Configuring BIG-IP APM v13.1 Application Policy Manager BIG-IP Version 13.1.0.1 | February 2018F5 Networks Training Configuring BIG-IP APM v13 Application Policy Manager Student Guide ® v13.1.0.1 — February 2018 Configuring BIG-IP APM v13Configuring BIG-IP APM v13 Student Guide Twenty-Second Printing; February 2018 Support and Contact Information Obtaining Technical Support Contacting F5 Networks Web ‘support.f5.com Web www.fS.com Phone (206) 272-6888 Sales sales@f5.com com General Info _infowfS.com Support Issues support@ Suggestions feedback @f5.com FSNetworks, Ine. FS Networks, Ltd '§ Networks, Ine. PS Networks, Ine. Corporate Office United Kingdom Asia Pacific Japan 401 Eliot Avenue West Chertsey Gate West 5 Temasek Boulevard ‘Akasaka Gardon City 19F Scattl, Washington 98119 Chertsey Suey KT168AP_—#08-01/02 Suntec Tower S 4-1-1 Akasoka, Minato-ku T (888) S8BIG-IP United Kingdom Singapore, 038985 ‘Tokyo 107-0082 Japan (206) 272-5855 T (48) 0 1932 582-000 (65) 6833-6103 TBI) 35114-3200 F (206) 272 F (44)0 1932 582.001 F (65) 6533-6106 (61) 35114-3201 EMEATraining@fScom —APACTraining@S.com ——_ JapanTraining’@iS.com Legal Notices Copyright © 2018, F5 Networks, Inc. All rights reserved. FS Networks; In. (F5) belioves the information it fishes to be accurate and reliable, However FS assumes no responsibility forthe use oF hi information; nor any infringement of patents or othe: Fgh of hid partis Which may result ffm suse No license is granted by implication or ‘otherwise under any patent copyeght or atherineleetual propery Fight of FS except a specifically described by applicable user eons. FS resorss the right fo change speciation al anytime without nie. Trademarks ‘AAM, Assos Policy Manager, Advanced Client Authentication, Advanced Firewall Manager, Advanced Routing, AFM, APM, Application ‘Avsleration Manager, Application Seuty Manager, AskFS, ASM, BIG, BIG-IP EDGE GATEWAY, 1G-1Q,Claual Extender Clot Manage, CloudFucious, Cited Muliprocesing, CMP. COHESION, Data Marager, DDoS Foaline, DDoS SWAT, Defonse Net, .gz. Archived Log Table 8: Interesting Log Files for BIG-IP APM Configuring BIG-IP APM v13Chapter 5: Using Authentication 54 Chapter 5: Using Authentication Wiki Site Partner Auth !!! A CIO (cio@fStrn.com) To: adminX@fStrn.com The AD team has been unhappy about keeping partner accounts on the corporate Active Directory. They will be moving those accounts to a RADIUS server. You need to incorporate RADIUS authentication without making any changes to the way either employees or partners logon and you need to do that ASAP! Prerequisites This chapter is one of the required chapters and it builds on the concepts and technologies introduced in Chapter 4 and earlier. The required chapters present the basic foundations of BIG-IP APM. New Concepts and Technologies «AD Authentication, Authorization and the AD Query agent + RADIUS Authentication © One-Time Passwords © Local User Databases Configuring BIG-IP APM v13 545-2 Chapter 5: Using Authentication Introduction to Access Policy Authentication In order to use most Auth Agents, you must ereate a corresponding (BIG-IP APM) AAA server first. The ‘an object that points to the “real” AAA server. The BIG-IP APM AAA BIG-IP APM AAA server server usually contains any information needed to use the “real” AAA server, such as hostname and shared secret. The following is a list of AAA servers that are supported by BIG-IP APM. (2 Acceleration = RADIUS AA) Accase wae ovenew Active Directory Profiles / Policies soe HTTP co oracle Accoss Manager ae OcSP Responder Connectivity / VPN a ‘Seoure Web Gateway bo rastad Access Control Lists perore aida Local User D8 Endpoint = Management {> Device Management ‘Systems 2 CAPTCHA EQ Network Configurations [F9) system bis Figure 4: Access »» Authentication As you have seen before, after the (BIG-IP APM) AAA server is created, the corresponding Authentication Agent must be added to the Access Policy. ‘The following is a list ofall Authentication Agents. This is the Authentication tab from the Access Policy Add Agent window. We will briefly discuss most of the agents below, and many in more detail later in this chapter and in the course. 5-2 Configuring BIG-IP APM v13Chapter 5: Using Authentication 53 som awe Deectry athena fen wer exces tae recep wear fr nnh ecs hgner ectyeh AD ep ‘lent cat ingen Check he est of enter athetaton bythe Lo Taff Cent SL pole coupe ns ‘erent Revocation Lit Dstt Fo (CRLDP) dent eat authentication HIT Aah LTP astertcaon of end sr ender ert Ath ‘eters atentan, ypc felon an HTTP 4 Response action oa a 00? ashoricaon of re user cde Loar que 00? gun to pul wer totes for we with rescue aimee ote unions, sch 3 LDAP group mapeng Leas uth toca Dabs terion TUM th Rest TUM atheraton oer se crdertls onan Aeruaton ‘otuh 20 Autharzaton Agent for spe management onah cere ‘ten chee ‘nuh Scape ‘ott Scope coe th ‘Online Certs Stats Protec (OCS) cnt reat ute ‘nDerand Cart Auth Dyan an SSL rehardshake and vate the rece cen cateate OTP Generate enerte One Tine Pascoe (OTP) OTP erty erty One Tine Paste (OTP) 00S fet ‘Send acounbeg messes 08 RADIUS Seve when wes on and of AOS Ah AOIUS shertcaton of end wer coders ASA Sec FSA Seat bwofoer uerteatin of ed user crederls sent Ay SAM. AU ung SIM Serve Protec TOMS het Send szounting mesioges 108 TACACS* seer when srg on and of TwOACS Aa “WOACS + Autertcaon of on user cede “TniparentIdentty imprt__mor dns (sr) formato ram IMAP server Figure 2: Access Policy Authentication Agents List Active Directory, RADIUS, LDAP and RSA SecurlD are the most common authentication methods. Both AD and LDAP support an Authentication Agent and a Query Agent which is used for user resource Authorization, Because RADIUS and TACACS* began in the days of dialup MODEMS, they have the ability to log accounting records, sometimes referred to as Call Detail Records (CDR), which can be used for usage billing. We'll also look at AD Trusted Domains in this chapter. Another method of authentication is to use the student's credentials to attempt to logon to a web server. If the logon attempt is successful, then the BIG-IP system recognized that the credentials were valid and allows the user access. If the logon attempt fails, BIG-IP denies the user access. BIG-IP APM supports four methods to test user credentials on a web server: HTTP Basic Auth, NTLM, Form-based Auth and a Custom Post method. Note that the web server is used only to determine credential validity. The server response, if any, is lost. Configuring BIG-IP APM v13 5354 Chapter 5: Using Authentication BIG-IP APM can generate and authenticate one-time passwords. We will look at this in more detail later in this chapter. TACACS is similar to RADIUS in many respects and is commonly used in networks with a Cisco Infrastructure. ‘A user certificate check can either be