Applies To:
Show VersionsBIG-IQ Centralized Management
- 7.0.0, 6.1.0, 6.0.1
Manage Access Groups
How do I start to centrally manage APM configurations from BIG-IQ?
Here is an overview of your first steps for setting up an Access Policy Manager® (APM®) configuration once, and then being able to deploy that configuration from the BIG-IQ® system to other BIG-IP® devices.
Step 1. Add the BIG-IP device to the inventory list on the BIG-IQ system. You enter the IP address and credentials of the BIG-IP device you're adding, and associate it with a cluster (if applicable).
Step 2. Manage the APM configuration by adding to the existing Access group or creating a new Access group. You can create an Access group with or without a device.
What is the best way to create an Access group?
You can create an Access group in either of two ways. Use whichever you prefer, based on your requirements.
- In the Configuration tab, create an Access group without attaching a device.
- In the Configuration tab, create an Access group by attaching a device.
Add devices to the BIG-IQ inventory
Before you can add BIG-IP devices to the BIG-IQ inventory:
- The BIG-IP device must be located in your network and running a compatible software version. Refer to https://support.f5.com/csp/article/K14592 for more information.
- The management address of the BIG-IP device must be open (typically this is port 22 and 443), or any alternative IP address used to add the BIG-IP device to the BIG-IQ inventory. Ports 22 and 443 and the management IP address are open by default on BIG-IQ.
Create an Access group from the Configuration tab
Add a device to an Access group from the Configuration tab
Reimport an Access group configuration or device-specific configuration
- At the top of the screen, select Configuration, then on the left side of the screen, click .
- Click Reimport.
- For the Configuration Type option, Select whether you want to import a Shared Access Group and Device Specific configuration or just a Device specific configuration.
- (Optional) For the Snapshot option, select whether you want to create a snapshot of the current configuration before importing.
- Click Reimport.
Remove a device from an Access group
Remove an Access group
Create an Access group from the Devices tab
Discover the LTM and APM service configurations
Import the LTM service configuration
Import the APM configuration into an Access group
Add a device to an Access group from the Devices tab
Working with default service templates for Access
The BIG-IQ system ships with a set of Access-specific default service templates that you can use as starting points to allow authentication and access control for web applications behind local traffic virtual servers. You can clone these service templates and edit the cloned templates to add access security to your applications.
The table shows the included default service templates.
Service Template | Description |
---|---|
Default-f5-HTTPS-offload-lb-Access-AD-Authentication-template | For load balancing an HTTPS application on port 443 with SSL offloading on BIG-IP device, and securing application Access using AD authentication. |
Default-f5-HTTPS-offload-lb-Access-LDAP-Authentication-template | For load balancing an HTTPS application on port 443 with SSL offloading on BIG-IP device and securing application Access using LDAP authentication. |
Default-f5-HTTPS-offload-lb-Access-RADIUS-Authentication-template | For load balancing an HTTPS application on port 443 with SSL offloading on BIG-IP device and securing application Access using RADIUS authentication. |
- Clone an access policy from the default-access-group to the Access group associated with the Service Scaling Group.
- Edit the resources associated with the cloned access policy.
- Make the cloned policy available in templates.
- In the Service Catalog, clone the default associated service template.
- Associate the cloned Access Policy with the cloned service template and publish the service template.
- Deploy the application using the customized cloned template.
- To enable Access statistics, enable the remote logging configuration at .
Clone an access policy from the default-access-group
Review and edit resources associated with an access policy
Resources associated with a cloned access policy
These tables list resources that are cloned when you clone an access policy from the default-access-group. You should review and edit these resources, if necessary, on the target access group. Edit these resources from the access group (
).Resource | Details | Path |
---|---|---|
default_ad_auth_policy_aaa_srvr | The Active Directory server information for the access policy. | |
default_ad_auth_policy_sso | The SSO configuration for the access policy. | |
default-log-setting | Log settings for the AD auth policy. |
Resource | Details | Path |
---|---|---|
default_ldap_auth_policy_aaa_srvr | The LDAP authentication server information for the access policy. | |
default_ldap_auth_policy_sso | The SSO configuration for the access policy. | |
default-log-setting | Log settings for the LDAP auth policy. |
Resource | Details | Path |
---|---|---|
default_radius_auth_policy_aaa_srvr | The RADIUS authentication server information for the access policy. | |
default_radius_auth_policy_sso | The SSO configuration for the access policy. | |
default-log-setting | Log settings for the RADIUS auth policy. |