- Overview
- Warning
- Module Description - What the module does and why it is useful
- Setup - The basics of getting started with f5
- Usage - Configuration options and additional functionality
- Reference - An under-the-hood peek at what the module is doing and how
- Limitations - OS compatibility, etc.
- Development - Guide for contributing to the module
- Support
The f5 module enables Puppet management of LTM F5 load balancers by providing types and REST-based providers. The Puppet, Inc. versions (<= v1.5.4) of this module are no longer in development. That module has been merged with the development efforts of F5. Starting with v1.6.0, BIG-IP module development will be handled by F5.
Per the information in the Overview, this module cannot be used in conjunction with the former, deprecated module under the namespace of puppetlabs/f5. The puppetlabs/f5 module must be removed before you installing this module. This is recommended as this module will be the only actively maintained module in the future.
This module uses REST to manage various aspects of F5 load balancers, and acts as a foundation for building higher level abstractions within Puppet.
The module allows you to manage nodes, pools, applications, and application service, in order to manage much of your F5 configuration through Puppet.
Before you can use the f5 module, you must create a proxy system able to run puppet device. Your Puppet agent will serve as the "proxy system" for the puppet device subcommand.
Create a device.conf file in the Puppet conf directory (either /etc/puppet or /etc/puppetlabs/puppet) on the Puppet agent. Within your device.conf, you must have:
[bigip]
type f5
url https://<USERNAME>:<PASSWORD>@<IP ADDRESS OF BIGIP>/
In the above example, <USERNAME> and <PASSWORD> refer to Puppet's login for the device.
Additionally, you must install the faraday gem into the Puppet Ruby environment on the proxy host (Puppet agent) by declaring the f5 class on that host. If you do not install the faraday gem, the module will not work.
This example assumes the following pre-existing infrastructure:
- A server running as a Puppet master.
- A Puppet agent running as a proxy or controller to the f5 device.
- A f5 device that has been registered with the Puppet master via the proxy or controller.
The F5 device contains a management VLAN, a client VLAN to contain the virtual server, and a server VLAN to connect to the two web servers the module sets up.
To load balance requests between 2 webservers using the BIG-IP, you must know the following information about your systems:
- The IP addresses of both of the web servers;
- The names of the nodes each web server will be on;
- The ports the web servers are listening on; and
- The IP address of the virtual server.
- Classify the f5 device with the required resource types.
- Apply classification to the device from the proxy or controller by running
puppet device -v --user=root.
See below for the detailed steps.
In your site.pp, <devicecertname>.pp node manifest, or a profiles::<profile_name> manifest file, enter the below code in the relevant class statement or node declaration:
f5_node { '/Common/WWW_Server_1':
ensure => 'present',
address => '172.16.226.10',
description => 'WWW Server 1',
availability_requirement => 'all',
health_monitors => ['/Common/icmp'],
}
f5_node { '/Common/WWW_Server_2':
ensure => 'present',
address => '172.16.226.11',
description => 'WWW Server 2',
availability_requirement => 'all',
health_monitors => ['/Common/icmp'],
}
f5_pool { '/Common/puppet_pool':
ensure => 'present',
members => [
{ name => '/Common/WWW_Server_1', port => '80', },
{ name => '/Common/WWW_Server_2', port => '80', },
],
availability_requirement => 'all',
health_monitors => ['/Common/http_head_f5'],
require => [
F5_node['/Common/WWW_Server_1'],
F5_node['/Common/WWW_Server_2'],
],
}
f5_virtualserver { '/Common/puppet_vs':
ensure => 'present',
provider => 'standard',
default_pool => '/Common/puppet_pool',
destination_address => '192.168.80.100',
destination_mask => '255.255.255.255',
http_profile => '/Common/http',
service_port => '80',
protocol => 'tcp',
source_address_translation => 'automap',
source => '0.0.0.0/0',
vlan_and_tunnel_traffic => {'enabled' => ['/Common/Client']},
require => F5_pool['/Common/puppet_pool'],
}The order of your resources is extremely important. You must first establish your two web servers. In the code above, they are f5_node { '/Common/WWW_Server_1'... and f5_node { '/Common/WWW_Server_2'.... Each has the minimum number of parameters possible and is set up with a health monitor that pings each server directly to make sure it is still responsive.
Next, establish the pool of servers. The pool is also set up with the minimum number of parameters. The health monitor for the pool runs an https request to see that a webpage is returned.
Finally, the virtual server brings your setup together. Your virtual server must have a provider assigned.
If you're using a profile, remember to apply the profile to the node with either the console, your ENC, or site.pp.
Run the following command to have the device proxy node generate a certificate and apply your classifications to the F5 device.
$ puppet device -v --user=root
If you do not run this command, clients can not make requests to the web servers.
At this point, your basic web servers should be up and fielding requests.
(Note: Due to a bug, passing --user=root is required, even though the command is already run as root.)
Once you've established a basic configuration, you can explore the providers and their allowed options by running puppet resource <TYPENAME> for each type. (Note: You must have your authentification credentials in FACTER_url within your command, or puppet resource will not work.) This provides a starting point for seeing what's already on your F5. If anything failed to set up properly, it will not show up when you run the command.
To begin with, call the types from the proxy system.
$ FACTER_url=https://<USERNAME>:<PASSWORD>@<IP ADDRESS OF BIGIP> puppet resource f5_node
To manage the device (create, modify, or remove resources), classify the bigip
just as you would classify any other Puppet node (site.pp, ENC,
Console, etc.), using the device certname specified in device.conf.
Then run puppet device -v on the proxy node as you would normally use the
puppet agent command.
The above example is for setting up a simple configuration of two web servers. However, for anything more complicated, use the roles and profiles pattern when classifying nodes or devices for F5.
If you have a '/Common/http_monitor' (which is available by default), then when you are creating a '/Common/custom_http_monitor' you can use just parent_monitor => '/Common/http', so that you don't have to duplicate all values.
- The defaults for any given type's parameters are determined by your F5, which varies based on your environment and version. Please consult F5's documentation to discover the defaults pertinent to your setup.
- All resource type titles are required to be in the format of
/Partition/title, such as/Common/my_virtualserver.
- [f5]: The main class of the module. Installs the faraday gem; contains no adjustable settings.
- f5_iapp: Manages iApp instances on the F5 device.
- f5_node: Manages nodes on the F5 device.
- f5_pool: Manages pools of
f5_noderesources on the F5 device. - f5_irule: Creates and manages iRule objects on your F5 device.
- f5_monitor: Creates and manages monitor objects, which determine the health or performance of pools, individual nodes, or virtual servers.
- f5_virtualserver: Creates and manages virtual node objects on your F5 device.
- f5_partition: Manages partitions on the F5 device.
- f5_vlan: Manages virtual LANs on the F5 device.
- f5_selfip: Sets the self IP address on the BIG-IP system.
- f5_dns: Sets the system DNS on the BIG-IP system.
- f5_ntp: Sets the system NTP on the BIG-IP system.
- f5_globalsetting: Sets the gener system global setting on the BIG-IP system.
- f5_user: Sets the user account on the BIG-IP system.
- f5_route: Configure route on the Big-IP system.
- f5_root: Modify the password of the root user on the Big-IP system.
- f5_license: Manage license installation and activation on BIG-IP devices
- f5_selfdevice: Change device name from default bigip1
- f5_device: Manages device IP configuration settings for HA on a BIG-IP.