performed when the user connects to BIG-IP APM, or may be initiated by the Access Policy sometime after the initial connection. This could be useful if a client certificate is required for specific secure operations, but not for normal tasks. Because user certificates are sometimes lost or stolen, there are two methods available to confirm that the certificate is still valid OAM and Kerberos Constrained Delegation are enterprise authentication and single sign-on platforms but are beyond the scope of this course. However, SAML is the third enterprise authentication and single sign-on platform that is covered on the third day. 54 Configuring BIG-IP APM v13Chapter 5: Using Authentication 55 Active Directory AAA Server We've already looked at the Active Directory AAA Server in Chapter 2, but we're going to dive in deeper in this chapter. There are three ways to specify the AD domain controller or controllers. The first method is to not use a pool and specify a single domain controller. ‘The second option also doesn’t use a pool, but relics on DNS find the domain controller using service locator records, The third option is to use a pool (not shown) and specify the domain controllers you want. This is your safest option in a production environment, because specifying a single domain controller is subject to a single point of failure. Relying on DNS is better, but in some circumstances can be worse if it chooses a domain controller halfway around the world. Specifying a pool of DCs reasonably close to BIG-IP APM. enhances the odds that BIG-IP APM will always be able to authenticate users. The lab only has a single domain controller, so using the pool is beyond the scope of t Domain Name {trn.com | Server Connection Use Pool @ Direct | | Domain Controller Figure 3: AAA Server Configuration The following shows BIG-IP APM using an Active Directory domain controller that is part of a multi- domain environment (Forest) with trust relations with the other controllers. - Active Directory t5tmcom area V User ia = — BIG-IP LTM+APM Figure 4: Active Directory Trusted Domains Configuring BIG-IP APM v13 555-6 Chapter 5: Using Authentication BIG-IP APM docs not honor trust relationships the way Windows PCs do. Users from other domains cannot log on to the BIG-IP APM by default. However, enabling the cross domain option in the AD Auth Agent allows users from other domains to logon to BIG-IP APM. Specifying Trusted Domains limits which domains can log on to BIG-IP APM. The lab only has a single domain and configuring Trusted Domains is beyond the scope of this course. Properties* |{ Branch Rules ) Name: |AD Auth Active Directory Type Authentication | Server None : Cross Domain Support | Disabled ¢ Figure 5: Access Policy AD Auth Agent: Cross Domain Support Disabled ‘The Trusted Domains field only appears in the Ul when Cross Domain Support is Enabled. Type ‘Authentication ] Server None + Trusted Domains None : ‘Cross Domain Support Enabled $ Figuro 6: Access Policy AD Auth Agent: Cross Domain Support Enabled 56 Configuring BIG-IP APM v13Chapter 5: Using Authentication 5-7 RADIUS As mentioned earlier, RADIUS has an Accounting option that allows RADIUS to send the session or user Logon and Logoff times to a log file. This feature is sometimes used for billing purposes, Unlike AD and LDAP, RADIUS does not have a query option. Instead any additional information that might be returned by a Query, is sent back with the Authentication response of Allow or Deny. (There is also a challenge response, but this is beyond the scope of this course.) For example, tne two fields returned (if there is content) are the class field, which is typically used similarly to Group Membership in AD and LDAP, and the Framed-IP field which can be used to provide aan IP address for the VPN tunnel. We haven't discussed BIG-IP APM VPNs yet, but you are probably familiar with VPN concepts. By providing the user with a known IP address other devices within the (enterprise) network can provide more granular access contro Many Token-Based One-Time Password providers also use RADIUS as their authentication method. RSA SecurlD has its own authentication method which BIG-IP APM supports, but RSA recommends the use of their RADIUS proxy for new implementations. Entrust and Vasco also use RADIUS for their OTP implementations, Configuring RADIUS Create the RADIUS AAA Server configuration that points to the actual RADIUS Server. The server address is the important part of this configuration. Like the AD Auth agent, the RADIUS server can be configured to connect directly to a single server or use a pool of servers. ‘AAA Server Name radius.aaa Type RADIUS Server Connection Direct Server Address 172.16.20.1 Table 1: RADIUS AAA Server Configuration ‘The AAA Server information is used by the RADIUS Auth agent in the Access Policy (shown here). Sia 8B [on rae f+ success, Tao RADIUS Auth je +» — aa) Figure 7: Access Policy with RADIUS Auth Agent Configuring BIG-IP APM v13 5758 Chapter 5: Using Authentication One-Time Password BIG-IP APM supports its own one-time password implementation, but re! of the password to a mobile device. 's on Email (or SMS) delivery rye eas] fo se] fa Figure 8: One-Time Password Actual Access Policy sy fe (Se It could work like this: the Logon Page agent is used to prompt for Username. With the username, AD Query can be used to find the user’s password. It is saved in a session variable. The OTP Generate agent creates « new password and stores it in a session variable (shown here). The email agent reads the session variables for email address and password and sends an email to the user or to an SMS proxy. The user receives the password on her mobile device and types it into the password prompt from the second Email agent. The OTP Verify agent matches the password from the second Logon Page (session variable) against the store password from OTP Generate (session variable) However, the typical implementation uses a user certificate instead of prompting for username (in the first Logon Page agent). The cert contains the username, which is extracted and used by the AD Query Agent to find the email address. By only prompting the user once we have streamlined the logon process. Using either method, when combined with a prompt for the AD password and using the corresponding AD Authentication Agent, provides Two-Factor Authentication, ie, something the user has (smart phone or user certificate) and something the user knows (password). 