How to: Provision BIG-IP Next instance licenses from BIG-IP Next Central Manager

Overview

Use these procedures to provision licenses for BIG-IP Next instances from BIG-IP Next Central Manager when it is in connected or disconnected mode.

Provision licenses for BIG-IP Next Instances in Connected Mode

Central Manager GUI

Prerequisite

By default, the BIG-IP Next Central Manager licensing mode is in a connected state. If it’s not, see How to: Switch the BIG-IP Next Central Manager mode between connected and disconnected to change the licensing mode of the CM to connected state.

Use this procedure to provision single or multiple licenses for BIG-IP Next instances from BIG-IP Next Central Manager when it is in connected mode.

1. Log in to BIG-IP Next Central Manager.

2. Click the Workspace icon next to the F5 logo and then click Infrastructure.

3. Select the name of the BIG-IP Next instance you want to provision the license.

4. In License & Provision section, select Provision.

5. Click the toggle of the module which you want to disable and click Yes, Disable to disable instance’s module feature.
   The respective module feature is disabled on the selected instance.

Central Manager API

For a full list of API endpoints for licenses, see Licenses in the OpenAPI documentation.

Prerequisite

By default, the BIG-IP Next Central Manager licensing mode is in a connected state. If it’s not, see Central Manager API tab in How to: Switch the BIG-IP Next Central Manager mode between connected and disconnected to change the licensing mode of the CM to connected state.

Use the following APIs to provision single or multiple licenses for BIG-IP Next instances in CM connected mode.

1. Verify the validity of JWT by sending the POST request to spaces/default/license/tokens/verify endpoint.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens/verify
   

   For the request payload, use the following example, modifying the values as required.

   {
   "jwt": "{{jwt}}"
   }
   

   For more information about verifiying the validity of JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

2. Add the JSON Web Token (JWT) by sending the POST request to spaces/default/license/tokens endpoint.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens
   

   For the request payload, use the following example, modifying the values as required.
   In JWT field, paste the jwt you received from your F5 representative.

   {
   "nickName": "prod-jwt-1",
   "jwt": "{{jwt}}"
   }
   

   For more information about adding the JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

3. Get the list of the JWTs with their IDs by sending the GET request to spaces/default/license/tokens endpoint. Identify the ID of the JWT from the response.

   GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens
   

   For more information about retrieving the list of JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

4. Get the list of all devices by sending the GET request to spaces/default/instances endpoint. Identify the ID of the device which you want to provision the license.

   GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances
   

5. Check the provisioning status of the respective modules by sending the GET request to device/v1/proxy/{{device_id}}?path=/services?include=provisioning endpoint. In response, copy the module features of the instances in the provisioning section.

   GET https://{{cm_mgmt_ip}}/api/device/v1/proxy/{{device_id}}?path=/services?include=provisioning
   

   Click for sample response (shortened) ▶

   "id": "cf42d962-4082-4d7d-a820-d6caf7234744" ,
   "name": "Default Service",
   "provisioning": {
       "_links": {
           "self": "/services/cf42d962-4082-4d7d-a820-d6caf7234744/provisioning"
       },
       "access": {
           "state": "nominal"
       },
       "accessZtna": {
           "state": "disabled"
       },
       "dns": {
           "state": "disabled"
       },
       "dnsVE": {
           "state": "disabled"
       },
       "efwAc1": {
           "state": "disabled"
       },
       "efwCGnat": {
           "state": "disabled"
       },
       "efwIpi": {
           "state": "disabled"
       },
       "efwIps": {
           "state": "disabled"
       }
       "ltm": {
           "state": "disabled"
       },
       "sslo": {
           "state": "disabled"
       },
       "waf": {
           "state": "disabled"
       }
   }
   

6. Provision the license by sending the POST request to /v1/spaces/default/instances/{{device_id}}/module-provision endpoint. In the request body, paste the copied content from the previous response. Identify the task_id from the response to know the provisioning task status.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/{{device_id}}/module-provision
   

   For the request payload, use the following example, modifying the values as required. Modify the state of the respective module to either nominal or disable based on your requirement.

   {
     "access": {
             "state": "nominal"
         },
         "accessZtna": {
             "state": "disabled"
         },
         "dns": {
             "state": "disabled"
         },
         "dnsVE": {
             "state": "disabled"
         },
         "efwAc1": {
             "state": "disabled"
         },
         "efwCGnat": {
             "state": "disabled"
         },
         "efwIpi": {
             "state": "disabled"
         },
         "efwIps": {
             "state": "disabled"
         }
         "ltm": {
             "state": "disabled"
         },
         "sslo": {
             "state": "disabled"
         },
         "waf": {
             "state": "disabled"
         }
   }
   

   For more information about provisioning the modules using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

7. Check the provisioning task status by sending the GET request to /spaces/default/instances/module-provision-tasks/{{task_Id}} endpoint. Modify the task_id with the task ID copied from the previous request response. Check the status in the response, until it changes from running to completed.

GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/module-provision-tasks/{{task_Id}}

For more information about provisioning task status using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

10. Repeat step 7 to know the provisioning status of the modules you modified.

11. Get the license task status by sending the GET request to /spaces/default/license/tasks/{task_id} endpoint modifying the value of the task_id with the ID of the task.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tasks/{task_id}
    

    For more information about license task status using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

12. Get the license details of the device by sending the GET request to /spaces/default/instances/license/license-info/{device_id} endpoint modifying the value of digital-asset-id with the ID of the device.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/license/license-info/{device_id}
    

    For more information about license activation status of the device by using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

Provision licenses for BIG-IP Next Instances in Disconnected Mode

Central Manager GUI and Postman

Prerequisite

By default, the BIG-IP Next Central Manager licensing mode is in a connected state. To change the licensing mode of the CM to disconnected state, see How to: Switch the BIG-IP Next Central Manager mode between connected and disconnected.

Note: These steps involve switching alternatively between using the GUI of the BIG-IP Next Central Manager and selecting API requests in the Postman application.

1. Download the Postman collection.

   1. Log in to the BIG-IP Next Central Manager.

   2. Once you log in, you’ll see the Maintenance tab in the left pane, indicating that the Central Manager is in disconnected mode.

   3. Click the Workspace icon next to the F5 logo and then click Infrastructure.

   4. Select the name of the BIG-IP Next instance you want to provision the license.

   5. In License & Provision section, select Provision.

   6. Click the toggle of the module which you want to disable and click Yes, Disable to disable instance’s module feature.
      The Provisioning report is generated for the selected instance.

   7. Go to Infrastructure > Instances > Maintenance, and select Download to download the report.

2. Download the Postman collection.

3. Unzip the downloaded postman collection zip file to access the Getting Started - BIG-IP Next.postman_collection.json and Env. Getting Started - BIG-IP Next.postman_environment.json files.

4. Open Postman application (Procedural steps related to APIs):
   

   1. Log in to the Postman application.

   2. From the left side bar, select Collections and import Getting Started - BIG-IP Next.postman_collection.json.

   3. Select Environments and import Env. Getting Started - BIG-IP Next.postman_environment.json.

   4. Select the imported environment, and in the bigip_next_cm_mgmt_ip field, enter your Central Manager IP address in the Current value column.

   5. In the JWT_license field, enter the JSON Web Token (JWT) in the Current value column which you received from your F5 representative or downloaded from my F5.

   6. Select Collections and click Getting Started – BIG IP Next collection.

   7. Select Disconnected Licensing folder, click Login to Central Manager API and then click Send to login to BIG-IP Next Central Manager.

   8. Click Upload Bulk Reports to license server API, and click Body.

   9. In the File field, upload the downloaded license report zip file in the Value column and click Send.

   10. Click Get Status of Bulk Reports from license server API, click Send and wait until you see the Download ready status in the response.

   11. Click Download Signed Bulk Reports from license server API and from the Send dropdown, select Send and Download to download the ACK (Acknowledgement) file.

5. Open BIG-IP Next Central Manager GUI to perform the following steps:
   

   1. From the Central Manager Maintenance tab, select Upload to upload the ACK file and select Verify.

   2. After successful verification of the ACK file, the instance is provisioned, and the instance disappears from the Maintenance tab.

Central Manager API

For a full list of API endpoints for licenses, see Licenses in the OpenAPI documentation.

Prerequisite

• Make sure jq is installed in your system.

• By default, the BIG-IP Next Central Manager licensing mode is in a connected state. To change the licensing mode of the CM to disconnected state, see Central Manager API tab in How to: Switch the BIG-IP Next Central Manager mode between connected and disconnected.

Use the following APIs to provision single or multiple licenses for BIG-IP Next instances in CM connected mode.

1. Verify the validity of JWT by sending the POST request to spaces/default/license/tokens/verify endpoint.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens/verify
   

   For the request payload, use the following example, modifying the values as required.

   {
   "jwt": "{{jwt}}"
   }
   

   For more information about verifiying the validity of JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

2. Add the JSON Web Token (JWT) by sending the POST request to spaces/default/license/tokens endpoint.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens
   

   For the request payload, use the following example, modifying the values as required.
   In JWT field, paste the jwt you received from your F5 representative.

   {
   "nickName": "prod-jwt-1",
   "jwt": "{{jwt}}"
   }
   

   For more information about adding the JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

3. Get the list of the JWTs with their IDs by sending the GET request to spaces/default/license/tokens endpoint. Identify the ID of the JWT from the response.

   GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tokens
   

   For more information about retrieving the list of JWTs using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

4. Get the list of all devices with IDs by sending the GET request to /device/v1/inventory endpoint. Identify the ID of the device which you want to provision the license.

   GET https://{{cm_mgmt_ip}}/api/device/v1/inventory
   

5. Check the provisioning status of the respective modules by sending the GET request to device/v1/proxy/{{device_id}}?path=/services?include=provisioning endpoint. In response, copy the module features of the instances in the provisioning section.

   GET https://{{cm_mgmt_ip}}/api/device/v1/proxy/{{device_id}}?path=/services?include=provisioning
   

   Click for sample response (shortened) ▶

   "id": "cf42d962-4082-4d7d-a820-d6caf7234744" ,
   "name": "Default Service",
   "provisioning": {
       "_links": {
           "self": "/services/cf42d962-4082-4d7d-a820-d6caf7234744/provisioning"
       },
       "access": {
           "state": "nominal"
       },
       "accessZtna": {
           "state": "disabled"
       },
       "dns": {
           "state": "disabled"
       },
       "dnsVE": {
           "state": "disabled"
       },
       "efwAc1": {
           "state": "disabled"
       },
       "efwCGnat": {
           "state": "disabled"
       },
       "efwIpi": {
           "state": "disabled"
       },
       "efwIps": {
           "state": "disabled"
       }
       "ltm": {
           "state": "disabled"
       },
       "sslo": {
           "state": "disabled"
       },
       "waf": {
           "state": "disabled"
       }
   }
   

6. Provision the license by sending the POST request to /v1/spaces/default/instances/{{device_id}}/module-provision endpoint. In the request body, paste the copied content from the previous response. Identify the task_id from the response to know the provisioning task status.

   POST https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/{{device_id}}/module-provision
   

   For the request payload, use the following example, modifying the values as required. Modify the state of the respective module to either nominal or disable based on your requirement.

   {
     "access": {
             "state": "nominal"
         },
         "accessZtna": {
             "state": "disabled"
         },
         "dns": {
             "state": "disabled"
         },
         "dnsVE": {
             "state": "disabled"
         },
         "efwAc1": {
             "state": "disabled"
         },
         "efwCGnat": {
             "state": "disabled"
         },
         "efwIpi": {
             "state": "disabled"
         },
         "efwIps": {
             "state": "disabled"
         }
         "ltm": {
             "state": "disabled"
         },
         "sslo": {
             "state": "disabled"
         },
         "waf": {
             "state": "disabled"
         }
   }
   

   For more information about provisioning the modules using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

7. Check the provisioning task status by sending the GET request to /spaces/default/instances/module-provision-tasks/{{task_Id}} endpoint. Modify the task_id with the task ID copied from the previous request response. Check the status in the response, until it changes from running to completed.

GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/module-provision-tasks/{{task_Id}}

For more information about provisioning task status using BIG-IP Next Central Manager APIs, see OpenAPI Documentation. 10. Repeat step 7 to know the provisioning status of the modules you modified.

11. Get the license task status by sending the GET request to spaces/default/license/tasks/{task_id} endpoint modifying the value of the task_id with the ID of the task.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/license/tasks/{task_id}
    

    For more information about license task status using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

12. Get the license details of the device by sending the GET request to spaces/default/instances/license/license-info/{device_id} endpoint modifying the value of device_id with the ID of the device.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/license/license-info/{device_id}
    

    For more information about license activation status of the device by using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

13. To download the configuration report,
    a. Send a GET request to spaces/default/instances/license/report endpoint and copy the data from reportData in the response.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/license/report
    