- f5_addtotrust: Manage the trust relationships between BIG-IPs.
- f5_devicegroup: Manage device groups on a BIG-IP.
- f5_configsync: Perform initial sync of the Device Group.
- f5_command: Run arbitrary TMSH command on the Big-IP system.
- f5_persistencecookie: Manage Virtual server Cookie persistence profile on a BIG-IP
- f5_persistencedestaddr: Manage Virtual server Destination Address Affinity persistence profile on a BIG-IP
- f5_persistencehash: Manage Virtual server Hash persistence profile on a BIG-IP
- f5_persistencesourceaddr: Manage Virtual server Source Address persistence profile on a BIG-IP
- f5_persistencessl: Manaage Virtual server SSL persistence profile on a BIG-IP
- f5_persistenceuniversal: Manage Virtual server Universal persistence profile on a BIG-IP
- f5_profilehttp: Manage Virtual server HTTP traffic profile
- f5_profileclientssl: Manage Virtual server client-side proxy SSL profile
- f5_profileserverssl: Manage Virtual server server-side proxy SSL profile
- f5_sslkey: Import SSL keys from BIG-IP
- f5_sslcertificate: Import SSL certificate from BIG-IP
- f5_snat: Manage Secure network address translation (SNAT)
- f5_snatpool: Manage SNAT pools on a BIG-IP
- f5_datagroup: Manage Internal data group
- f5_datagroupexternal: Manage External data group
Manage iApp application services on the F5 device. See F5 documentation for information about iApps. The best way to get started is to create an application service in the F5 gui, then copy the manifest returned for it via puppet resource f5_iapp
Specifies the name of the iApp application service to manage. Must be in the form of /<partition/<instance name>.app/<instance name> . Example: /Common/my_test.app/my_test
Valid options: a string.
Name of the iApp template to be used when creating the iApp application service.
Valid options: a string.
Hash containing iApp vars for the given template.
Valid options: a hash.
Hash containing iApp table entries for the given template.
Valid options: a hash.
Manages nodes on the F5 device. See F5 documentation for information about configuring F5 nodes.
Specifies the name of the node resource to manage.
Valid options: a string.
Specifies the IP address and route domain ID of the node resource.
Valid options: IPv4 or IPv6 addresses optionally followed by % sign and a route domain ID, such as '10.0.5.5%3'.
Sets the number of health monitors that must be available. This must be set if you have any monitors, but it cannot be set to more than the number of monitors you have.
Valid options: 'all' or an integer.
Sets the maximum number of concurrent connections allowed for the virtual server. Setting this parameter to '0' turns off connection limits.
Valid options: an integer.
Sets the connection rate limit of the node.
Valid options: an integer.
Sets the description of the node.
Valid options: a string.
Determines whether the node resource is present or absent.
Valid options: 'present' or 'absent'.
Assigns health monitors to the node resource. You can assign a single monitor
or an array of monitors. If you're using an array of monitors then you must also set availability_requirement.
Valid options: ["/PARTITION/OBJECTS"], 'default', or 'none'
Sets the logging state for the node resource.
Valid options: 'disabled', 'enabled', true, or false.
Specifies the backend to use for the f5_node resource. You seldom need to specify this, as Puppet usually discovers the appropriate provider for your platform.
Sets the ratio weight of the node resource. The number of connections that each machine receives over time is proportionate to a ratio weight you define for each machine within the pool.
Valid options: an integer.
Sets the state of the node resource.
Valid options: 'enabled', 'disabled' or 'forced_offline'
Manages pools of f5_node resources on the F5 device. See F5 documentation to learn more about F5 pools.
Specifies the name of the pool to manage.
Valid options: a string.
Specifies whether to enable network address translations (NAT) for the pool.
Valid options: true or false
Specifies whether to enable secure network address translations (SNAT) for the pool.
Valid options: true or false
Sets the number of health monitors that must be available. This must be set if you have any monitors, but cannot be set to more than the number of monitors you have.
Valid options: 'all' or integers
Sets the description of the pool.
Valid options: a string.
Determines whether the pool is present or absent.
Valid options: 'present' or 'absent'
Sets the health monitor for the pool. You can assign a single monitor
or an array of monitors. If you're using an array of monitors then you must also set availability_requirement.
Valid options: ["/PARTITION/OBJECTS"], 'default', or 'none'
Specifies the action to take when the service is down.
Valid options: 'none', 'reject', 'drop', or 'reselect'
Sets the slow ramp time for the pool.
Valid options: an integer.
Sets the return packet ToS level for the pool. The value you set is inspected by upstream devices and gives outbound traffic the appropriate priority.
Valid options: 'pass-through', 'mimic', or an integer between 0 and 255
Sets the packet ToS level for the pool. The BIG-IP system can apply an iRule and send the traffic to different pools of servers based on the ToS level you set.
Valid options: 'pass-through', 'mimic', or an integer between 0 and 255
Sets the return packet QoS level for the pool. The value you set is inspected by upstream devices and gives outbound traffic the appropriate priority.
Valid options: 'pass-through' or an integer between 0 and 7
Sets the packet QoS level for the pool. The BIG-IP system can apply an iRule that sends the traffic to different pools of servers based on that QoS level you set.
Valid options: 'pass-through' or an integer between 0 and 7
An array of hashes containing pool node members and their port. Pool members must exist on the F5 before you classify them in f5_pool. You can create the members using the f5_node type first. (See the example in Usage.)
Valid options: 'none' or
[
{
'name' => '/PARTITION/NODE NAME',
'port' => <an integer between 0 and 65535>,
},
...
]
Specifies the number of reselect tries to attempt.
Valid options: an integer.
Specifies whether to queue connection requests that exceed the connection capacity for the pool. (The connection capacity is determined by the connection limit set in f5_node.)
Valid options: true or false.
Specifies the maximum number of connection requests allowed in the queue. Defaults to '0', which allows unlimited connection requests constrained by available memory. This parameter can be set even if request_queuing is false, but it does not do anything until request_queuing is set to true.
Valid options: an integer.
Specifies the maximum number of milliseconds that a connection request can be queued until capacity becomes available. If the connection is not made in the time specified, the connection request is removed from the queue and reset. Defaults to '0', which allows unlimited time in the queue. This parameter can be set even if request_queuing is false, but it does not do anything until request_queuing is set to true.
Valid options: an integer.
Specifies the type of IP encapsulation on outbound packets, specifically BIG-IP system to server-pool member.
Valid options: '/PARTITION/gre', '/PARTITION/nvgre', '/PARTITION/dslite', '/PARTITION/ip4ip4', '/PARTITION/ip4ip6' '/PARTITION/ip6ip4', '/PARTITION/ip6ip6', or '/PARTITION/ipip'.
Sets the method of load balancing for the pool.
Valid options: 'round-robin', 'ratio-member', 'least-connections-member', 'observed-member', 'predictive-member', 'ratio-node', 'least-connection-node', 'fastest-node', 'observed-node', 'predictive-node', 'dynamic-ratio-member', 'weighted-least-connection-member', 'weighted-least-connection-node', 'ratio-session', 'ratio-least-connections-member', or 'ratio-least-connection-node'
Disables persisted weights in predictive load balancing methods. This parameter is only applicable when load_balancing_method is set to one of the following values: 'ratio-member', 'observed-member', 'predictive-member', 'ratio-node', 'observed-node', or 'predictive-node'.