58 Configuring BIG-IP APM v13Chapter 5: Using Authentication 5-9 Local User Database BIG-IP APM also provides a local user database. This is not meant to replace Active Directory for enterprise logon, but it could easily replace a RADIUS server that had a small number of maintenance accounts ~ thus reducing total account management overhead. The first step is to create and name the database itself, The italicized settings are the defaults. ‘The first two settings indicate the user gets three attempts to logon within a ten minute interval. If the user fails, this will result in a lockout with a ten minute duration. This stymies automated authentication attacks as well as possibly minimizing the impact of user denial of service attacks Database Instance local-users.db Lockout Interval 600 (seconds) Lockout Threshold 3 (attempts) Dynamic User Remove interval 1800 (seconds) Table 2: Local Database Instance Configuration The next step is to add a user to the newly created database. Username student19 Password . Instance local-users.db Table 3: Local User Database Configuration Finally add the LocalDB Auth agent to your access policy. Because multiple user databases are allowed, the agent must specify which database to use. Unlike AD Auth and RADIUS, this agent has a third branch (not shown here) for users that are locked out. In that case, itis possible to provide locked out users receive a customized Deny message. Figure 9: Local User Database Authentication Policy Local User Database Temporary Usernames ‘The third setting is a little more complicated. The Local User Database can be used to store temporary usernames as well. For example, if usernames are being authenticated against Active Directory, the BIG- IP Access Policy Manager can be configured to save the username of an unsuccessful logon. If'that username is attempted more than some number of times within a certain period, BIG-IP can prevent any further log on attempts from reaching Active Directory. The third setting works when temporary names are allowed. In this case, that temporary name is only stored for a specific period and then that name is deleted. Configuring BIG-IP APM v13 5-9Chapter 6: Understanding Assignment Agents 61 Chapter 6: Understanding Assignment Agents Problems Updating Wiki Servers !!! A ClO (cio@fStrn.com) To: adminX@f5trn.com Of the three wiki servers we are load balancing, only one of them is writeable. The other two are read only. This has become a problem for employees trying to update the wiki. Make it so any employee wanting to update it, only goes to the first wiki server. Also, please remind all remote users not to share the Wiki content and you need to do it ASAP! Prereq es This chapter is one of the required chapters and it builds on the concepts and technologies introduced in Chapter 5 and earlier. The required chapters present the basic foundations of BIG-IP APM. New Concepts and Technologies + Visual Policy Editor List of Assignment Agents * Advanced Resource Assign Agent * Session Variable Assign Agent Configuring BIG-IP APM v13 6462 Chapter 6: Understanding Assignment Agents List of Assignment Agents Access Policy Assignment Tab ‘The following are all of the Assignment Agents available in the Access Policy (Geson|(Ratertzabon | Assorment Enns Seu (Sener Sde (Eons Sun (Gent Sas) Genera Pures ACL Assign Assign existing Access Control Lists (ACLS) 20 Grup Resource Assan Map ACL nd esoures based on ser Active Decor group membership ‘Advanced Resource Assign Expression-based assignment of Connectivty Resources, Webtop, and ACLS BWC Policy Assign Bandwicth Controller polices ‘crx Smart Access Enable Cr SmartAccess Mites when deploying with NenApp or XenDesktop Dynamic ACL. Assign and map Access Control Usts (ACLS) retrieved from an external cirectory such as RADIUS o* LDAP LDAP Group Resource Assign Map ACLS and resources based on user LDAP group membership Links Section and WebtO?_gsson 4 Yiettop, Webzop Links and Webtop Sections a rea An “oe a el po ey son Sa A ae oe oh ig fw Ya in een Se Fa Gas Roa {Us Dara a SMAT ——_ypaeny sec Rete Dana ad SAAT sets ‘$50 Credential Mapping _ Enables Single Sigr-On (SSO) credentials caching and assigns SSO variables Variable Assign ‘Assign custom variables, configurston variables, or predefined session variables ‘vmnere View Policy ‘Speck a policy thet vl apo to VMware View connections Figure 1: Access Policy Assignment Agents List In this course, you are going to focus on one assignment agent as much as possible, the Advanced Resource Assign agent. Anything that can be configured in the following six agents can also be configured using the Advanced Resource Assign: * ACL Assign + AD Group Resource Assign ‘© LDAP Group Resource Assign * Links, Section and Webtop Assign © Pool Assiz © Resource Assign Note that this agent was called the Full Resource Assign in carlier versions and sometimes labelled as ign” in macro templates, which have not yet been covered “Resource Ass 6-2 Configuring BIG-IP APM v13Chapter 6: Understanding Assignment Agents 63 ‘The ACL Assign agent has been superceded by the Advanced Resource Assign, but remains in the Access Policy for backwards compatibility with older versions of BIG-IP APM. ‘The AD Group and LDAP Group Resource Assign Agents function similarly to the Advanced Resource Assign, but allow for easier to use mapping of resources to AD Groups and LDAP Groups. ‘The Links, Section and Webtop Assign Agent has been superceded by the Advanced Resource Assign, but remains in the Access Policy for backwards compatibility with older versions BIG-IP APM. Note that Webtop Sections are new for BIG-IP APM 12.0. The Pool Assign and Resource Assign Agents have been replaced by the Advanced Resource Assign, but remain in the Access Policy for backwards compatibility with older versions BIG-IP APM. ‘The Dynamic ACL Assign Agent will be discussed in Chapter 14 and the Single Sign-On Credential Mapping Agent will be discussed in Chapter 15. ‘There are some additional agents shown that are beyond the scope of this course. A brief explanation for cach is provide below: BWC Policy: You can create a “Bandwidth Controller” (really it’s a Bandwidth Policy) in the ‘Acceleration Menu, This is part of the AAM product, but some parts are included without a license or without provisioning. Once a controller is created, it can be assigned to a BIG-IP APM policy using this agent. Citrix SmartAceess Filters: Citrix NetScaler has a similar feature to BIG-IP APM (but not as, powerful or flexible) that performs endpoint checks on the client. Based on these checks a string is passed to Citrix that can be used to determine which resources are available. Eg, all client endpoint checks passed, the string might be “Very Secure” and all resources are available, The string is completely arbitrary. After performing the appropriate endpoint checks, BIG-IP APM. can send the appropriate string to Citrix. RDG Policy: This agent assigns a secondary Access Policy (of type RDG-RAP) that runs every time a remote desktop client requests a new connection to a host that is behind BIG-IP APM. It is used to determine whether the client