This document provides information on how to configure the F5 BIG-IP publishing profile to make it possible to install and publish certificates.
If the F5 BIG-IP device isn't directly reachable from Segura® Platform, the profile publishes through the Network Connector configured on the device.
Requirements
- A certificate generated and signed by a CA. More information in How to create a request and How to sign a request.
- A credential registered in Segura® with access to the F5 BIG-IP device. More information in How to configure a credential in Segura®.
- A device registered in Segura® for the F5 BIG-IP. More information in How to configure a device.
If the device isn't directly reachable from Segura® Platform, configure a Network Connector on the device before creating the profile. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment. - An HTTPS connectivity on the device, set to the port of the F5 API (for example,
8443). Segura® connects to the F5 on this port. If the device has no HTTPS connectivity, Segura® uses its HTTP connectivity. If the device has neither, the publication fails with an error saying that the device has no HTTP connectivity.
After you save the device, reopen it and check that the HTTPS connectivity is still listed. Saving the device can remove its connectivities a few seconds later.
Configure F5 BIG-IP
To configure F5 BIG-IP, see the following steps:
- On Segura®, in the navigation bar, hover over the Products menu and select Certificate Manager.
- In the side menu, select Publishing > Publishing profiles.
- In the actions button, select F5 BigIP.
- In the Settings tab, enter the following information:
- In the Profile name *, enter the profile's name.
- In the Credential username, enter the credential's name.
- (Optional): Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura® to be used.
- Click Continue.
- In the F5 BigIP tab, enter the following fields:
- In the Certificate Name field, enter the base name of the certificate on the F5. This field is required to publish, even though the form doesn't mark it as required.
- The Port for access via SOAP (F5 / BigIP) field isn't used to publish. Segura® connects on the port of the device's HTTPS connectivity, or HTTP connectivity if there's no HTTPS.
- (Optional) In the Synchronization group field, enter the name of the F5 device group to synchronize the configuration with after publishing.
- (Optional) Check Force overwrite? to force the configuration synchronization to the synchronization group. This option has an effect only when the Synchronization group field is filled in.
- (Optional) Check Delete existing profiles in VIP? to remove existing SSL profiles on the Virtual IP before applying the new one.
- In the Partitions table, add the F5 partitions where the settings apply. Add at least one partition: the table is required to publish, even though the form doesn't mark it as required.
- In the SSLClient profiles table, add the client SSL profiles, which secure the traffic between clients and the BIG-IP. For each profile, also enter the Full name of virtual server (VIP).
- In the SSLServer profiles table, add the server SSL profiles, which secure the traffic between the BIG-IP and the pool members. For each profile, also enter the Full name of virtual server (VIP).
- Click Continue.
- In the Devices tab, select the F5 BIG-IP device.
- The device must be previously registered in Segura®.
- The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
- In the Review tab, review all information entered previously, and click Save.
The certificate doesn't keep the exact name entered in Certificate Name. On the F5, you see the following names:
- The certificate is installed as
<name>_<YYYYMMDD>, where the date is the certificate's expiration date. If that name already exists, a suffix with 4 hexadecimal characters of the certificate's serial number is added:<name>_<YYYYMMDD>_<serial>. - The certificate chain is installed as
<name>_chain. - The SSL profiles are moved to the new certificate, and the previously installed certificate and key pairs are removed.
F5 BIG-IP profiles created through the API don't publish, because the API saves the partitions in a field that the publication doesn't read. Until this is fixed, create F5 BIG-IP profiles in the interface.
Verify your results
Publish a certificate through the profile. If the device is reachable only through its Network Connector, the publication routes through that connector instead of failing on a local connection. More information in How to publish a certificate.
If the Certificate Name field or the Partitions table is empty, the publication fails with an error saying that at least the partition and certificate names must be defined.
If the device has no HTTPS or HTTP connectivity, the publication fails with an error saying that the device has no HTTP connectivity.
If the publication fails because the device's Network Connector is unreachable or misconfigured, the operation result shows:
Could not connect to the F5 at <host:port> through the Network Connector <agent> (<URL>): cURL error <code>: <message>. Check that the F5 answers on the HTTP/HTTPS port registered for the device and that it is reachable from the Network Connector agent.
If the connection opens but the WSDL doesn't download, the message instead reads:
Could not download the F5 WSDL from <URL> through the Network Connector <agent> (<host:port>): HTTP <code>
Without a Network Connector, the same errors appear without the Network Connector details.