Valid options: true or false
Assigns f5_node resources to priority groups within the pool.
Valid options: 'disabled' or integers
Creates and manages iRule objects on your F5 device. See F5 documentation to learn more about iRules.
Set the syntax for your iRule. This parameter should be event declarations consisting of TCL code to be executed when an event occurs.
Valid options: Any valid iRule TCL script
Determines whether iRules should be present on the F5 device.
Valid options: 'present' or 'absent'
Sets the name of the iRule object.
Valid options: a string.
Verifies the signature contained in the definition.
Valid options: true or false
Creates and manages monitor objects, which determine the health or performance of pools, individual nodes, or virtual servers. See F5 documentation to learn more about F5 monitors.
Note: Not all features are available with all providers. The providers below are based on F5 monitor options.
external- Create your own monitor type. (Contains features:external.)gateway_icmp- Make a simple resource check using ICMP. (Contains features:transparent.)http- Check the status of HTTP traffic. (Contains features:auth,dscp,reverse,strings, andtransparent.)https- Check the status of HTTPS traffic. (Contains features:auth,dscp,reverse,ssl,strings, andtransparent.)icmp- Make a simple node check. (Contains features:transparent.)ldap- Check the status of LDAP servers. (Contains features:auth,debug, andldap.)sip- Check the status of SIP Call-ID services. (Contains features:debugandsip.)tcp- Verify the TCP service by attempting to receive specific content from a resource.(Contains features:dscp,reverse,strings, andtransparent.)tcp_half- Monitor a service by sending a TCP SYN packet to it. (Contains features:transparent.)udp- Verify the UDP service by attempting to send UDP packets to a pool, individual node, or virtual server. (Contains features:debug,reverse,strings, andtransparent.)
Note: Not all features are available with all providers.
auth- Enables authentication functionality. (Available withhttp,https,ldap. )debug- Enables debugging functionality. (Available withldap,sip, andudp.)dscp- Enables DSCP functionality. (Available withhttp,https, andtcp.)external- Enables external command functionality. (Available withexternal.)ldap- Enables LDAP functionality. (Available withldap.)reverse- Enables reverse test functionality. (Available withhttp,https,tcp, andudp.)sip- Enables SIP functionality. (Availlable withsip.)ssl- Enables SSL functionality. (Available withhttps.)strings- Enables you to send or receive strings. (Available withhttp,https,tcp, andudp.)transparent- Enables pass-through functionality. (Available withgateway_icmp,http,https,icmp,tcp,tcp_half, andudp.)
Sets any additional accepted status codes for SIP monitors. (Requires sip feature.)
Valid options: '*', 'any', or an integer between 100 and 999
Sets any additional rejected status codes for SIP monitors. (Requires sip feature.)
Valid options: '*', 'any', or an integer between 100 and 999
Specifies the destination IP address for the monitor to check.
Valid options: 'ipv4' or 'ipv6'
Specifies the destination port for the monitor to check.
Valid options: '*' or an integer between 1 and 65535
Sets command arguments for an external monitor. (Requires external feature.)
Valid options: a string.
Sets an LDAP base for the LDAP monitor. (Requires ldap feature.)
Valid options: a string.
Sets the LDAP chase referrals for the LDAP monitor. (Requires ldap feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Specifies the list of ciphers that match either the ciphers of the client sending a request or those of the server sending a response. The ciphers in this parameter are what would be in the Cipher List field. (Requires ssl feature.)
Valid options: a string.
Specifies the client certificate that the monitor sends to the target SSL server. (Requires ssl feature.)
Valid options: a string.
Specifies a key for the client certificate that the monitor sends to the target SSL server. (Requires ssl feature.)
Valid options: a string.
Sets the SSL options setting in OpenSSL to 'ALL'. Defaults to 'enabled'.
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets the debug option for LDAP, SIP, and UDP monitors. (Requires debug feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets the description of the monitor.
Valid options: a string.
Determines whether or not the resource should be present.
Valid options: 'present' or 'absent'
Specifies the command to run for an external monitor. (Requires external feature.)
Valid options: a string.
Sets the LDAP filter for the LDAP monitor. (Requires ldap feature.)
Valid options: a string.
Specifies the headers for an SIP monitor. (Requires sip feature.)
Valid options: Array
Specifies how often to send a request. Determined in seconds.
Valid options: an integer.
Specifies the ToS or DSCP bits for optimizing traffic and allowing the appropriate TCP profiles to pass. Defaults to '0', which clears the ToS bits for all traffic using that profile. (Requires dscp feature.)
Valid options: An integer between 0 and 63
Specifies LDAP mandatory attributes for the LDAP monitor. (Requires ldap feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Enables the manual resume of a monitor, associates the monitor with a resource, disables the resource so it becomes unavailable, and leaves the resource offline until you manually re-enable it.
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Specifies the SIP mode for the SIP monitor. (Requires sip feature.)
Valid options: 'tcp', 'udp', 'tls', and 'sips'
Sets the name of the monitor.
Valid options: a string.
Specifies the parent-predefined or user-defined monitor. This parameter can't be modified once the monitor is created. All providers can be used with this parameter.
Valid values: '/< PARTITION >/< MONITOR NAME >' (For example: '/Common/http_443')
Sets the password for the monitor's authentication when checking a resource. (Requires auth feature.)
Valid options: a string.
Specifies the backend to use for the f5_monitor resource. You seldom need to specify this, as Puppet usually discovers the appropriate provider for your platform.
Available providers can be found in the "Providers" section above.
Specifies the text string that the monitor looks for in the returned resource. (Requires strings feature.)
Valid options: Regular expression
Specifies the text string the monitor looks for in the returned resource. (Requires strings feature.)
If you use a receive_string value together with a receive_disable_string value to match the value of a response from the origin web server, you can create one of three states for a pool member or node: Up (Enabled), when only receive_string matches the response; Up (Disabled), when only receive_disable_string matches the response; or Down, when neither receive_string nor receive_disable_string matches the response.
Valid options: Regular expression
Marks the pool, pool member, or node down when the test is successful. (Requires reverse feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets the LDAP security for the LDAP monitor. (Requires ldap feature.)
Valid options: 'none', 'ssl', and 'tls'
Specifies the text string that the monitor sends to the target resource. (Requires strings feature.)
Valid options: a string; for example: 'GET / HTTP/1.0\n\n'.
Specifies the request to be sent by the SIP monitor. (Requires sip feature.)
Valid options: a string.
Allows the system to delay the marking of a pool member or node as 'up' for some number of seconds after receipt of the first correct response.
Valid options: an integer.
Specifies the period of time to wait before timing out if a pool member or node being checked does not respond or the status of a node indicates that performance is degraded.
Valid options: an integer.
Enables you to specify the route through which the monitor pings the destination server, which forces the monitor to ping through the pool, pool member, or node with which it is associated (usually a firewall) to the pool, pool member, or node. (Requires transparent feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets how often the monitor should check the health of a resource.
Valid options: an integer, 'disabled', false, or 'no'
Sets a username for the monitor's authentication when checking a resource. (Requires auth feature.)
Valid option: a string.
Creates and manages virtual node objects on your F5 device.