should have access to the targeted host. Route Domain and SNAT Selection: This allows the admin to set the Route Domain and the SNAT settings in the Policy, overriding the specification in the Virtual, SNAT (now called Source Address Translation in the Virtual) can be set to None, Automap or specify a Pool. Configuring BIG-IP APM v13 6364 Chapter 6: Understanding Assignment Agents Using the Advanced Resource Assign Agent The Access Policy from the previous chapter is shown below tos, Taran fh nf "ps, AD AUD | rteack * | Successful om +a] RADIUS AD | Figure 2: Wiki Accoss Policy Poet The idea for the new policy is to allow certain users to access the one member of the pool that is editable, but to do this, a new pool must be created that just contains the one editable host, as shown here. Pool Name wiki-edit.pool Pool Members 172.16.20.1:443 Pool Monitor —_ wiki-443 Table 1: Wiki Edit Poo! Configuration The next step is to add an Advanced Resource Assign Agent to your Access Policy, as show below. Sates fatback sxc Ta | BADIUS Aut oe Figure 3: Access Policy with Advanced Resource Assignment Agent pe Edit the Advanced Resource Assign Agent and click Add new entry, shown here. Figure 4: Access Policy Advanced Resource Assign Agent Properties Sheet In the newly created entry, click Add/Delete, 6-4 Configuring BIG-IP APM v13Chapter 6: Understanding Assignment Agents 65 freeevap IMENT ECHL EEE SLE -ESEE SESE SEE HERE EE EAU SEE Ean OI AEE EERE sere aes Anat “Ade nem entry naar ee: Boren cane e secvoaen Figure 5: Access Policy Advanced Resource Assign Agent: add new resource Here you see the kinds of resources you can add to your policy. You will look at each one of these options in depth in the next chapters. Note the 0/0 in each tab, this means 0 resources available and 0 selected. Only Static Pool is different. Click the Static Pool tab. [sacns60 Figure 6: Access Policy Advanced Resource Assign Agent: tabbed list of resource types Select the wiki-edit pool and save. manasa se aca Figure 7: Access Polley Advanced Resource Assign Agont: change tho default pool ‘This shows your entire Advanced Resource Assign configuration at this point. But what is wrong with it? With this configuration, every employce (remember this is on the AD Auth branch) will always go to the first host which writeable, but will lose the benefit of the pool. Employees should only go to this pool when they want to edit the wiki xprmion Ent eee 2 3 sai Poa: Cannan pct toa Figure 8: Access Policy Advanced Resource Assign Agent: resource ist summary Configuring BIG-IP APM v13 656-6 Chapter 6: Understanding Assignment Agents ‘To make that happen you need to change the expression, so that the wiki-edit pool is used when the employee adds “Yedit” to the end of the URL they use to access the wiki, eg, wiki.fStm.com/edit. The first step is to click Add Expression. Simple |[advanced Add Expressio Figure 9: Access Policy Advanced Resouree Assign Agent: add exrpression ‘The next step is to specify the actual expression and again, click Add Expression. ‘Simple ‘Agent Sel: Landing URI Condition: Landing URI. $ Landing URLs [eat ( cancel Figure 10: Access Policy Advanced Resource Assign Agent: landing URI expression After adding the expression, the Advance Resource Assign now succinetly states, IF the landing URI is /edit THEN change the default pool to wiki-edit. pool (rors: Lancing U's fet chase cy 1 sete Poot: Carmona nl este Figure 11: Access Policy Advanced Resource Assign Agent: resource lst summary Here you see the Access Policy with details for every Agent that doesn’t use the default settings. 6-6 Configuring BIG-IP APM v13Chapter 6: Understanding Assignment Agents 67 ‘Message: Piease do not share Wiki Content ) ( Message: Please do not share Wiki Content | Se Se Bae) + Lan ace | +f yl ae 7 zt { Server. on/fStn. | Max Logon Attempts Alowod: / / \ Ba ( Server. /Common/radius.aa8 ) (Expression: Landing URI is /edit | ‘Max Logon Attempts Allowed: 1 | state Poot /Common/wikiedit pol | Configuring BIG-IP APM v3. Figure 12: Access Policy 67Resource Assignments Labs Overview Archive and Save the Previous Lab Configuration Archive the current configuration, name the file studentX-lab6 and download it to your Windows client. When You’ve Completed the Following Labs... You will be able to create a dynamic policy that assigns different pools based on the user's authentication grouping. If you complete the challenge lab, you will also be able to create a ‘Two-Factor Authentication policy using Active Directory and One-Time Passwords, You will need 15 minutes to complete these lab exercises.Lab 6.1 - Dynamic Pool Assignment This lab is your first introduction to dynamic assignments. Rather than serving a user with a load balanced page, it serves users who authenticate with Active Directory, a single page so that it can be edited. Create a new Pool Pool Name wiki-edit pool Health Monitors wiki.mon Pool Members 172.16.20.1:443 Create an Access Profile and edit the Access Policy 1. Create a new Access Profile named wiki. following p.10 and edit the new policy to look like the Message: Please do not share Wiki Content Max Logon Attempts Allowed: 1 ~N tock Server: [Common/fStrn.aaa | ( Server ;Commoniradius.saa Max Logon Attempts Allowed: 4 2. Change the wiki.vs Virtual Server to use this policy Tests and Results Login as studentX. Which servers are used? Note: You may have to do a force refresh for each of these tests. Repeat for student17. Which servers? Repeat for student18. Which servers? figuring BIG-IP A\Chapter 7: Configuring Portal Access ™ Chapter 7: Configuring Portal Access OWA Losing DMZ Interface !! A CIO (cio@f5trn.com) To: adminX@fStrn.com The Security Team has demanded that the public facing IP address for OWA be removed and the Email Team has agreed. You need to find a way to make OWA available to all of our employees, but without compromising corporate security. Oh, and you need to do it ASAP! Prerequisites This chapter is one of the required chapters and it builds on the concepts and technologies introduced in Chapter 6 and earlier. The required chapters present the basic foundations of BIG-IP APM. New Concepts and Technologies + BIG-IP APM Component View * Landing Page (Full Webtop) * Portal Access (aka Reverse Proxy or HTTP Tunneling) © Rewrite Profile ‘+ Connectivity Profile ‘+ Portal Access Resource and Resource Item ‘© Virtual Server for Portal Access Configuring BIG-IP APM v13 TA72 Chapter 7: Configuring Portal Access Introduction to Portal Access So far, you've looked at BIG-IP LTM used in conjunction with the Access Policy. From @ BIG-IP APM perspective, this is called Web Application Access. In this chapter, you're going to look at another access method, Portal Access, which is sometimes referred to as HTTP Tunneling or Reverse Proxy. Web Application Access is a Layer 4 Proxy whereas Portal Access is Layer 7. You will examine these in more detail in the next few pages. These are the components of BIG-IP APM, the Access Policy and three remote access methods. Layer 4 Proxy Coty Remote Access - ' Nemes Soa) Pores Clay Layer 7 Proxy (aka Reverse Proxy) Figure 1: BIG-IP APM Components and Access Methods Web Application Access does not use a landing page, after connecting to BIG-IP APM and a possible logon page, the user is connected to the pool. Remote Access typically uses a landing page, which displays all the resources dynamically provisioned for the user, as shown here on the Full Webtop Landing Page For a user connecting to Web Application Access, the Virtual Server goes to the pool, but for a user connecting to Remote Access, the Virtual Server goes to a Landing Page, which can have many resources, such as Network Access, Application Access and Portal Access. 