BIG-IQ Cloud provides you with the tools to manage Amazon EC2 and CloudWatch resources required to perform application delivery. Management tasks include discovering and creating BIG-IP VE virtual machines located in Amazon Virtual Private Cloud (VPC), application pool servers, and deploying applications. You can use these features to accommodate application traffic fluctuations by periodically adding and retracting devices and application servers, as needed. Additionally, you can provide tenants access to self-deployable iApps through Amazon EC2 integration.

To provide access to these services for Amazon EC2 tenants, you configure communication between Amazon EC2 products, and BIG-IQ Cloud. Then, you associate a Amazon EC2 cloud connector with a device, and create a catalog entry for a corresponding Amazon EC2 service profile. The tenants to whom you give access to the catalog entry see it in their applications panel. From there, they can use it to self-deploy their own iApps.

1. From https://console.aws.amazon.com/iam, create a group with aws-full-access (Administrator Access).
2. Create an AWS-Admin user and add that user to the aws-full-access group.
3. Create a BIG-IQ Connector user and add that user to the aws-full-access group. For this user, you must download or copy an access key that you use to connect BIG-IQ Cloud to your AWS account
4. From the AWS dashboard, set up an account alias. Note the IAM user login link. For example, https://my-account-alias.signin.aws.amazon.com/console
5. Log out of the AWS dashboard as the root user.
6. Navigate back to the user login link and sign in as the AWS-Admin user.

1. Navigate to https://console.aws.amazon.com/vpc and select the AWS Region in which you want to manage resources. For example, Oregon.
2. From the VPC Wizard's VPC with Public and Private Subnets option, set the IP CIDR Block to 10.0.0.0/16.
3. Set the public subnet to 10.0.0.0/24. This is the management network.
4. Select an availability zone. For example, us-west-2c. It is crucial that you use this availability zone throughout the configuration process. Objects configured in one zone are not visible within other zones, so they cannot function together. This availability zone is required when you create a BIG-IQ Cloud connection.
5. Set the private subnet to 10.0.1.0/24. This is the external data network.
6. Create subnet 10.0.2.0/24. This is the internal network.
7. Create a security group named, allow-all-traffic, and associate it with the VPC you created. You must use this exact name.
8. Set the Inbound Rules ALL Traffic Source to 0.0.0.0/0.
9. Set the Outbound Rules ALL Traffic Destination to 0.0.0.0/0.
10. Create a Route Table for the external data network to reach the Internet.
11. Add a route to Destination 0.0.0.0/0 through Target igw-<xxxx>.

    <xxxx> is the Internet Gateway that the VPC Wizard created automatically.

12. Allocate two Elastic IP Addresses.

1. Log in to your account on Amazon Web Services (AWS) marketplace.
2. In the Search AWS Marketplace bar, type F5 BIG-IQ and then click GO. The F5 BIG-IQ Virtual Edition for AWS option is displayed.
3. Click F5 BIG-IQ Virtual Edition for AWS and then click CONTINUE.
   Tip: You might want to take a moment here to browse the pricing details to confirm that the region in which you created your security key pair provides the resources you require. If you determine that the resources you need are provided in a region other than the one in which you created your key pair, create a new key pair in the correct region before proceeding.
   The Launch on EC2 page is displayed.
4. Click the Launch with EC2 Console tab. Launching Options for your EC2 AMI are displayed.
5. Select the software version appropriate for your installation, and then click the Launch with EC2 button that corresponds to the Region that provides the resources you plan to use.
   Important: The first time you perform this task, you need to accept the terms of the end user license agreement before you can proceed, so the Launch with EC2 button reads Accept Terms and Launch with EC2.
   Important: There are a number factors that determine which region will best suit your requirements. Refer to Amazon user documentation for additional detail. Bear in mind that the region you choose must match the region in which you created your security key pair.
   The Request Instances Wizard opens.
6. Select an Instance Type appropriate for your use.
7. From the Launch Instances list, select EC2-VPC.
8. From the Subnet list, select the 10.0.0.0/24 subnet and click CONTINUE. The Advanced Instance Options view of the wizard opens.
9. From the Number of Network Interfaces list, select 2.
10. Click the horizontal eth1 tab to set values for the second network interface adapter, and then from the Subnet list, select the 10.0.1.0/24 subnet and click CONTINUE The Storage Device Configuration view of the wizard opens.
11. In the Value field, type in an intuitive name that identifies this AMI and click CONTINUE (for example, BIG-IQ VE <version>). The Create Key Pair view of the wizard opens.
12. From Your existing Key Pairs, select the key pair you created for this AMI and click CONTINUE. The Configure Firewall view of the wizard opens.
13. Under Choose one or more of your existing Security Groups, select the allow-all-traffic security group, and then click CONTINUE. The Review view of the wizard opens.
14. Confirm that all settings are correct, and then click Launch. The Launch Instance Wizard displays a message to let you know your instance is launching.
15. Click Close.