Note: Not all features are available with all providers. The providers below were based on F5 virtual server options you can read about here.
forwarding_ip- Forwards packets directly to the destination IP address specified in the client request, and has no pool members to load balance. (Available withbandwidth_control,clone_pool,connection_limit,connection_mirroring,irules,last_hop_pool,protocol_client,source_port,source_translation, andtraffic_class.)forwarding_layer_2- Shares the same IP address as a node in an associated VLAN group. (Available withbandwidth_control,clone_pool,connection_limit,connection_mirroring,default_pool,fallback_persistence,irules,last_hop_pool,persistence,protocol_client,source_port,source_translation, andtraffic_class.)performance_http- Increases the speed at which the virtual server processes HTTP requests, and has a FastHTTP profile associated with it. (Available withbandwidth_control,clone_pool,default_pool,irules,last_hop_pool,persistence,protocol_client,source_port,source_translation, andtraffic_class.)performance_l4- Increases the speed at which the virtual server processes packets, and has a FastL4 profile associated with it. (Available withbandwidth_control,clone_pool,connection_limit,connection_mirroring,default_pool,fallback_persistence,irules,last_hop_pool,persistence,protocol_client,source_port,source_translation, andtraffic_class.)reject- Rejects any traffic destined for the virtual server IP address. (Available withirules,source_port, andtraffic_class.)standard- Directs client traffic to a load balancing pool, and is a general purpose virtual server. (Available withaddress_translation,bandwidth_control,clone_pool,connection_limit,connection_mirroring,default_pool,fallback_persistence,irules,persistence,policies,port_translation,protocol_client,protocol_server,source_port,source_translation,standard_profilesandtraffic_class.)stateless- Improves the performance of UDP traffic over a standard virtual server in specific scenarios but with limited feature support. (Available withaddress_translation,connection_limit,default_pool,last_hop_pool, andport_translation.)
Note: Not all features are available with all providers.
address_translation- Supports address translation. (Available withstandardandstateless.)bandwidth_control- Supports bandwidth control. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4, andstandard.)clone_pool- Supports clone pools. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4, andstandard.)connection_limit- Supports limiting connections. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4,standard, andstateless.)connection_mirroring- Supports mirroring connections. (Available withforwarding_ip,forwarding_layer_2,performance_l4, andstandard.)default_pool- Supports setting a default pool. (Available withforwarding_layer_2,performance_l4, andstandard.)fallback_persistence- Supports setting a fallback persistence profile. (Available withforwarding_layer_2,performance_http,performance_l4,standard, andstateless.)irules- Supports setting iRules. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4,reject, andstandard.)last_hop_pool- Supports a last hop pool. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4, andstateless.)persistence- Supports setting a persistence profile. (Available withforwarding_layer_2,performance_http,performance_l4, andstandard.)policies- Supports policies. (Available withstandard.)port_translation- Supports port translation. (Available withstandardandstateless.)protocol_client- Supports client protocol profiles. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4, andstandard.)protocol_server- Supports server protocol profiles. (Available withstandard.)source_port- Supports source port setting. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4,reject, andstandard.)source_translation- Supports source address translation. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4, andstandard.)standard_profiles- Supports the standard set of profiles. (Available withstandard.)traffic_class- Supports traffic class objects. (Available withforwarding_ip,forwarding_layer_2,performance_http,performance_l4,reject, andstandard.)
Determines whether the virtual server's IP should respond to pings based on pool member availability.
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Determines whether address translation is on or not. If the address is translated, the servers interpret the traffic as coming from the F5 and respond to the F5. However, if the address is not translated, the servers interpret the traffic as coming from the router and return the traffic there. Address translation works only at layer 4 and below. (Requires address_translation feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Enables you to use specific authentication profiles that make various traffic behaviors applicable to multiple protocols. The authentication profiles available when this parameter is enabled are: LDAP, RADIUS, TACACS+, SSL Client Certificate LDAP, SSL OCSP, and CRLDP. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Allows the BIG-IP system to track the source MAC address of incoming connections and return traffic from pools to the source MAC address, regardless of the routing table.
Valid options: 'default', 'enabled', or 'disabled'
Applies a bandwidth controller to enforce the total amount of bandwidth that can be used by the virtual server.
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Copies traffic to IDS's prior to address translation.
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Copies traffic to IDS's after address translation.
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Sets the maximum number of concurrent connections allowed for the virtual server. Setting this to 0 turns off connection limits. (Requires connection_limit feature.)
Valid options: an integer.
Sets whether to mirror connection and persistence information to another device in order to prevent interruption in service during failover. (Requires connection_mirroring feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets the connection rate limit of the object.
Valid options: An integer or 'disabled'.
Specifies the CIDR mask of connection destinations with rate limiting.
Valid options: An integer between 0 and 32.
Sets the connection rate limit mode.
Valid options:
- 'per_virtual_server'
- 'per_virtual_server_and_source_address'
- 'per_virtual_server_and_destination_address'
- 'per_virtual_server_destination_and_source_address'
- 'per_source_address'
- 'per_destination_address'
- 'per_source_and_destination_address'
Specifies the CIDR mask of connection sources with rate limiting.
Valid options: An integer between 0 and 32.
Enables you to use specific persistence profiles that make various traffic behaviors applicable to multiple protocols. The persistence profiles available when this parameter is enabled are: Cookie, Destination Address Affinity, Hash, Microsoft Remote Desktop, SIP, Source Address Affinity, SSL, and Universal. (Requires persistence feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'.
Specifies a pool of nodes that F5 sends traffic to if not otherwise specified by another property such as an iRule or OneConnect profile. (Requires default_pool feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'.
Sets the description of the virtual server.
Valid options: a string.
Sets the IP address of the virtual server. Optionally includes a route domain ID. Eg: '10.0.5.5%3'
Valid options: IP Address
Specifies the netmask for a network virtual server, which clarifies whether the host is 0 or a wildcard representation. Is required for network virtual servers.
Valid options: Netmask
Enables you to use a Diameter profile, which allows the BIG-IP system to send client-initiated Diameter messages to load balancing servers and ensure that those messages persist on the servers. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables you to use a custom DNS profile to enable features such as: converting IPv6-formatted addresses to IPv4 format, DNS Express, and DNSSEC. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Determines whether or not the resource should be present.
Valid options: 'present' or 'absent'
Specifies the type of persistence that the BIG-IP system should use if it cannot use the default persistence. (Requires fallback_persistence feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables you to use Financial Information eXchange (FIX) protocol messages in routing, load balancing, persisting, and logging connections. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Defines the behavior of File Transfer Protocol (FTP) traffic. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables the virtual server to modify HTML content that passes through it, according to your specifications. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables compression of HTTP content to reduce the amount of data to be transmitted and significantly reduce bandwidth usage. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables you to use an HTTP profile that ensures that HTTP traffic management suits your specific needs. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables the use of iRule objects on your virtual server. (Requires irules feature.)
Valid options: 'none' or '/< PARTITION >/< IRULE OBJECT NAME >'
Directs reply traffic to the last hop router using a last hop pool. Note: This parameter overrides the auto_lasthop setting.
Valid options: 'none' or '/< PARTITION >/< POOL NAME >'
Sets the name of the virtual server.
Valid options: a string.
