Applies To:
Show VersionsBIG-IQ Centralized Management
- 5.4.0
How do I evaluate changes made to managed objects?
To change the object settings on a managed device, there are four tasks to perform.
This figure illustrates the workflow you perform to manage the objects on BIG-IP® devices. Evaluating the changes you have made is the third step in this process.
Overview of evaluating changes made to managed objects
How do shared objects affect my deployments?
The objects that you manage using BIG-IQ® depend on associations with other, supporting objects. These objects are called shared objects. When the BIG-IQ evaluates a deployment to a managed device, it starts by deploying the device-specific objects. Then it examines the managed device to compile a list of the objects that are needed by other objects on that device. Then (unless you override the default behavior) the BIG-IQ system deletes any shared objects that exist on the managed device but are not used. So if there are objects on a managed device that are not being used, the next time you deploy changes to that device, the unused objects are deleted.
Evaluate Access configuration changes
- To accept the default, proceed with the evaluation. The settings from the managing BIG-IQ overwrite the settings on the managed BIG-IP® device.
- To override the default, re-discover the device and re-import the service. The settings from the managed BIG-IP device overwrite any changes that have been made using the BIG-IQ.
To apply the evaluated object changes to the managed device, they must be deployed. Refer to Deploy configuration changes for instructions.
Evaluate Local Traffic configuration changes
- To accept the default, proceed with the evaluation. The settings from the managing BIG-IQ overwrite the settings on the managed BIG-IP® device.
- To override the default, re-discover the device and re-import the service. The settings from the managed BIG-IP device overwrite any changes that have been made using the BIG-IQ.
To apply the evaluated object changes to the managed device, they must be deployed. Refer to Deploy configuration changes for instructions.
Evaluate Network Security configuration changes
- To accept the default, proceed with the evaluation. The settings from the managing BIG-IQ overwrite the settings on the managed BIG-IP® device.
- To override the default, re-discover the device and re-import the service. The settings from the managed BIG-IP device overwrite any changes that have been made using the BIG-IQ.
To apply the evaluated object changes to the managed device, they must be deployed. Refer to Deploy configuration changes for instructions.
Evaluate Web Application Security configuration changes
- To accept the default, proceed with the evaluation. The settings from the managing BIG-IQ overwrite the settings on the managed BIG-IP® device.
- To override the default, re-discover the device and re-import the service. The settings from the managed BIG-IP device overwrite any changes that have been made using the BIG-IQ.
To apply the evaluated object changes to the managed device, they must be deployed. Refer to Deploy configuration changes for instructions.
How do I deploy changes made to managed objects?
Deploying changes applies the revisions that you have made on the BIG-IQ® Centralized Management system to the managed BIG-IP® devices.
This figure illustrates the workflow you perform to manage the objects on BIG-IP devices. Deploying the settings is the last step in this process.
Change managed object workflow
How does deployment to devices in a cluster work?
When you created a cluster in BIG-IQ® inventory, you chose a deployment option for the devices in that cluster.
If you chose to initiate BIG-IP® DSC® sync, and the Sync-Failover group on the BIG-IP system is configured for manual sync, after deployment to either device in the HA pair, Access kicks off manual sync to the other device. If manual sync succeeds, the deployment is successful. Otherwise, the deployment status shows an error.
If you chose to initiate BIG-IP DSC sync and the Sync-Failover group on the BIG-IP system is configured for automatic sync, after deploying to either device in the HA pair, automatic sync propagates the configuration to the other device. If automatic sync succeeds, the deployment is successful. Otherwise, the deployment status shows an error.
If you chose to ignore BIG-IP DSC sync, you must deploy the configuration from BIG-IQ to both devices in the cluster.
Deploy configuration changes
To apply the changes you made on the BIG-IQ® Centralized Management system to your managed device, you must deploy those changes to the managed device.
- If you chose to deploy immediately, the changes begin to deploy and the Status column updates as it proceeds.
- If you choose to delay deployment, the Status column displays the scheduled date and time.
Make an urgent Local Traffic & Network deployment
If you need to make an urgent change, you can skip the Evaluate configuration changes task and deploy changes to your BIG-IP® device immediately. Changes to configuration objects are still validated; if there are critical errors, the deployment does not proceed. But you can avoid the task of creating an evaluation and viewing the changes and get right to deploying your changes.
Deploy urgent Network Security updates
If you need to make an urgent change, you can skip the Evaluate configuration changes task and deploy changes to your BIG-IP® device immediately. Changes to configuration objects are still validated; if there are critical errors, the deployment does not proceed. But you can avoid the task of creating an evaluation and viewing the changes and get right to deploying your changes.
Make an urgent Web Application Security deployment
If you need to make an urgent change, you can skip the Evaluate configuration changes task and deploy changes to your BIG-IP® device immediately. Changes to configuration objects are still validated; if there are critical errors, the deployment does not proceed. But you can avoid the task of creating an evaluation and viewing the changes and get right to deploying your changes.
Deploy to one device when a cluster member is down
With the Ignore BIG-IP DSC sync when deploying configuration changes option selected, you can now deploy changes to the member that is available, and BIG-IQ will not attempt to sync those changes to the member that is unavailable.
Use the Deploy configuration changes task to deploy changes to the available member. When you select the target device for deployment, do not select the unavailable device.
Access deployment errors and warnings: causes and resolutions
Problem | Description | Resolution |
---|---|---|
Access profile type mismatch | The deployment process imports an access profile from a device to the other devices in the Access group. If an access profile of the same name exists on a device, the access profile types must match. If it does not, a critical error occurs and deployment fails. | On the BIG-IP® device, delete the access profile. Then, redeploy on the BIG-IQ® system. |
Sandbox object outside of the /Common partition | If partitions exist on the device in addition to the /Common partition, they contain sandbox objects by default. When the deployment process tries to create the sandbox objects, if the same partitions do not exist on the device, a critical error occurs and deployment fails. | On each BIG-IP device, create the same partitions. Then, redeploy on the BIG-IQ system. |
Pools, pool members, self IPs, route domains | Access objects refer to pools, pool members, self IP addresses, and route domains, all of which are managed in ADC. If any of these objects is not present on the device, evaluation provides a warning that LTM® must be deployed before Access can be deployed. If the warning is ignored, Access deployment fails. | Deploy LTM. Then re-discover LTM before trying to deploy Access. |