the pool that contains pool member 203.0.113.100:514.
2. Save the configuration by typing save /sys config.

1. At the tmsh prompt, create a packet filter. For example:

   Create sys log-config filter hslfilter_packet_filter {
      publisher hslpub_secure_remote_syslog
      source packet_filter
   }

2. Create an SSL filter. For example:

   create sys log-config filter hslfilter_ssl {
     publisher hslpub_secure_remote_syslog
     source ssl
   }

3. Create a tamd filter. For example:

   create sys log-config filter hslfilter_tamd {
     publisher hslpub_secure_remote_syslog
     source tamd
   }

4. Create a tmshfilter. For example:

   create sys log-config filter hslfilter_tmsh {
     publisher hslpub_secure_remote_syslog
     source tmsh
   }

1. At the tmsh prompt, enable syslog logging for BIG-IP^® Access Policy Manager^® (APM^®): modify sys db log.access.syslog value enable
2. Create an APM filter. For example:

   create sys log-config filter remote_apm_filter {
     level info
     publisher hslpub_secure_remote_syslog
     source accesscontrol
   }

3. Create an access control filter. For example:

   create sys log-config filter remote_acl_filter {
     level info
     publisher hslpub_secure_remote_syslog
     source apmacl
   }

4. Create a filter for single sign-on. For example:

   create sys log-config filter remote_sso_filter {
     level info
     publisher hslpub_secure_remote_syslog
     source sso
   }