Maps IPv6 subscriber private addresses to IPv4 Internet public addresses.
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Enables use of an encrypted challenge/response protocol to authenticate a user without sending the user's password over the network. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables connection pooling on your virtual server. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables use of custom /Partition/Object policies.(Requires policies feature.)
Valid options: Array
Determines whether port translation is on or not. If the port is translated, the servers interpret the traffic as coming from the F5 and responds to the F5. However, if the port is not translated, the servers interpret the traffic as coming from the router and return the traffic there. (Requires port_translation feature.)
Valid options: 'enabled', 'disabled', true, false, 'yes', or 'no'
Sets the network protocol name for which you want the virtual server to direct traffic.
Valid options: 'all', 'tcp', 'udp', or 'sctp'
Setting this parameter requires setting protocol_profile_server as well. If you want to default this value, set protocol_profile_server to the same value as protocol_profile_client.
Enables you to use specific protocol profiles that expand the capacities of specific protocols pertaining to incoming connections from a web client. The protocol profiles available when this parameter is enabled are: Fast L4, Fast HTTP, HTTP Class, TCP, UDP, and SCTP. (Requires protocol_client feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Setting this parameter requires setting protocol_profile_client as well. If you want to default this value, set protocol_profile_client to the same value as protocol_profile_server.
Enables you to use specific protocol profiles that expand the capacities of specific protocols pertaining to F5's connection to the virtual server's it's sending traffic to. The protocol profiles available when this parameter is enabled are: Fast L4, Fast HTTP, HTTP Class, TCP, UDP, and SCTP. (Requires protocol_server feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Specifies the backend to use for the f5_virtualserver resource. You seldom need to specify this, as Puppet usually discovers the appropriate provider for your platform.
Available providers can be found in the "Providers" section above.
Enables you to define the throughput limitations and packet scheduling method that you want the BIG-IP system to apply to all traffic that the rate class handles.
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Instructs an HTTP virtual server to send a request to a named virtual server of type Internal for possible modification by an Internet Content Adaptation Protocol (ICAP) server. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables you to configure data within a log file for requests and responses in accordance with specified parameters. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Instructs an HTTP virtual server to send a response to a named virtual server of type Internal for possible modification by an Internet Content Adaptation Protocol (ICAP) server. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Specifies the TCL expression that the system uses to rewrite the request URI that is forwarded to the server without sending an HTTP redirect to the client. Note: If you use static text rather than a TCL expression, the system maps the specified URI for every incoming request. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables a client system to control a remote streaming-media server and allow time-based access to files on a server. (Requires 'standard_profiles' feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Specifies a service name or port number for which you want to direct traffic. This parameter is required. (Requires 'service_port' feature.)
Valid options: '*' or integers
Configures how the virtual server handles SIP sessions. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Configures the BIG-IP system to handle proxy requests and function as a gateway. Configuring browser traffic to use the proxy allows you to control whether to allow or deny a requested connection. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Specifies the CIDR notation for traffic source address. Optionally includes a route domain ID.
Valid options: '< IPADDRESS[%ID]/ 0 - 32 >'. For instance: '78.0.0.0%3/8'.
Assigns an existing SNAT or LSN pool to the virtual server, or enables the Automap feature. When you use this setting, the BIG-IP system automatically maps all original source IP addresses passing through the virtual server to an address in the SNAT or LSN pool. (Requires source_translation feature.)
Valid options: 'none', 'automap', { 'snat' => '/Partition/pool_name'}, or { 'lsn' => '/Partition/pool_name'}
Specifies whether the system preserves the source port of the connection. (Requires source_port feature.)
Valid options: 'preserve', 'preserve_strict', or 'change'
Minimizes latency of HTTP requests by multiplexing streams and compressing headers. When you assign a SPDY profile to an HTTP virtual server, the HTTP virtual server informs clients that a SPDY virtual server is available to respond to SPDY requests. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables the the BIG-IP system to handle authentication and encryption tasks for any SSL connection coming into a BIG-IP system from a client system. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Enables the BIG-IP system to handle encryption tasks for any SSL connection being sent from a BIG-IP system to a target server. A server SSL profile is able to act as a client by presenting certificate credentials to a server when authentication of the BIG-IP system is required. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Sets the state of the virtual server.
Valid options: 'enabled', 'disabled', or 'forced_offline'
Provides user-defined statistical counters.
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Searches for and replaces strings within a data stream. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Allows you to classify traffic according to a set of criteria that you define, such as source and destination IP addresses, for the virtual server.
Valid options: An array of /Partition/traffic_class_name objects
Specifies the names of VLANs for which the virtual server is enabled or disabled.
Valid options: '< 'all','enabled', or 'disabled' > => [ '/Partition/object' ]}'
Weight taken into account by the Global Traffic Manager.
Valid options: an integer between 0 and 100 (Note: value is a percentage.)
Allows the BIG-IP system to store HTTP objects in memory and reuse these objects for subsequent connections. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'
Defines the formatting and attack pattern checks for the security policy. (Requires standard_profiles feature.)
Valid options: 'none' or '/< PARTITION >/< VIRTUAL SERVER NAME >'.
Manages partitions on the F5 device. See f5 documentation for information about configuring F5 partitions.
Specifies the name of the partition resource to manage.
Valid options: a string.
Sets the description of the node.
Valid options: a string.
Manages virtual LANs on the F5 device. See f5 documentation for information about configuring F5 VLANS.
Specifies the name of the partition resource to manage.
Valid options: a string.
Sets the description of the node.
Valid options: a string.
Specifies the VLAN ID. If you do not specify a VLAN ID, the BIG-IP system assigns an ID automatically.
Valid range: 1 - 4094.
Causes the BIG-IP system to verify that the return path of an initial packet is through the same VLAN from which the packet originated.
Valid options: 'enabled' or 'disabled'.
Specifies the Maximum Transmission Unit.
Valid range: 576 - 65535.
Triggers fail-over in a redundant system when certain VLAN-related events occur.
Valid options: 'enabled' or 'disabled'.
Specifies the number of seconds that a system can run without detecting network traffic on this VLAN before it takes the fail-safe action.
Valid range: 0 - 4294967295.
Specifies the action that the system takes when it does not detect any traffic on this VLAN, and the timeout has expired. The default is 'reboot'. Valid options:
- 'reboot': The system reboots.
- 'restart-all': The system restarts all services.
Allows the BIG-IP system to track the source MAC address of incoming connections and return traffic from pools to the source MAC address, regardless of the routing table.
Valid options: 'default', 'enabled', or 'disabled'.
Specifies how the traffic on the VLAN will be disaggregated. The value selected determines the traffic disaggregation method. You can choose to disaggregate traffic based on src-ip, dst-ip, or default, which specifies that the default CMP hash uses L4 ports.
Valid options: 'default', 'src-ip' or 'dst-ip'.
Specifies whether some of the stateless traffic on the VLAN should be disaggregated in a round-robin order instead of using a static hash.
Valid options: 'enabled' or 'disabled'
Specifies the maximum interval in seconds between two pollings.
Valid range: 0 - 86400.
Specifies the ratio of packets observed to the samples generated.
Valid range: 0 - 102400.
An array of interfaces that this vlan resource is bound to.