1. Log in to BIG-IQ Cloud with your administrator user name and password.
2. Hover over the Connectors header and click the + icon when it appears.
3. In the Name and Description fields, type a name and description. You can use the name and description to help you organize network resources into logical groups based on certain criteria, such as the location or application.
4. From the Cloud Provider list, select Amazon EC2.
5. In the Region Endpoint field, type the entry point URL. For example, ec2.us-east-1.amazonaws.com is the region end point for the Amazon EC2 US East (Northern Virginia) Region. Refer to the AWS documentation for a list of all regional end points at http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region
6. In the Key ID and Secret Key fields, type the credentials of the BIG-IQ-Connector IAM user. For security purposes, it is important to specify a user that has Amazon EC2 Full Control Access.
7. In the Availability Zone field, type the location of the region in which the instances are located. For example, type us-west-2c for the availability zone for Oregon state.
8. In the Virtual Private Cloud field, you may type the identification for the EC2 Virtual Private Cloud (VCP) network topology inside the Availability Zone. This step is optional. If you do not specify the identification for a VCP, BIG-IQ Cloud uses the first one it discovers in the Availability Zone.
9. Click the arrow next to Device & Server Provisioning to display associated options. The screen refreshes to display the options.
10. To prompt BIG-IQ Cloud to automatically provision additional BIG-IP VE devices when more resources are needed for application traffic, for the Device Elasticity setting, select Enable.
11. From the Device License list, select a rate at which you want Amazon to direct-bill for additional devices, or select a license pool from which to grant a license. You must activate a license pool before you can select it.
12. To automatically prompt BIG-IQ Cloud to provision additional servers when more resources are needed to manage an influx in application traffic, for the Server Elasticity setting, select Enable.
13. Review the network settings populated when you selected a connector, verifying that the proper CIDR blocks display for management, external, and internal.
14. Click the Save button.
15. If the system discovered devices, you must expand the device's properties panel, and provide the device's credentials to finalize the discovery process.
16. Review the network settings populated when you selected a connector, verifying that the proper CIDR blocks display for management, external, and internal.

1. Log in to BIG-IQ Cloud with your administrator user name and password.
2. Hover over the Devices header, and click the + icon when it appears.
3. Select the Create a Device option.
4. From the Cloud Connector list, select the EC2 cloud connector you created.
5. From the Device Image list, select the AMI you created for this device.
6. Select the Auto Update Framework check box to direct the BIG-IQ system to perform any required REST framework updates on the BIG-IP device. For the BIG-IQ system to properly manage a BIG-IP device, the BIG-IP device must be running the most recent REST framework. If you do not select the Auto Update Framework check box before you click the Add button, a message displays prompting you do update the framework or cancel the task.
7. To prompt BIG-IQ Cloud to assign the default user admin and a randomly-selected password, select the Use "admin" check box.
8. To assign a specific user name and password, deselect the Use "admin" check box. The screen refreshes to display additional settings.
9. In the User Name and Password fields, type a user name and password for the user of this devices.
10. Click the Add button.

1. Log in to the BIG-IQ system terminal as the root user.
2. Establish SSH trust between the BIG-IQ system and the managed BIG-IP device. ssh-copy-id root@<BIG-IP Management IP Address> This step is optional. If you do not establish trust, you will be required to provide the BIG-IP system's root password multiple times.
3. Navigate to the folder in which the files reside. cd /usr/lib/dco/packages/upd-adc
4. Run the installation script.
   • For devices installed in an Amazon EC2 environment: ./update_bigip.sh -a admin -p <password> -i /<path_to_PEM_file> <BIG-IP Management IP Address>
   • For devices installed in any other environment: ./update_bigip.sh –a admin –p <password> <BIG-IP Management IP Address>
   Where <password> is the administrator password for the BIG-IP device.
5. Revoke SSH trust between the BIG-IQ system and the managed BIG-IP device. root@<BIG-IP Management IP address>grep -v '<username>@<computername>' /root/.ssh/authorized_keys > /tmp/authorized_keys.tmp; mv -f /tmp/authorized_keys.tmp /root/.ssh/authorized_keys This step is not required if you did not establish trust in step 2.
6. Log in to BIG-IQ Cloud with your administrator user name and password.
7. In the Device panel, click the gear icon next to the legacy device with a yellow triangle next to it and displaying the message, Discovery is incomplete.
8. In the Admin User Name and Admin Password fields, type the administrator user name and password for the managed device.
9. Select the Auto Update Framework check box to direct the BIG-IQ system to perform any required REST framework updates on the BIG-IP device. For the BIG-IQ system to properly manage a BIG-IP device, the BIG-IP device must be running the most recent REST framework. If you do not select the Auto Update Framework check box before you click the Add button, a message displays prompting you do update the framework or cancel the task.
10. Click the Save button.