72 Configuring BIG-IP APM v13Chapter 7: Configuring Portal Access 7-3 forF5 Networks eee eonoee, wom Figure 2: Logon Page then Landing Page Unlike connecting to the wiki server for Web Application Access, for this Portal Access example, the user will log on to BIG-IP and then get a landing page (or Full Webtop in BIG-IP APM nomenclature). In the lab case, initially the student will have only one resource, or option, to click on. When the user clicks that resource on the landing page, things begin to happen. BIG-IP APM (remember BIG-IP architecture is full proxy) sends request to a backend server. This is configured in the resource as the starting URI as you will see in the configuration slides. ‘The backend server responds with an HTML page. BIG-IP APM encodes every link in the page and sends it to the user. Only the highlighted text is displayed on the left side. Below is an example of what happens when a user clicks a Portal Access Resource on the Landing Page, or Full Webtop. Configuring BIG-IP APM v13 7-314 Chapter 7: Configuring Portal Access 2. a En cep connect.f5trn.com intranet.internal HOST connect.f5trn.com HOST intranet.internal GET / GET/ href="https://connect.5trn.com menu.js'> /15.w-687474703a2121696e7472616e logo.png"/> 65742e696e7465726e616c$$ /appearance.css"/> Figure 3: Portal Access Request and Response ‘You see the original request from the client to BIG-IP to the backend Server. (Again, remember BIG-IP isa full proxy device.) Note the original text on the left. BIG-IP translates (Portal Access is a Layer 7 proxy) the links in the HTML file into something the browser will understand (shown on the right). Three of these links will be automatically pulled from the backend server. ‘The first link is for the stylesheet. Notice the user agent (browser) connects to BIG-IP APM (HOST) and performs a GET for a long encoded string, BIG-IP APM translates that to the proper HOST and G ings, shown below. str TH Configuring BIG-IP APM v13.Chapter ': Configuring Portal Access. 75 C) SS — Es [eo connect.fStrn.com intranet.internal HOST connect.f5trn.com HOST intranet.internal GET f5-w-687474703a... GET appearance.css Eee C HOST connect.f5trn.com HOST intranet.internal GET f5-w-687474703a... GET menu.js URLs Rewiten for JavaScrint = HOST connect.f5trn.com HOST intranet-internal GET f5-w-687474703a... GET logo.png ee eo ee Figure 4: More Portal Access requests and responses from links from the first page ‘The host returns the stylesheet and every URL in that style sheet is encoded as shown on the previous page. The user agent still has two more links from the original html page. Next it requests the JavaScript file. Those CSS and JavaScript files may contain URLs for other files from behind the firewall. Lastly the user agent brings the final file an image to complete the original web page. Note, there is no rewriting or patching of image files. To better explain what’s happening, let’s examine a URL before it gets translated. If this is the start URL, itis pre-configured in the portal access resource. It looks like the following after translation. Configuring BIG-IP APM v13 75Chapter 7: Configuring Portal Access — (eee 0 External URL Internal URL https://connect.f5tmn.com https://intranet.internal/appearance.css Meelis tna Oe iaitbGsTATOEAbeS 5742e696e74657262616c$$ /appearance.css fepp Figure 5: Portal Access Link Demangle not only unreachable (firewall), but in many times unresolvable. DNS internal names are often not visible externally. BIG-IP APM encodes the internal URL scheme and hostname into a hex string and prepends it with “f5-w-" and appends it with “S$”. It’s important to note the intemal hostname is obfuscated, but is easily decoded by any curious or malicious uscr. BIG-IP APM encodes all the rewritten URLs with its own hostname so any requests come back to BIG-IP APM. When BIG-IP APM receives an encoded request, it translates it back to the original URL (as you saw in the previous slide.) This encoding works HTML, CSS, JavaScript, Java and Flash files. Portal Access is sometimes referred to as HTTP Tunneling as you will see in the next slide. Remember the internal hos 76 Configuring BIG-IP APM v13Chapter 7: Configuring Portal Access cad Portal Access Configuration Overview This diagram shows all the objects that must be configured for Portal Access. It is similar to the Web Application Access configuration map from Chapter 2. Viral Server 443 Top [— recess Poley falback Figure 6: Portal Access Configuration Hierarchy Map A policy with Portal Access needs a Portal Access Resource and a Webtop. It also needs an Advanced Resource Assign than can assign the Portal Access Resource and the Webtop to the policy. Ifthe backend portal access resource (or BIG-IP LTM pool) is on port 443, it also needs a ServerSSL profile. the policy has a Portal Access resource, then the Rewrite profile is required. If the policy has a Portal ‘Access or Network Access resource, then the connectivity profile is required. Finally, SNAT Auto Map is configured. Note: the SNATT setting is not a profile. Ifthe backend server does not point a route back to BIG-IP then SNAT (or Source Address Translation as itis now called in the Virtual) must be set to Auto Map or to a SNAP Pool. Note in the classroom, the back-end resource server (IP addresses 172.16.20.1 - 19) has static routes so ‘that each student’s client PC gets routed back through their specific BIG-IP. This removes the requirement for each student to use SNAT on their virtual server. The default gateway of the back-end resource server is BIG-IP 17. However, the Windows Server services on 172.16.20.20 are not configured with individual static routes and thus require that SNAT Automap is configured. if Configuring BIG-IP APM v13 7778 Here is a summary of the configuration steps: Create Portal Access Resource Create Landing Page (aka Full Webtop) Chapter 