Correct format example is:
[{name => '1.1', tagged => true}, {name => '2.1', tagged => true}]
Sets the self IP address on the BIG-IP system that you associate with a VLAN, to access hosts in that VLAN. By virtue of its netmask, a self IP address represents an address space; that is, a range of IP addresses spanning the hosts in the VLAN, rather than a single host address. You can associate self IP addresses not only with VLANs, but also with VLAN groups
Specifies the name of the selfip to manage.
Valid options: a string.
Specify either an IPv4 or an IPv6 address. For an IPv4 address, you must specify a /32 IP address per RFC 3021 and a CIDR range. EG 9.9.9.9/255
Valid options: ip/cidr
Specifies the VLAN associated with this self IP address.
Valid options: string
Specifies the traffic group to associate with the self IP. You can click the box to have the self IP inherit the traffic group from the root folder, or clear the box to select a specific traffic group for the self IP.
Valid options: string
Whether to inherit the traffic group from the current partition or path.
Valid options: true, false.
Specifies the protocols and services from which this self IP can accept traffic. Note that fewer active protocols enhances the security level of the self IP and its associated VLANs. Accepts an array of: 'default', 'all', protocol:port (for example, ["TCP:80", "UDP:55"]). Options behave as follows:
protocol:port: the protocols and ports to activate on this self IP.default: Activates only the default protocols and services. You can determine the supported protocols and services by running the tmsh list net self-allow defaults command on the command line. May be combined with further protocol:port values.all: Activates all TCP and UDP services on this self IP. May not be combined with any other value.none: Specifies that this self IP accepts no traffic. May not be combined with any other values.
Manages system DNS settings on the F5 device. See F5 documentation to learn more about F5 DNS. f5_dns has no ensure => absent functionality.
Specifies the name of the DNS resource to manage.
Valid options: a string.
Sets the description of the DNS.
Valid options: a string.
Specifies the name servers that the system uses to validate DNS lookups, and resolve host names.
Correct format example is: ["4.2.2.2", "8.8.8.8”]
Specifies the domains that the system searches for local domain lookups, to resolve local host names.
Correct format example is: ["localhost","f5.local”]
f5_dns { '/Common/dns':
name_servers => ["4.2.2.2", "8.8.8.8"],
search => ["localhost","f5.local"],
}Manages system NTP settings on the F5 device. See F5 documentation to learn more about F5 DNS.
Specifies the name of the NTP resource to manage.
Valid options: a string.
Sets the description of the NTP.
Valid options: a string.
Specifies the time servers that the system uses to update the system time
Correct format example is: ['0.pool.ntp.org', '1.pool.ntp.org']
Specifies the timezone
f5_ntp { '/Common/ntp':
servers => ['0.pool.ntp.org', '1.pool.ntp.org'],
timezone => 'UTC',
}Manages system global settings on the F5 device. See F5 documentation to learn more about F5 global setting. f5_globalsetting has no ensure => absent functionality.
Specifies the name of the global setting resource to manage.
Valid options: a string.
Sets the description of the global setting.
Valid options: a string.
Specifies a local name for the system.
The default value is bigip1.
Enables or disables the Setup utility in the browser-based Configuration utility.
The default value is enabled.
f5_globalsetting { '/Common/globalsetting':
hostname => "bigip-a.f5.local",
gui_setup => "disabled",
}Manages the user account on the F5 device. See F5 documentation to learn more about F5 user account.
Specifies the name of the user account to manage.
$name is mandatory for all users in the format of my_user. Without $name specification, the $name defaults to the value of $title, which is in the format of /Partition/title, such as /Common/my_user.
Valid options: a string.
Sets the description of the user account.
Valid options: a string.
Determines whether the user resource is present or absent.
Valid options: 'present' or 'absent'.
Set the user password during creation or modification without prompting or confirmation.
f5_user { '/Common/joe':
name => 'joe',
ensure => 'present',
password => 'joe',
} f5_user { '/Common/joe':
name => 'joe',
ensure => 'absent',
}Configure route on the Big-IP system. See F5 documentation to learn more about F5 Configuring Routes.
Specifies the identifier that, when appended to BIG-IP system addresses, indicates the specific route domain in the partition to which the address applies.
Valid options: a string.
Specifies descriptive text that identifies the route.
Valid options: a string.
Specifies a gateway address for the route.
Valid options: IPv4 or IPv6 addresses.
Sets a specific maximum transmission unit (MTU).
Valid options: 0 - 65535.
The destination subnet and netmask for the route.
Valid options: IP address followed by netmask.
Specifies a gateway pool, which allows multiple, load-balanced gateways to be used for the route.
Valid options: a string.
Specifies a VLAN for the route. This can be a VLAN or VLAN group.
Valid options: a string.
f5_route { '/Common/Default':
ensure => 'present',
gw => "10.1.20.253",
mtu => '0',
network => "0.0.0.0/0",
} f5_route { '/Common/Default':
ensure => 'absent',Changes the password of the root user on the Big-IP system. The root user can be used for SSH to obtain remote access to the device. A root user can not send REST requests it is not a REST Framework user. f5_root has no ensure => absent functionality.
Specifies the name of the root user to manage.
Valid options: a string.
Sets the description of the root user.
Valid options: a string.
The root user’s old password.
Valid options: a string.
The root user’s new password.
Valid options: a string.
f5_root { '/Common/root':
old_password => 'default',
new_password => 'default',
}Manage license installation and activation on BIG-IP devices. f5_license has no ensure => absent functionality
Specifies the name.
Valid options: a string.
Sets the description.
Valid options: a string.
The registration key to use to license the BIG-IP.
f5_license { '/Common/license':
registration_key => "GKWPN-NDMLV-CXSTE-NWDEX-PCFPTLV"
}Change device name from default bigip1 under 'Device Management > Devices'. This is achieved by using tmsh mvcommand, and hence has no ensure => absent functionality.
NOTE: This does not impact the hostname
Specifies the name of device name to manage.
Valid options: a string.
Sets the description of device name.
Valid options: a string
Specifies the target device name.
Valid options: a string
rename the self device:
f5_selfdevice { '/Common/bigip-a.f5.local':
target =>"bigip-a.f5.local",
}reset the device name:
f5_selfdevice { '/Common/bigip1':
target =>"bigip1",
}Manages device IP configuration settings for HA on a BIG-IP. Each BIG-IP device has synchronization and failover connectivity information (IP addresses) that you define as part of HA pairing or clustering. This module allows you to configure that information.
Specifies the name of the device to manage
Valid options: a string.
Sets the description of the device IP configuration settings
Valid options: a string.
Local IP address that the system uses for ConfigSync operations.
Specifies the primary IP address for the system to use to mirror connections.
f5_device{ '/Common/bigip-a.f5.local':
ensure => 'present',
configsync_ip => '10.1.30.1',
mirror_ip => '10.1.30.1',
}Manage the trust relationships between BIG-IPs. In this task we will add BIG-IP-B as a trusted peer of BIG-IP-A. This is achieved by using tmsh command, and hence has no ensure => absent functionality.
Specifies the name
Valid options: a string.
Sets the description.
Valid options: a string.
Specify the FQDN or management-ip of the new device.
Specify the name of the peer device to add.
Specify the username when adding the new device.
Specify the password when adding the new device.
f5_addtotrust { '/Common/addtotrust':
device => "10.192.74.112",
device_name => "bigip-b.f5.local",
username => "admin",
password => "admin",
}Manage device groups on a BIG-IP. Managing device groups allows you to create HA pairs and clusters of BIG-IP devices.
