--- title: "Configure F5 BIG-IP" slug: "clm-configure-f5" updated: 2026-11-06T14:53:54Z published: 2026-11-06T14:53:54Z canonical: "docs.senhasegura.io/clm-configure-f5" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Configure F5 BIG-IP This document provides information on how to configure the F5 BIG-IP publishing profile to make it possible to install and publish certificates. If the F5 BIG-IP device isn't directly reachable from Segura® Platform, the profile publishes through the Network Connector configured on the device. ## Requirements - A certificate generated and signed by a CA. More information in [How to create a request](/v4-2/docs/certificates-flow-how-to-requisitions) and [How to sign a request](/v4-2/docs/certificates-flow-how-to-sign-request). - A credential registered in Segura® with access to the F5 BIG-IP device. More information in [How to configure a credential in Segura®](/v4-2/docs/pam-credential-how-to-set-up-a-credential-in-senhasegura). - A device registered in Segura® for the F5 BIG-IP. More information in [How to configure a device](/v4-2/docs/pam-device-configure-device). If the device isn't directly reachable from Segura® Platform, configure a Network Connector on the device before creating the profile. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment. - An HTTPS connectivity on the device, set to the port of the F5 API (for example, `8443`). Segura® connects to the F5 on this port. If the device has no HTTPS connectivity, Segura® uses its HTTP connectivity. If the device has neither, the publication fails with an error saying that the device has no HTTP connectivity. Attention After you save the device, reopen it and check that the HTTPS connectivity is still listed. Saving the device can remove its connectivities a few seconds later. ## Configure F5 BIG-IP To configure F5 BIG-IP, see the following steps: 1. On Segura®, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**. 2. In the side menu, select **Publishing** > **Publishing profiles**. 3. In the actions button, select **F5 BigIP**. 4. In the **Settings** tab, enter the following information: 1. In the **Profile name ***, enter the profile's name. 2. In the **Credential username**, enter the credential's name. 3. (Optional): Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura® to be used. 5. Click **Continue**. 6. In the **F5 BigIP** tab, enter the following fields: 1. In the **Certificate Name** field, enter the base name of the certificate on the F5. This field is required to publish, even though the form doesn't mark it as required. 2. The **Port for access via SOAP (F5 / BigIP)** field isn't used to publish. Segura® connects on the port of the device's HTTPS connectivity, or HTTP connectivity if there's no HTTPS. 3. (Optional) In the **Synchronization group** field, enter the name of the F5 device group to synchronize the configuration with after publishing. 4. (Optional) Check **Force overwrite?** to force the configuration synchronization to the synchronization group. This option has an effect only when the **Synchronization group** field is filled in. 5. (Optional) Check **Delete existing profiles in VIP?** to remove existing SSL profiles on the Virtual IP before applying the new one. 6. In the **Partitions** table, add the F5 partitions where the settings apply. Add at least one partition: the table is required to publish, even though the form doesn't mark it as required. 7. In the **SSLClient profiles** table, add the client SSL profiles, which secure the traffic between clients and the BIG-IP. For each profile, also enter the **Full name of virtual server (VIP)**. 8. In the **SSLServer profiles** table, add the server SSL profiles, which secure the traffic between the BIG-IP and the pool members. For each profile, also enter the **Full name of virtual server (VIP)**. 7. Click **Continue**. 8. In the **Devices** tab, select the F5 BIG-IP device. 1. The device must be previously registered in Segura®. 2. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured. 9. In the **Review** tab, review all information entered previously, and click **Save**. Info The certificate doesn't keep the exact name entered in **Certificate Name**. On the F5, you see the following names: - The certificate is installed as `<name>_<YYYYMMDD>`, where the date is the certificate's expiration date. If that name already exists, a suffix with 4 hexadecimal characters of the certificate's serial number is added: `<name>_<YYYYMMDD>_<serial>`. - The certificate chain is installed as `<name>_chain`. - The SSL profiles are moved to the new certificate, and the previously installed certificate and key pairs are removed. Attention F5 BIG-IP profiles created through the API don't publish, because the API saves the partitions in a field that the publication doesn't read. Until this is fixed, create F5 BIG-IP profiles in the interface. ## Verify your results Publish a certificate through the profile. If the device is reachable only through its Network Connector, the publication routes through that connector instead of failing on a local connection. More information in [How to publish a certificate](/v4-2/docs/certificates-flow-how-to-publish-a-certificate). Attention If the **Certificate Name** field or the **Partitions** table is empty, the publication fails with an error saying that at least the partition and certificate names must be defined. If the device has no HTTPS or HTTP connectivity, the publication fails with an error saying that the device has no HTTP connectivity. If the publication fails because the device's Network Connector is unreachable or misconfigured, the operation result shows: ``` Could not connect to the F5 at through the Network Connector (): cURL error : . Check that the F5 answers on the HTTP/HTTPS port registered for the device and that it is reachable from the Network Connector agent. ``` If the connection opens but the WSDL doesn't download, the message instead reads: ``` Could not download the F5 WSDL from through the Network Connector (): HTTP ``` Without a Network Connector, the same errors appear without the Network Connector details.