7: Configuring Portal Access Create Access Profile and Policy with Advanced Resource Assign Create Rewrite Profile Create Connectivity Profile Create Virtual Server + TCP Profile + HTTP Profile * Client SSL Profile + Server SSL Profile + Rewrite Profile + Connectivity Profile + Access Profile + SNAT Automap + (No Pool Assignment) Tablo 1: Portal Accoss Configuration Overviow Shown here in the menu are the items you will use for Portal Access. (access Overview Profies / Potcies Authentication Single Sign-On Federation Secure Web Gateway Access Control Lists Connectivity Network Access (VPN) Apo Tunnels, VDI/ ROP, Microsoft Exchange Portal Access Lists Figure 7: Access » Connectivity / VPN : Portal Access Submenu 78 Configuring BIG-IP APM v13Chapter 7: Configuring Portal Access To ‘The next one is the Landing Page (Webtops) which is the BIG-IP APM Web Page that lists the resources a user is authorized to access. The connectivity profile (Secure Connect for specialized configurations. Next is the Portal Access Resource (Portal Access) which is assigned in the Access Policy. Finally, a Rewrite Profile (Portal Access : Rewrite) is require when using Portal Access. ty), is the kitchen sink (or catch all) of Profiles and allows Configuring BIG-IP APM v13 79Chapter 8: Configuring Network Access 84 Chapter 8: Configuring Network Access Employees Requesting VPN Access !!! A ClO (cio@f5trn.com) To: adminX@fStrn.com The good news: our employees have been happy with the OWA support you provided using BIG-IP APM. The bad news: they now want access to more than just OWA, including some non-HTTP resources. You need to provide a VPN solution for our employees ASAP! Prerequisites This chapter is one of the required chapters and it builds on the concepts and technologies introduced in Chapter 6 and earlier. The required chapters present the basic foundations of BIG-IP APM. New Concepts and Technologies ‘© BIG-P APM Concurrent User Licensing + Lease Pools © Tunnel SNAT'ing © Split Tunneling * DIL Network Access Resource © Dynamic Landing Page Configuring BIG-IP APM v13 8-18-2 Chapter 8: Configuring Network Access Concurrent User Licensing In Chapter 4, you discussed the maximum number of sessions that BIG-IP APM allows. There is a secondary concept called “concurrent user” that is different from a session. Like the maximum session count, the maximum number of concurrent users is limited by performance. By default, every BIG-IP APM platform comes with a relatively small number of CCUs, which is as low as 100 on the BIG-IP 2000. BIG-IP customers can buy additional CCU licenses based on their requirements. Shown here is the max CCU count per platform. Depending on what the user session is configured for, it may also consume a CCU, or it may not. A user session will never consume more than one CCU license. But, itis possible for a single user to use more than one session by using multiple browsers, for example, This would use multiple CCUs. BE BIG-IP VE 2,500 | BIG-IP 5000 Series 20,000 | VIP 2000 Series 60,000 BIG-IP 2000 500 | B1G-IP 15800 20,000 | viP 4480 100,000 BIG-P 2200 2,500 | BIG-IP 6900 FIPS 25,000 | VIP 4800 200,000 BIG.IP 2600 500 | BIG-P 7000 Series 40,000 BIG-IP (2800 2,500 | BIG-IP i7800 40,000 | BIG-IP 4000 5,000 | BIG-IP 10000 Series 60,000| BIG-IP 4200 10,000 | BIG-IP 110800 60,000 | BIG-IP 14600 5,000 | BIG-IP 12000 Series 100,000 | BIG-IP i4800 10,000 | | It is important to understand what consumes a CCU and what doesn’t, In a nutshell, BIG-IP APM+BIG- IP LTM does not use a CCU, but any Remote Access solution does. ‘There are a few exceptions shown here. The most important thing to understand is that the CCU is consumed when the user logs on. If the webtop (aka landing page, introduced in the previous chapter) contains a resource, then that user session consumes a CCU, regardless of whether the user uses that resource or not. On the other hand, if a user is using multiple resources that each require a CCU, only one CCU is consumed by that session. A session will never consume multiple CCUs. However, a single user can start multiple sessions using multiple browsers, 8-2 Configuring BIG-IP APM v13Chapter 8: Configuring Network Access Den Web Application Access (LTM Use Case) Network Access Portal Access Citrix Portal Mode Application Access Citrix Clients (Proxy Mode or Webtop Mode) VMware View Client Microsoft RDP Client (Java or Plugin) Outlook Anywhere, Active Syne OAM, SAML Webtop with Resource that Consumes CCU Webtop with no Resource that Consumes CCU Configuring BIG-IP APM v13 No. Yes Yes Yes Yes No No No No No Yes No 83 Cte 83a4 Chapter 8: Configuring Network Access VPN Concepts There are a couple of concepts you need to understand before you can configure BIG-IP APM Network Access. ‘The VPN tunnel is between the client and BIG-IP APM, but traffic flows through the tunnel and through BIG-IP APM to reach backend servers on the internal corporate network, The tunnel itself needs an ‘address which is used as the tunnel interfaces addresses on both the client and BIG-IP APM. This address comes from a lease pool and works very similarly to the way DHCP lease pools work for local clients. Ifyou want to have 8000 concurrent VPN users, you will need 8000 concurrent user licenses and you will need a lease pool with at least 8000 IP addresses. The pool range shown below is bit-aligned, so it can be represented with a single subnet address and mask. (The actual number of usable addresses is 8190: 10,20.0.1 ~ 10.20.31.254,) fo connect f5tm.com intranet internal =, Lease Pool: 10.20.0.019 Figure 4: VPN Tunnel iP Address To make Network Access work, your network has to be updated as shown below with new configuration information for BIG-IP APM, the backend server, and the router between them, The important thing to note here is that the router has a route to the lease pool that points to the internal BIG-IP self IP. intranet om “ae 10.20.10.99 — ee O a connect.fStrn.com (Lease Poo! 10.20.0.0119 { Route 10.20.0.0/19 Via 10. | Internal Self IP: 10.10.1.31 VPN SNAT: None or) Peo Ogi eras ay Eaten dst:10.20.10.99 eee ee) Figure 2: VPN SNAT set fo None This is the path a packet takes through BIG-IP APM and then into the backend network and finally all the ‘way back to the client. It’s important to emphasize that the tunnel connects to BIG-IP APM, but traffic a4 Configuring BIG-IP APM v13Chapter 8: Configuring Network Access 85 from the client flows through the tunnel, through BIG-IP APM, though the backend router and to the destination server. With this configuration, the router must have a route to the lease pool address space that points to the internal BIG-IP self IP, Without this route, the traffic would never reach the client for the return trip. However, there are a lot of times when an internal router may not have a