Specifies the name of device group to manage.
Valid options: a string.
Sets the description of the device group.
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies if the device-group will be used for failover or resource syncing
Valid options: a string.
Specifies if the device-group will automatically sync configuration data to its members
Valid options: a string.
An array of devices to be added to the device group.
f5_devicegroup{ '/Common/DeviceGroup1':
ensure => 'present',
type => 'sync-failover',
auto_sync => 'enabled',
devices => [ "bigip-a.f5.local","bigip-b.f5.local" ],
} f5_devicegroup{ '/Common/DeviceGroup1':
ensure => 'absent',
}Perform initial sync of the Device Group. This is achieved by using tmsh run command, and hence has no ensure => absent functionality.
Specifies the name.
Valid options: a string.
Sets the description.
Valid options: a string.
Specifies the 'to-group' device group to run a config-sync
f5_configsync { '/Common/config-sync':
to_group => "DeviceGroup1",
}Sends an arbitrary command to an BIG-IP node. TMSH command has no ensure => absent functionality.It provides a way to execute native tmsh or bash commands ( using the REST API (/mgmt/tm/util/bash)
Specifies the name.
Valid options: a string.
Sets the description.
Valid options: a string.
Specifies the command to send to the remote BIG-IP device over the configured provider
f5_command { '/Common/tmsh':
tmsh => "tmsh create ltm node 2.2.2.2",
}Manage Virtual server Cookie persistence profile
Specifies the name of Cookie persistence profile to manage.
Valid options: a string.
Sets the description of the Cookie persistence profile.
Valid options: a string.
Determines whether the Cookie persistence profile resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies the type of cookie processing that the system uses. The default value is insert.
Valid options: 'insert', 'passive', 'rewrite'
Specifies a unique name for the profile.
Valid options: a string.
Specifies whether the httponly attribute should be enabled or disabled for the inserted cookies. The default value is enabled.
Valid options: 'enabled', 'disabled'
Specifies whether the secure attribute should be enabled or disabled for the inserted cookies
Valid options: 'enabled', 'disabled'
Specifies, when enabled, that the cookie persistence entry will be sent to the client on every response, rather than only on the first response.
Valid options: 'enabled', 'disabled'
Specifies the cookie expiration date in the format d:h:m:s, h:m:s, m:s or seconds. Hours 0-23, minutes 0-59, seconds 0-59. The time period must be less than 24856 days. You can use "session-cookie" (0 seconds) to indicate that the cookie expires when the browser closes.
Specifies the way in which cookie format will be used: "disabled": generate old format,unencrypted, "preferred": generate encrypted cookie but accept both encrypted and old format, and "required": cookie format must be encrypted. Default is required.
Valid options: 'enabled', 'disabled'
f5_persistencecookie { '/Common/cookie1':
ensure => 'present',
method => 'insert',
cookie_name => 'name1',
httponly => 'enabled',
secure => 'enabled',
always_send => 'disabled',
expiration => '0',
cookie_encryption => 'disabled',
} f5_persistencecookie { '/Common/cookie1':
ensure => 'absent',
}Manage Virtual server Destination Address Affinity persistence profile on a BIG-IP
Specifies the name of Destination Address Affinity persistence profile to manage
Valid options: a string.
Sets the description of the Destination Address Affinity persistence profile
Valid options: a string.
Determines whether the persistence profile resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies, when enabled, that the system can use any pool that contains this persistence record. The default value is disabled.
Valid options: 'enabled', 'disabled'
Specifies, when enabled, that all persistent connections from a client IP address, which go to the same virtual IP address, also go to the same node. The default value is disabled.
Valid options: 'enabled', 'disabled'
Specifies, when enabled, that all persistent connections from the same client IP address go to the same node. The default value is disabled.
Valid options: 'enabled', 'disabled'
Specifies whether the system uses the hash algorithm defined by the Cache Array Routing Protocol (CARP) to select a pool member.
Valid options: default, 'carp'.
Specifies an IP mask. This is the mask used by simple persistence for connections.
Valid options: Netmask
Specifies the duration of the persistence entries. The default value is 180 seconds.
Valid options: an integer.
Specifies, when enabled, that the pool member connection limits are not enforced for persisted clients. Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
Valid options: 'enabled', 'disabled'
f5_persistencedestaddr { '/Common/dest_addr1':
ensure => 'present',
match_across_pools => 'enabled',
match_across_services => 'enabled',
match_across_virtuals => 'enabled',
hash_algorithm => 'carp',
mask => '255.255.0.0',
timeout => '180',
override_connection_limit => 'enabled',
} f5_persistencedestaddr { '/Common/dest_addr1':
ensure => 'absent',
}Manage device groups on a BIG-IP. Managing device groups allows you to create HA pairs and clusters of BIG-IP devices.
Specifies the name of device group to manage.
Valid options: a string.
Sets the description of the device group.
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies if the device-group will be used for failover or resource syncing
Valid options: a string.
Specifies if the device-group will automatically sync configuration data to its members
Valid options: a string.
An array of devices to be added to the device group.
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'present', type => 'sync-failover', auto_sync => 'enabled', devices => [ "bigip-a.f5.local","bigip-b.f5.local" ], } ~
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'absent', } ~
Manage device groups on a BIG-IP. Managing device groups allows you to create HA pairs and clusters of BIG-IP devices.
Specifies the name of device group to manage.
Valid options: a string.
Sets the description of the device group.
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies if the device-group will be used for failover or resource syncing
Valid options: a string.
Specifies if the device-group will automatically sync configuration data to its members
Valid options: a string.
An array of devices to be added to the device group.
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'present', type => 'sync-failover', auto_sync => 'enabled', devices => [ "bigip-a.f5.local","bigip-b.f5.local" ], } ~
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'absent', } ~
Manage device groups on a BIG-IP. Managing device groups allows you to create HA pairs and clusters of BIG-IP devices.
Specifies the name of device group to manage.
Valid options: a string.
Sets the description of the device group.
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies if the device-group will be used for failover or resource syncing
Valid options: a string.
Specifies if the device-group will automatically sync configuration data to its members
Valid options: a string.
An array of devices to be added to the device group.
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'present', type => 'sync-failover', auto_sync => 'enabled', devices => [ "bigip-a.f5.local","bigip-b.f5.local" ], } ~
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'absent', } ~
Manage device groups on a BIG-IP. Managing device groups allows you to create HA pairs and clusters of BIG-IP devices.
Specifies the name of device group to manage.
Valid options: a string.
Sets the description of the device group.
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies if the device-group will be used for failover or resource syncing
Valid options: a string.
Specifies if the device-group will automatically sync configuration data to its members
Valid options: a string.
An array of devices to be added to the device group.
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'present', type => 'sync-failover', auto_sync => 'enabled', devices => [ "bigip-a.f5.local","bigip-b.f5.local" ], } ~
~puppet f5_devicegroup{ '/Common/DeviceGroup1': ensure => 'absent', } ~
Manage Virtual server HTTP traffic profile
Specifies the name of HTTP traffic profile to manage.
Valid options: a string.
Sets the description of the HTTP traffic profile
Valid options: a string.