1. Hover over the Catalog header, and click the + icon when it appears. The panel expands to display the Catalog properties.
2. In the Name field, type a name for this new application.
3. From the Application Type list, select an application.
4. Unless you want to restrict this application template to a specific cloud connector, leave the Cloud Connector setting as Tenant Selectable so tenants are allowed to select the appropriate cloud connector when they deploy this application.
5. If the Application Tiers settings are displayed (expanded), select the options that match the properties for this application; otherwise, keep the default settings.
   Important: If you must specify the options for these settings, select the Tenant Editable check box for the virtual server and pool members.
6. To allow cloud tenants to specify certificates with SSL encryption when self-deploying applications, select options from the SSL Cert and SSL Key lists. BIG-IQ Cloud uses these options to provide the appropriate certificate and key when the tenant self-deploys this application to a BIG-IP device. These options are not available for all application templates.
7. Finish making modifications by specifying the Application Properties and Customize Application Template variables. To allow a tenant to modify a particular setting, select the Tenant Editable check box for that setting. For further details about template variables and settings, refer to the BIG-IP iApps Developer's Guide.
8. Click the Save button. You can now send the cloud IP addresses to the tenant and use this IP address range in configuring server tiers and pool members, within certain application services. The tenant can self-deploy the application from the catalog.

1. Log in to the BIG-IQ Cloud with your tenant user name and password.
2. Hover over the Applications header, and click the + icon when it appears.
3. In the Name field, type a name for this new application.
4. From the Application Type list, select an application.
5. From the Cloud Connector list, select the cloud connector associated with where you want to deploy your application. A cloud connector is a resource that identifies the local or virtual environment in which a tenant deploys applications and, when necessary, adds parameters required by third-party cloud providers.
6. To configure BIG-IQ Cloud to automatically provision additional resources when traffic to your application increases, select Enable from the Server Elasticity list and specify the settings for the server elasticity options that display. This option is available only for the EC2 connector. For automatic server provisioning to work, your cloud service provider must have enabled the Server Elasticity setting for this EC2 connector.
   1. From the Node Image list, select the image from which to create new application servers when capacity is met and additional servers are required.
   2. In the Min. # of Servers field, type the minimum number of application servers you want running at any given time.
   3. In the Max. # of Servers field, type the maximum number of application servers you want running when additional servers are required.
   4. From the Monitor By list, select the category associated with the statistic on which you want to base the threshold value.
   5. For the When setting, select a specific statistic, the associated relational operator, and a type a number in the field for the threshold. Base the threshold on the maximum amount of traffic a server can reasonably process for this application to ensure that BIG-IQ Cloud adds additional resources at the right time.
   6. In the Add Servers field, type the number of application servers you want BIG-IQ Cloud to add when this threshold is met.
7. To define a new SSL certificate and private key for this application, for the SSL Certificate Options, paste the PEM (CRT or CER) text representation of the certificate and private key. The SSL certificate and private key must be unbundled Base64 encoded ASCII text with PEM header and footer. This option is not available for all applications.
8. Alternatively, select the Use Existing option to use a SSL certificate and private key already stored on the device.
9. You can further customize this application by specifying an IP address for the virtual server and adding pool hosts. If your cloud service provider assigned IP addresses for the Servers, Pool Hosts, and Pool Members for this application, the addresses display. If these addresses were specified as not editable, you cannot change them.
10. When you are finished, click the Deploy button located at the top of the New Application panel.

1. Log in to the AWS IAM console.
2. Create a user role to encapsulate relevant permissions for this tenant. If a user needs to create key pairs, make certain that they have sufficient permissions.
3. Configure password policies for this tenant.
4. Create user accounts and set passwords for this tenant.
5. Create the user(s).
6. Specify the IAM AWS Management URL that you will provide to your tenants so that they can log in to this IAM account and directly manage their resources.

1. To view the resource associated with a particular activity, click the activity located on the Activities panel. The associated objects are highlighted in the relevant panels.
2. To view specific activity details, place your cursor on an activity. A popup window opens to display further details about the selected activity.