Applies To:
Show VersionsBIG-IQ Centralized Management
- 5.2.0
Finding a device-specific resource
Editing a device-specific resource
Sharing a device-specific resource
What local traffic objects does Access support?
In BIG-IQ® Centralized Management, you can associate various local traffic objects without manually configuring the objects in individual BIG-IP® devices before deploying the Access configuration on these devices. You must create these objects in either the BIG-IQ local traffic component or in BIG-IP local traffic. :
- Virtual Server
- You can configure sections of a virtual server specific to BIG-IQ system in the BIG-IQ system. This includes configuring Access profiles, connectivity profiles, per-request policies, VDI profiles, enabling App Tunnels, enabling OAM support, and PingAccessProfile.
- You can configure the SAML artifact resolution service with the virtual server for each BIG-IP device in BIG-IQ Access.
- SSL Certificate and SSL Key
- On the BIG-IP device, you can export the certificate and key files for each CERT and KEY object, and manually import them to the same object in BIG-IQ system.
- On the BIG-IP device, you can configure SAML, SAML IdP Connector, and OCSP Respond with SSL Cert and SSL Key.
- You can configure OamAccessGate for each device with SSL Key and Cert in BIG-IQ system.
- Net Tunnels Fec
- You can create the connectivity profile on a BIG-IP device with a Fec profile.
- Route Domains
- You can create route domains for each BIG-IP device in BIG-IQ system.
- You can configure the Route Domain Selection Agent for each BIG-IP device in BIG-IQ system by editing the Access policy.
- iRules
- You can create iRules® in BIG-IP Access, and configure them in the virtual server.
- If you are using iRules in an OAuth server, create the iRule first, then associate the OAuth server in the BIG-IP device.
- DNS Resolver
- You can create DNS resolvers in either the BIG-IP device or BIG-IQ system.
- The best practice is to create the DNS resolver in the BIG-IP device, then associate the DNS resolver with the OAuth server.
- SSL Client Profile and HTTP Profile
- You can create either profile in BIG-IQ system, and configure it in the local traffic virtual server.
- Server SSL Profile
- You can create this in either the BIG-IP device or in BIG-IQ system.
- The best practice is to create the server SSL profile in the BIG-IP device, and associate it with the SAML IdP connector.
- You can configure LDAP and Endpoint Management systems with a server SSL profile in either the BIG-IP device or in BIG-IQ system.
- Rewrite Profile and Classification
Profile
- You must create these in the BIG-IP device.
- You can associate both these profiles with the local traffic virtual server in the BIG-IQ system.
- You can associate the rewrite profile in portal mode with the Access group virtual server in the BIG-IQ system.
For more information about configuring BIG-IQ local traffic objects, refer to the online help, and to the guide, F5 BIG-IQ Centralized Management: Local Traffic & Network.
Editing a virtual server
Where are local traffic objects supported in Access?
This table describes the relationship between local traffic objects and APM objects. Specifically, this explains which local traffic objects are used in which Access objects.
LTM Object | Access Object |
---|---|
Virtual server |
|
SSL Key |
|
SSL Cert |
|
SNAT Pool |
|
Server SSL Profile |
|
Net Tunnels Fec |
|
Route Domain |
|
iRules |
|
DNS Resolver |
|
ReWrite Profile |
|
LogPublisher |
|
Preset |
|
Returning a shared resource to device-specific resources
Viewing an access policy
About the access policy display
When you view an access policy in BIG-IQ® Access, the items in the policy are of a constant size. If an access policy item name is unusually long and does not include spaces, the name of the policy item will be truncated.
Editing an access policy
- Creating a per-session policy macro.
- Creating a per-request policy macro, subroutine, or subroutine macro.
- Creating new endings or terminals
- Deleting endings or terminals.
- Changing macros or subroutine properties.
- Updating the policy ending.
Editing a policy item
About timeouts and crashes
During an editing session, if you remain inactive for a prolonged period of time, the session times out. Other times, the browser might freeze. In either case, you might have to prematurely terminate an editing session without a chance to save your changes. However, regardless of why you had to terminate a session, BIG-IQ® Access saves a draft of the policy and saves any unsaved macro when you make a modification. The next time you log in, locate the policy, and open the editing screen. The system notifies you that an unsaved draft exists, and prompts you to select whether you want to continue editing the draft or start over.
The system saves the change history in the draft, so actions such as Undo and Redo work for all changes you make before the session was interrupted. Lastly, if someone else was the previous editor, you can see the user and the time of the last edit. This allows you to choose whether or not to resume that person's editing session.
What is a macro sub-policy?
A macro is a sub-policy with a beginning, one or more policy items, and one or more endings. You can create or edit a macro as you would a policy. In a policy, a macro-call in the workflow represents the macro. When you insert a macro-call in a policy or another macro, it displays as a node in the workflow diagram. Typically, you use a macro in multiple branches of the workflow.
Macros are specific to an access policy. You cannot create a macro if there are pending changes to the access policy. You can also create special macros. These have the same workflow as the base macro type. However, you can only use subroutines in per-request policies and subroutine macros in subroutines.
Creating a macro sub-policy
Adding an action item or macro-call to a sub-policy
Creating an ending policy item
Editing an ending policy item
Deleting an ending policy item
Swapping policy branches
About editing conflicts
- Contact the other editor.
- Try again another time.
- Take over the original user's session. You can then choose to save or discard the original user's changes or continue editing.
Managing Configuration Snapshots
What is snapshot management?
Comparing snapshots
You can compare two snapshots, or compare a snapshot to the configuration on the BIG-IQ® Centralized Management system to view their differences.