Determines whether the HTTP traffic profile resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies an HTTP fallback host. HTTP redirection allows you to redirect HTTP traffic to another protocol identifier, host name, port number, or URI path. For example, if all members of the targeted pool are unavailable (that is, the members are disabled, marked as down, or have exceeded their connection limit), the system can redirect the HTTP request to the fallback host, with the HTTP reply Status Code 302 Found.
Valid options: a string.
Specifies one or more three-digit status codes that can be returned by an HTTP server.
Valid options: a string.
f5_profilehttp { '/Common/http-profile_1':
ensure => 'present',
fallback_host => "redirector.siterequest.com",
fallback_status_codes => ['500'],
} f5_profilehttp { '/Common/http-profile_1':
ensure => 'absent',
}Manage Virtual server client-side proxy SSL profile
Specifies the name of client-side proxy SSL profile to manage.
Valid options: a string.
Sets the description of the client-side proxy SSL profile
Valid options: a string.
Determines whether the client-side proxy SSL profile resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies the name of the certificate installed on the traffic management system for the purpose of terminating or initiating an SSL connection.
Valid options: a string.
Specifies the name of a key file that you generated and installed on the system. The default key name is default.key.
Valid options: a string.
Enables proxy SSL mode, which requires a corresponding server SSL profile with proxy-ssl enabled to allow for modification of application data within an SSL tunnel.o
Valid options: 'enabled', 'disabled'
Enables proxy SSL passthrough mode, which requires a corresponding server SSL profile with proxy-ssl-passthrough enabled to allow for modification of application data within an SSL tunnel.
Valid options: 'enabled', 'disabled'
f5_profileclientssl {'/Common/clientssl-profile1':
ensure => 'present',
cert =>"/Common/default.crt",
key =>"/Common/default.key",
proxy_ssl => 'enabled',
proxy_ssl_passthrough => 'enabled',
} f5_profileclientssl {'/Common/clientssl-profile1':
ensure => 'absent',
}Manage Virtual server server-side proxy SSL profile
Specifies the name of Virtual server server-side proxy SSL profile to manage.
Valid options: a string.
Sets the description of the Virtual server server-side proxy SSL profile
Valid options: a string.
Determines whether the Virtual server server-side proxy SSL profile resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies the name of the certificate installed on the traffic management system for the purpose of terminating or initiating an SSL connection. The default value is none.
Valid options: a string.
Specifies the name of the key installed on the traffic management system for the purpose of terminating or initiating an SSL connection. The default value is none.
Valid options: a string.
Enables proxy SSL mode, which requires a corresponding client SSL profile with proxy-ssl enabled to allow for modification of application data within an SSL tunnel.
Valid options: 'enabled', 'disabled'
Enables proxy SSL passthrough mode, which requires a corresponding client SSL profile with proxy-ssl-passthrough enabled to allow for modification of application data within an SSL tunnel.
Valid options: 'enabled', 'disabled'
f5_profileserverssl {'/Common/serverssl-profile1':
ensure => 'present',
cert =>"/Common/default.crt",
key =>"/Common/default.key",
proxy_ssl => 'enabled',
proxy_ssl_passthrough => 'enabled',
} f5_profileserverssl {'/Common/serverssl-profile1':
ensure => 'absent',
}Import SSL keys from BIG-IP. This is achieved by using tmsh mvcommand, and hence has no ensure => absent functionality.
Specifies the name of SSL key to manage.
Valid options: a string.
Sets the description of the SSL key.
Valid options: a string.
Specifies name of the key
Valid options: a string.
Specifies the exiting key file with full path that the system extracts the key text from.
Valid options: a string.
f5_sslkey { '/Common/sslkey':
keyname => "test",
from_local_file => "/var/tmp/test.key",
}Import SSL certificate from BIG-IP. This is achieved by using tmsh mvcommand, and hence has no ensure => absent functionality.
Specifies the name of SSL certificate to manage.
Valid options: a string.
Sets the description of the SSL certificate.
Valid options: a string.
Specifies the name of the certificate
Valid options: a string.
Specifies the exiting certificate file with full path that the system extracts the certificate text from.
Valid options: a string.
f5_sslcertificate { '/Common/sslcertificate':
certificate_name => "test",
from_local_file => "/var/tmp/test.crt",
}Manage Secure network address translation (SNAT)
Specifies the name of SNAT
Valid options: a string.
Sets the description of the SNAT.
Valid options: a string.
Determines whether the SNAT resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies the name of a SNAT pool. You can only use this option when automap and translation are not used.
Valid options: a string.
Specifies, for each SNAT that you create, the origin addresses that are to be members of that SNAT.
Valid options: an array
f5_snat { '/Common/snat_list1':
ensure => 'present',
snatpool => ['/Common/snat_pool1'],
origins => [{"name"=>"10.0.0.0/8"}],
} f5_snatpool { '/Common/snat_pool1':
ensure => 'absent',
} Manage SNAT pools on a BIG-IP
Specifies the name of the SNAT pool member.
Valid options: a string.
Sets the description of the SNAT pool.
Valid options: a string.
Determines whether the SNAT pool resource is present or absent.
Valid options: 'present' or 'absent'.
An array of SNAT pool members that belong to this SNAT pool.
f5_snatpool { '/Common/snat_pool1':
ensure => 'present',
members => ["/Common/1.1.1.1", "/Common/1.1.1.2", "/Common/1.1.1.3"],
} f5_snatpool { '/Common/snat_pool1':
ensure => 'absent',
}Manage Internal data group
Specifies the name of Internal data group to manage.
Valid options: a string.
Sets the description of the Internal data group
Valid options: a string.
Determines whether the Internal data group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies the type of data group.
Valid options: 'ip','string', 'integer'
Specifies an IP address, or string of the string record, or integer value for the integer record to add to the data group.
f5_datagroup { '/Common/datagroup1':
ensure => 'present',
type => 'ip',
records => [{'data' => '', 'name' => '64.12.96.0/19'}, {'data' => '', 'name' => '195.93.16.0/20'}],
}
f5_datagroup { '/Common/datagroup2':
ensure => 'present',
type => 'string',
records => [{'data' => '', 'name' => '.gif'}, {'data' => '', 'name' => '.jpg'}],
}
f5_datagroup { '/Common/datagroup3':
ensure => 'present',
type => 'integer',
records => [{'data' => '', 'name' => '1'}, {'data' => '', 'name' => '2'}],
} f5_datagroup { '/Common/datagroup1':
ensure => 'absent',
}
f5_datagroup { '/Common/datagroup2':
ensure => 'absent',
}
f5_datagroup { '/Common/datagroup3':
ensure => 'absent',
} Manage External data group
Specifies the name of External data group to manage.
Valid options: a string.
Sets the description of the External data group
Valid options: a string.
Determines whether the device group resource is present or absent.
Valid options: 'present' or 'absent'.
Specifies an external data group file.
Valid options: a string.
f5_datagroupexternal { '/Common/datagroupext1':
ensure => 'present',
external_file_name => '/Common/add_dg1',
} f5_datagroupexternal { '/Common/datagroupext1':
ensure => 'absent',
}F5 version v12.1 or greater. Puppet Enterprise: 2016.4.x or greater.
Puppet modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. Please follow our guidelines when contributing changes. For more information, see our module contribution guide.
Support for this module is provided by F5. To file an issue, please visit this link