Supported way to use MFA to BIG-IP GUI and shell
I have read on DevCentral various mechanisms to implement 2FA (MFA) using APM and even some packages to change the PAM and implement this on the SSH shell. Are there any supported mechanisms to protect the BIG-IP Web interface via multi-factor? Even if one had the APM, can it be turned around to control the BIG-IP GUI itself? Also, what about SSH access? I am curious if others have solved this issue. It is surprising to me that at least the GUI does not have a native MFA solution to basic administration. Thanks, Tom
How to set different Priority Groups while adding nodes to pool with TMSH?
Version 11.4.1 and 11.5.0. I want to use a single TMSH command to create a pool and add 2 nodes each with a different Priority Group. Is this even possible? I am trying this in tmsh ltm: create pool pool_psc_p1_2_443 members add { view-p1-psc3:443 } priority-group 10 add { view-p1-psc4:443 } priority-group 1 monitor vmware_psc_monitor_TCP load-balancing-mode round-robin ...but I get this error: Syntax Error: "priority-group" unknown property I think I will have to first create the pool, then go back and modify it. I find the BigIP command line and TMSH difficult enough already, so I am inclined not to keep fiddling with it to try to make this work. The TMSH guide for 11.4.1 is rather useless for me here because the examples "delete pool my_pool" and "list pool my_pool" are a slightly a bit too overly simple.
Using Plink to run multiple commands
I have a fairly complex script which is trying to consolidate data into a text file using the following command: c:\tools\plink.exe -batch ltmops@%IP% -pw ******* -m a.txt >tempA.txt a portion of the a.txt file is as follows: show ltm virtual a* show ltm virtual b* show ltm virtual c* show ltm virtual d* ... Obviously, I'm trying to pull all of the VIP names. How can I suppress the prompt for "Display all 1014 items? (y/n) " ? I was trying to use "show ltm virtual *" but was being prompted for the same so I broke them out into individual commands, but this resulted in an undesirable high number of authentication requests in the logs. So now, I'm trying to implement the feature of using a file containing multiple commands that may be run under a single session. Thanks in advance for any guidance.
Finding all virtual servers with "log all traffic" policy applied via API
Hello, I am trying to locate virtual server configs in my F5 environment that are configured to log all traffic requests. Obviously, this has a detrimental impact to F5 logging performance. Is there a way to use the TMSH shell or REST API to interrogate the F5 appliance via a script and get a listing of all virtuals that use a "log all traffic" policy so I can change the policy and give our logging servers a bit of respite? Thank you, KylevRealize access to F5 needing to enable password authentication for SSH
So based on this document provided by VMWare support, the F5 needs to enable password authentication for SSH to allow vRealize to access and pull data. The instructions provided in this document are vague and don't work for me (but I am probably doing something wrong). Part of the issue is that I am not completely familiar with using the TMSH edit commands. The document is here: https://docs.vmware.com/en/VMware-vRealize-Network-Insight/6.0/com.vmware.vrni.using.doc/GUID-B722AA40-5C61-47F3-94A4-F7DAF9ABB1DA.html I can open the edit sys sshd but unsure how I add that bit into the config and then save it. I can't save the changes. Any thoughts? I've tried looking up how to use the edit command but can't find any details on how to do it.