route for the lease pool address space back to the BIG-IP. In that case, the VPN needs to be configured for SNAT Auto Map. When configured, BIG-IP APM changes the source address of the inbound packet from the client to its internal self IP, The routing infrastructure wil always be able to route back to the BIG-IP APM self address. If the routing infiastructure can’t or won’t include routing information to the BIG-IP APM Lease Pool, then SNAT Auto Map will solve the problem. IP Addr: 10.10.20.11 40.20.10.99 ics ‘connect fStrn.com intranet internal Lease Pool: 10.20.0.0/19 Internal Self IP: 10.10.1.31 VPN SNAT: Auto Map SCRE 10.10. er eee) ere) dst:10.20.10.99 Oe Figure 3: VPN SNAT set to Auto Map Ses) ce Consider the case where you have 8000 users averaging 10 connections each. The means a total of 80,000 connections. Each Connection consumes a port, The self-IP only has about 64000 unused high- order ports. When that limit is reached, the users won't be able to open any further connections. This is called port exhaustion, The work-around is to create a SNAT Pool and use it instead. Again, the same setup, but let’s examine how a user connects to non-corporate LAN resources when the VPN is enabled. With Split Tunneling disabled, all traffic flows through the VPN tunnel to BIG-IP APM and then back out to the specific external resource. Configuring BIG-IP APM v13 8586 Chapter 8: Configuring Network Access CeTETET intranet internal ca Le Onnect 5tm.com = — tease Poo! 1020.0.018 intemal SetiP:40.10.1.31 | VPN SNAT: Auto Map Spl Tunneling: None) Figure 4: VPN Split Tunneling set to None On the other hand, if Split Tunnel is configured with the internal address space, only traffic that is destined for that address space travels over the tunnel. All other traffic goes directly to its destination, 1020.10.99. intranet internal Lease Pool: 10.20.0.0/19 Ei \, internal sett P: 40.10.1.31 ) VPN SNAT: Auto Map | Split Tunneling: 10.10.0.0/16 | Figure 5: VPN Spit Tunneling set to Auto Map e . oy for either configuration? Split tunneling usually results in better performance for non- ‘What is the ca VPN traffic. It can also result in cost savings for corporate intemet connectivity, However, in the last few years more and more companies are disabling split tunneling for security reasons. With split tunnel disabled, security-minded companies can examine all traffic going to a remote client while it is connected to the VPN, especially non-corporate traffic. Finally, DNS resolution can be configured to provide split tunneling as well, so that internal resources are resolved by internal name servers and non-internal resources are resolved by the default client name server, In addition to creating a VPN tunnel interface on the client, Network Access also updates the routing table. 8-6 Configuring BIG-IP APM v13Chapter 8: Configuring Network Access 87 eric) Dea Lore Dea 10.10.0.0/16 tund 127.0.0.0/8 00. 127.0.0.0/8 100 192.168.1.1/32_ ethO default etho 192.168.1.100/32 ethO Split Tunneling is set fo 10.10.0.0/16 default tund Spit Tunneling is sot to None In the first table, with split tunneling enabled, you sce all traffic destined for the corporate LAN (10.10.0.0) takes the tunnel interface. All other traffic uses the default route out of the physical Ethernet interface. 127/8 Traffic is always sent to the loopback interface. With Split Tunneling disabled, traffic takes the default route over the tunnel interface, 192.168.1.1 is the local gateway for the client and 192.168.1.100 is the client’s IP address. ‘These are exceptions ~ host routes are maintained for both. (Otherwise, the tunnel would not know how to route to BIG-IP.) There is a VPN option to lock down the routing table so clients cannot change it VPN Traffic is multiplexed using PPP and can be optionally compressed. VPN Traffic is encrypted using ‘TLS and the tunnel is built between the client and a Port 443 Virtual Server on BIG-IP. BIG-IP APM also supports a UDP-based SSL/TLS VPN, called Datagram TSL, or DTLS, VPN. DTLS typically provides much better performance for UDP-based apps, especially, VoIP, Video and VDI This is because TCP retransmits occur at the tunnel layer for TCP-based VPNs. If the app is UDP, it may prefer to drop the packet and wait for the next packet. However, a TCP-based tunnel will guarantee its arrival (sometime introducing delay and/or jitter). A UDP-based tunnel will not request a retransmit if the packet is dropped. It relies on the TCP layer to request a retransmit, if needed. Any UDP apps are spared the retransmit Empirical evidence shows that even TCP-based apps may benefit from DTLS, if the link has high latency or high packet loss. If the link has both, performance is actually worse with DTLS. Ifthe link has neither, performance is about the same. The BIG-IP APM VPN client will always try to connect to UDP port 4433 to use DTLS. If that port is not available, because it is blocked by a network device between the client and BIG-IP APM, or if it is not configured on BIG-IP APM, the client will automatically fall back to TCP port 443, Configuring BIG-IP APM v13 8-788 Chapter 8: Configuring Network Access Network Access Configuration Overview In this case, you are only adding Network Access (aka SSL VPN) to the policy. Before you can create a Network Access resource, you need a Lease Pool to assign IP addresses to the VPN PPP tunnel interface. Then you can create the Network Access resource and finally assign it the Advanced Resource Assign agent in the poliey. [_vaatsowses_ | + Profile eae | | recess | | Rowse | | SNA Automap ime | | Servers Access Policy Seer Successtl [anced Resource Assan L282 aon Start BIGAP APM Objects and Resources ‘Other Dependencies Figure 6: Configuration Hierarchy Map Given that you are adding a VPN resource to existing Access Policy/Access Profile with a Virtual Server, there is not much left to do. The first step is to create a lease pool. Name intranet.ip Member List 10.20.1.1 - 10.20.1.250 88 Configuring BIG-IP APM v13Chapter 8: Configuring Network Access 89 Next, create a Network Access resource. This is a two-step process. First the resource is created, as shown here. Name intranet.na Caption Corporate VPN Then you need to modify the network settings, including linking the lease pool that you just created in the first step. IPv4 Lease Pool intranet.Ip ‘SNAT Pool ‘Auto Map Traffic Options Use Split Tunneling LAN Address Space —_—172,16.20.0/255.255.255.0 DNS Address Space —_—*.internal ‘The final step is to modify the access policy to include the network access resource created in the previous two steps. Sam te [acon ace] nf sist «ant ners an |S so | so auth Expression: Empty Webtop: [Commonilanding-page.wt Portal Access: Common/owa.pa Network Access: /Commoniintranet.na Figure 7: Access Policy Configuring BIG-IP