    Sample response

    "reportData": "JEsDBBQACAAIAAhSOVgAAAAAAAAAAAAAAAAcAAkAcmVwb3J0XzE3MTg2MTkzNzY@NDAxNjcuanNvbIVUBQAB8AxwZmyUX50iPBbGv4vX41QS/NPMna2CyQqWCAnJ116QQI9AYrMjCri13/2t4HS/
    01XvLOnn0c8vzzn//t9EZe3kx80L8VSq7A0t30XUBZkznRWZnGZQOVOwnDuL2dtL8aKcybdJXtxLVeB88mMC105ECKrpEhZo0pNATV2F104zIuXN0c6hZxNvk1+Fc37L6tSD0QsfVUeSoKTB4Zhia/
    4Es3VG¡9w3aR®TdzvxUA6nuqrRF6Nq2aJXTnDm®Fmw0605042ct9p9+XF4TQTrtWQUqEtd7tekliiEktFb7gmtLmEj@aw81LjHZVcKX1
    +yNDrLrfdQiIIT09zR1TbOWdbyEtYiliYfRyVAeLtIdYmGEAvNqQOYlEeNgQMNsmok7G8yX3vekzDh®ijA2d04+q9PNZ6t®/08Z/0qKGDQvouS+uBkGiA)FmvhmA9e+yr1c+gnIGwSm7ByYIhwvnukG/
    nZ8kSC21951R7oqtWbFYwsD1V2zb0gy4cABBsC/dx3QUxbsPHCvJYodAPHmG8cmwvytB00uRvhkbfs jRq00ubwoyeqjwNgURQK/06SEc0wqf1kxHZCib00esB9emNszmwNaVDapGSpEh£R
    +8¡FWe5×1dstVD4T3₫Wq®gVv1hw7vgw{vDu¡s11g+REsTTqJFoHue+N+Re1D×94¡HYYLCPV2g£b×26WcFD1TwOFZAxGxjjgRITceyJh719¡8/tDBFe6C6tgGG94GcZ4Em2QRxsE¡qM72
    +B5sfuam12IrNE8jqAx94KqRxUCMYB7IU6[j05/FYPmQRiDdpagHkqtRBGU/sjp8y413jVn9NM/N+5d+vQsxz4/Nag0{SOZBsKyN0Isd6H+s07i08Ge5z6tcfXef9FIQy3WeBGsu1IYes53dBCUaMm8xubIfs
    +Z213bwzIYh4reJY20MvDJ9uN/NgdZG10Fi/yP+r9noHw79cs/eval712enmyGX99y5JkUwbvYas4ffHH00uhoNFc+wN0S4ncq2DebWT+2T09SV÷3WRqNfoTxIgolf9Y5ipTY8yenavuFoU[im
    +4LNONbzvTt93coEUxsDdu31f7k0kPAUwJ+39PyEjW5/yUHxPaES+Kmp67M£XoVD0p8R+aJoZXNuRrwgjnXctw1Rlex8Z6Z+8iJIyq1049xLphbC2rfmdpczJ5sx30NB5/
    ZXItUNByNmbKzdst9bTJGh5E7omde8T6s6jbcJPPwBECI+GMf/+wPsd0BUSX8yIQomHEWV£gC8/2a3JVPh3GuT07Ji2iUcW/jP1zjhd2t0veAM042Kxeh8QW6b8fvq2m8botrdqf/+q/
    Lmp9w0qz41virxzqH2a8NX1TLMzhU1/R18v/1/BUAAP//
    UESHCDUQejEHBAAAOQYAAFBLAQIUABQACAAIAAhSOVg7kHoxBwQAADkGAAAcAAkAAAAAAAAAAAAAAAAAAAByZXBvcnRfMTcxODYx0TM3NjQOMDE2Ny5qc29VVQFAAHwDHBmUEsFBgAAAAABAAEAUWAAAFoEAAAAAA=="
    "reportDownloadStatus": [
    ｛
    

    b. In the following command, replace the report_data with the data copied from reportData and then run the command. The configuration report (downloaded_file.zip) will be downloaded in your system.

    echo report_data | base64 --decode > downloaded_file.zip
    

14. Upload the downloaded configuration report by sending the POST request to ee/v1/entitlements/telemetry/bulk endpoint.
    In the request payload, in the File field, upload the zip file of the downloaded configuration report to the Value column.

    POST https://product.apis.f5.com/ee/v1/entitlements/telemetry/bulk
    

    Note: To authorize acccess to https://product.apis.f5.com, include the BIG-IP Next license JWT as the Authorization bearer token in the header.

15. Check the status of uploaded configuration report by sending the GET request to {{license_status_link}} endpoint.
    You will see the Download ready status in the response.

    GET https://product.apis.f5.com{{license_status_link}}
    

    Note: To authorize acccess to https://product.apis.f5.com, include the BIG-IP Next license JWT as the Authorization bearer token in the header.

16. Download the Acknowledgement (ACK) file by sending the GET request to {{license_download_link}} endpoint.
    From the Send dropdown, select Send and Download to download the ACK file.

    GET https://product.apis.f5.com{{license_download_link}}
    

    Note: To authorize acccess to https://product.apis.f5.com, include the BIG-IP Next license JWT as the Authorization bearer token in the header.

17. Upload the downloaded ACK file by sending the PUT request to spaces/default/instances/license/report endpoint.
    In the request payload, in the fileList field, upload the downloaded ACK zip file to the Value column.

    PUT https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/license/report
    

    For more information about uploading ACK report using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.

18. Get the license status of the device by sending the GET request to spaces/default/instances/license/license-info/{device_id} endpoint modifying the value of device_id with the ID of the device.

    GET https://{{cm_mgmt_ip}}/api/v1/spaces/default/instances/license/license-info/{device_id}
    

    For more information about license activation status of the device by using BIG-IP Next Central Manager APIs, see OpenAPI Documentation.