14 Management, Users and System Services
This note covers the control plane side of BIG-IP: management access, licensing and provisioning, users and roles, remote authentication, and the supporting services (DNS, NTP, SNMP, syslog) and log files an administrator uses every day.
Management access
- The mgmt port is out-of-band, with its own IP and route. Shown top-left in the GUI next to the hostname; in CLI
tmsh list sys management-ip. - The management port can have its own firewall rules (allow/deny by source, with logging).
- Restrict GUI and SSH to admin networks (
sys httpd allow,sys sshd allow). - No access to the mgmt IP? Check link, IP/mask, management route, management rules and the client side; then use the console. On physical units,
Esc (opens the SCCP/AOM menu (Always-On Management). - Shells: bash (Linux) and tmsh (
(tmos)#prompt). The admin user may need Terminal Access enabled.
Licensing and provisioning
- License first, then provision. An unlicensed module can’t be provisioned (it appears unavailable).
- Activation: BIG-IP generates a system dossier → F5 license server → license. Automatic (Internet from mgmt) or manual (paste the dossier at activate.f5.com).
- Reactivate after adding modules and before upgrading (the service check date must be newer than the target version’s license check date).
tmsh show sys license detail→ licensed modules.tmsh show sys provision→ resources per module.- Provisioning gives a module CPU, memory and disk (levels: Dedicated, Nominal, Minimum, None — see 01 - ADC and Full Proxy Architecture).
Users and roles
| Role | Can do |
|---|---|
| Administrator | Everything |
| Resource Administrator | Everything except user account management |
| User Manager | Manage user accounts |
| Manager | Create/modify objects (VS, pools, profiles…) in its partition |
| Application Editor | Modify nodes, pools, members and monitors |
| Operator | Enable/disable nodes and pool members |
| Auditor | Read-only access to all configuration (no secrets) |
| Guest | Read-only |
| No Access | Nothing |
- Terminal access: Disabled, tmsh, or Advanced shell (bash; only admin-level roles).
- Users can be created in the GUI or with
tmsh create auth user.
Password policy (K15497)
Secure password enforcement, minimum length, required character types, password memory, maximum duration (e.g. 180 days), expiration warning, Maximum Login Failures — 0 means the feature is disabled (no lockout).
Remote authentication
- Supported servers: LDAP, Active Directory, RADIUS, TACACS+ (and client certificate LDAP).
- All remote users map to a single local placeholder account called “Other External Users”, which defines the default role.
- Remote Role Groups map a group attribute from AD/LDAP (e.g.
memberOf=CN=F5-Admins,…) to a role, partition and terminal access → manage access by groups instead of individual accounts.
Supporting services
| Service | Why | Where |
|---|---|---|
| DNS (UDP/TCP 53) | Name resolution; the search domain list lets you resolve short hostnames | System → Configuration → Device → DNS |
| NTP (UDP 123) | Correct time for logs, authentication, certificates and HA | System → Configuration → Device → NTP |
| SNMP (UDP 161/162) | Polling and traps for monitoring systems | System → SNMP |
| Syslog (514) | Send logs to a remote server/SIEM | System → Logs → Configuration → Remote Logging |
- An SNMP v1/v2c manager needs a community string and SNMP access (allowed address). SNMPv3 uses users with authentication and encryption.
- MIBs and OIDs: the OID identifies a value, the MIB defines names for OIDs. F5 MIBs:
F5-BIGIP-COMMON-MIB,F5-BIGIP-LOCAL-MIB,F5-BIGIP-SYSTEM-MIB. - Custom alerts (SNMP traps or email) are defined in
/config/user_alert.confby matching log messages.
Log files (/var/log/)
| File | Content |
|---|---|
ltm | Local traffic: members up/down, RSTs, connection limits, HA, ConfigSync, iRule errors |
secure | User authentication (logins, failed logins) |
audit | Configuration changes (who changed what) |
gtm, apm, asm | Their modules |
daemon.log, messages, kern.log | Linux system and daemons |
sodlog | SOD/failover events (course) |
Severity levels
0 Emergency · 1 Alert · 2 Critical · 3 Error · 4 Warning · 5 Notice · 6 Informational · 7 Debug. Setting a level logs that level and everything more severe. View all levels with tmsh list sys syslog all-properties (references K16197 and the LTM log message list).
Control plane vs data plane
| Control plane | Data plane | |
|---|---|---|
| Handles | GUI, tmsh, config (mcpd), monitors (bigd), HA (sod), logging | Client/server traffic |
| Runs on | Linux host | TMM |
| Seen in | top, Statistics → Analytics → View by Plane Names | tmsh show sys performance, tmsh show ltm virtual |
Self-check
Q1 — Which command lists the licensed modules?
Respuesta
tmsh show sys license detail
Q2 — What is the purpose of provisioning?
Respuesta
To grant a module system resources (CPU, memory, disk).
Q3 — Which tmsh command creates user accounts?
Respuesta
tmsh create auth user
Q4 — When remote users are configured, what local account represents them?
Respuesta
Other External Users.
Q5 — Where are remote groups configured in the GUI?
Respuesta
System → Users → Remote Role Groups.
Q6 — Which log records user authentication events?
Respuesta
/var/log/secure.
Q7 — Which log stores ConfigSync errors?
Respuesta
/var/log/ltm.
Q8 — What two things must be configured for an SNMP v1 server to query BIG-IP?
Respuesta
A community string and SNMP access (allowed address).