APM v13 89Chapter 9: Deploying Macros ot Chapter 9: Deploying Macros Wiki User Complaints !!! A CIO (cio@f5trn.com) To: adminX@fStrn.com Before partners were moved off the Active Directory to RADIUS, the BIG-IP APM Logon Page used to give the user three chances to logon before ending the session. Now it only gives one chance. Our users are requesting that we change it back to three chances to logon ASAP! PS: | know you're new here, but ASAP means "RIGHT NOW"! Prerequisites This chapter is one of the core chapters and builds on the concepts and technologies introduced in Chapter 6 and earlier. The core chapters present the topics needed to take advantage of more of the product features and to architect, configure and manage a richer user experience. New Concepts and Technologies © Access Policy Macros © Logon Agents List Configuring BIG-IP APM v13 ot9-2 Access Policy Macros Macros can be use over and over within a specific Access Policy, but they cannot be shared with other Access Policies. When reused, they can significantly reduce the size of the overall Access Policy, as counted by the total number of Agents and the total number of endings. AS you've seen, moving groups of agents around the Access Policy can be tricky, but it is easy to delete and re-add Macros anywhere in the policy. Because it removes duplicated agents—which have to be configured individually—it reduces the chances for misconfiguration either at creation or during later modification. This is the DRY, or Don’t Repeat Yourself, principle. Overall it makes it faster, safer and easier to create and manage Access Policies. Here you see the access policy from lab 5.2. Sat) | Flow Max Logon Attempts Allowed: 1 ETE eoue Figure 1: Access Policy Currently, the user gets one attempt to logon. After that, the user is denied and has to start a new session, Ifyou are wondering why the Max Logon Attempts is not set to 3 for AD Auth and RADIUS Auth, then recall from Lab 5, only the AD Auth got three attempts, by default. RADIUS Auth only saw the password from the third attempt. An Access Policy that gives the user three attempts at both AD and RADIUS, might look like the following But that’s not a great policy. It has too many repeated agents and too many endings. Macros are @ good solution in this case. In the example below, you move the Logon Page, AD Auth and RADIUS auth into a macro that you will repeat three times, 9-2 Configuring BIG-IP APM v13Chapter 9: Deploying Macros 9-3 faloack | 7] sucess 4, Tae] fn 1 of Ss po — * [=] Macro: Logon-Auth macro settings / Rename | Edit Terminals (Endings: Success [defe Start aa + {ono BE * sucessful, 3) POA "set, FE) Si — Figure 3: Access Policy with Three Logon Attempts using a Macro This policy is much better than the previous one, but it still has too many endings. Also, in typical policies there are more Agents, such as Resource Assign or Logging that would follow on each of the three successful branches that follow the three authentication attempts. The following, more typical ‘example, illustrates your point. Note the three repeated, identical resource assigns. ‘This breaks the Don’t Repeat Yourself Principle and the chance of misconfiguration increases. For example, if one resource assign is just slightly misconfigured, troubleshooting can become very difficult. a so [enema Ta] Fn a Figure 4: Consequences of Additional Actions Nested Macros Nested Macros are a better solution. The original macro is shown below, labeled Macro: Logon-Auth Configuring BIG-IP APM v13 9-3o4 Chapter 9: Deploying Macros faack Success +9} Allow Logon-Auth 3 | +, ] Macro: Logon-Auth Tm) te + [sane PAB of Successful = aD Auth — falback ,_,, f Sucesfil RADIUS Auth | Start bo T Macro: Logon-Auth 3x r Success success eee = tect oy Sa) Figure 5: Access Policy with Three Logon Attempts using Nested Macros ‘A second macro, labeled Macro: Logon-Auth 3x, calls the original one three times. This is the nested macro, or maero within a macro, Now the main policy only has a single successful branch. Any additional agents on this branch don’t have to be repeated. Looping Macros An even better solution is to use a looping macro, which is a relatively new feature, Notice the third terminal, “Loop then Fail”. This terminal will loop back around to “In” terminal a preset number of times before eventually exiting the Loop. 94 Configuring BIG-IP APM v13Chapter 9: Deploying Macros 95 sucess + Allow Logon: . Auth 1000-31 sop then Fi = | © Macro: Logon-Auth Loop 3x Rename /Sewings) (Edie Terminals) successful, ) (Ade Terminal Nanevcece____ ete ame: [lcop tren Fat] (HB} wp Save Nacinum Maco Loop Count: 3. cancel Save help Cancel Figure 6: Access Policy with Three Logon Attempts using a Looping Macro By clicking the Rename / Settings button, you see the Maximum Macro Loop Count and Macro Name may be set. And by clicking the Edit Terminals button, you see the Terminals created. Look at the main policy. Using looping macros, there is only one macro in this policy! Also, there is only a single success branch. Finally, you end up with a much simpler policy that is easier to create and manage. Note the loop count is set to three. This means the contents inside the macro may execute (or loop) up to three times before leaving the macro, However, if execution flows down either successful branch (that is either the AD Auth or the RADIUS Auth was successful), then flow leaves the Looping Macro immediately. Also, note the Keyword Loop. This branch is designated as the looping branch. This gets turned on whenever the Loop Count is set higher than 1 Configuring BIG-IP APM v13 9596 Chapter 9: Deploying Macros Configuring Macros Shown below, is a completely empty Access Policy. To create a new macro for this policy, click the Add New Macro button. A new empty macro is opened. Here you see your empty policy and your newly created empty macro. You currently have one exit terminal named “Out”, ‘Add New Macro Figure 7: Initial Access Policy Click the Select macro templates button to see the range of pre-built macro templates to choose from. Select mace teria Soumereeres =e ‘baum queryand resources es So ey a Oo ema an exorces 120 autn eur OT bya resurces cnwynce na wtens Sepa for heron base LDAP auth query and escures Windows Ants and frenll Cent Classification and Prelogon checks LUcense Check ara ogsing |Gareet) (re) Figure 8: Initial Macro and List of Macro Templates In the labs, you're going to use the Empty template, so you get more practice creating agents. The next stop is to name the macro and then click Save. Your macro and the main policy will look like this. a ace [SEY] renew es Caan) sreymace were ema i Macro: AV+FW (Rename / Settings.) (Gait Terminals) fe}. ae Figure 9: Neme the Macro Figure 10: Empty Access Policy with Empty Macro 96 Configuring BIG-IP APM v13