L4-L7 App Services

For information on how to define a declaration, see https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest/userguide/.

Note

When you click the L4-L7 App Service tab, two subtabs are displayed (BIG-IP and Application). The Application tab is selected by default. It has a box that displays the current AS3 declaration on this BIG-IP device.

Dry-Run declaration (BIG-IP subtab)

  1. The text box should include a valid AS3 declaration.

    Note

    You can upload a .txt or .json file instead of pasting a declaration in the text box.

  2. Click Dry Run.

BIG-IP validates the JSON declaration and if it’s valid, a success message appears. If it’s not valid, the F5 ACI ServiceCenter displays an error message and you can fix errors and re-validate.

Submit an AS3 declaration (BIG-IP subtab)

  1. The text box should include a valid AS3 declaration.
  2. You can upload a .txt or .json file instead of pasting a declaration in the text box.
  3. Click Submit.

If successful, BIG-IP includes all the partitions, applications, pools, and nodes as specified in the AS3 declaration.

Note

View the current AS3 declaration

  1. in the top right of the L4-L7 Configuration tab, click the Details icon.
  2. A window with the current AS3 declaration is displayed.
  3. To copy the declaration to the text box under the BIG-IP subtab, click Copy-to-Text Box.

The window also has a Delete button, so you can delete the entire AS3 declaration from the BIG-IP device.

Create a partition using Advanced mode (Application subtab)

  1. Select the Advanced mode on Application subtab.
  2. From the Partition list, click Create New Partition. The Application list is disabled.
  3. Application stub code is displayed in the text box.
  4. Two new fields, Partition Name and Application Name, are displayed. Enter valid input for both. The new partition can’t be created without providing an application name.
  5. Update the stub code with valid inputs.
  6. Optionally, click Manage Endpoint Mappings to configure Dynamic Endpoint Mappings for endpoint discovery, which dynamically updates endpoints in BIG-IP pools whenever endpoints are attached or detached from APIC Endpoint Groups.
  7. Click Submit.

A new partition is created on the BIG-IP device.

New partitions and applications are listed in the Partition and Application lists.

Note

  • Minimum supported AS3 version for VRF to Route Domain mapping support is v3.41.
  • Route Domains must be created on the BIG-IP. FASC does not support the creation of Route Domains.
  • Manage Endpoint Mappings APIC VRF field is read-only and is retrieved from the APIC based on the provided information.
  • On clicking Submit, the partition is created asynchronously in the background. Once the partition is created successfully, the app UI loads the latest data. For more details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Delete a partition using Advanced mode (Application subtab)

  1. Select the Advanced mode on the Application subtab.
  2. From the Partition list, click the partition you want to delete.
  3. Click the Delete next to the menu.
  4. When prompted, confirm that you want to delete the partition.

The partition from this BIG-IP device is no longer listed in the Partition list.

Note

Create an application using Advanced mode (Application subtab)

  1. Select the Advanced mode on the Application subtab.
  2. From the Partition list, click the partition you want to create the new app in.
  3. From the Application list, click Create New Application.

Note

Application stub code is displayed in the text box.

  1. In the Application Name field, enter a valid application name.
  2. Update the stub code which appears in the JSON box with appropriate values.
  3. Optionally, click Manage Endpoint Mappings to configure Dynamic Endpoint Mappings for endpoint discovery, which dynamically updates endpoints in BIG-IP pools whenever endpoints are attached or detached from APIC Endpoint Groups.
  4. Click Submit.

The new application is created on this BIG-IP device in the specified partition, and the app is listed in the Application list.

Note

  • Minimum supported AS3 version for VRF to Route Domain mapping support is v3.41.
  • Route Domains must be created on the BIG-IP. FASC does not support the creation of Route Domains.
  • Manage Endpoint Mappings APIC VRF field is read-only and is retrieved from the APIC based on the provided information.
  • On clicking Submit, the application is created asynchronously in the background. Once the application is created successfully, the app UI loads the latest data. For more details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Update an application using Advanced mode (Application subtab)

  1. Select the Advanced mode on the Application subtab.

  2. From the Partition list, click the partition to which the application belongs.

  3. From the Application list, click the application you want to update.

    Note

    Application content is retrieved through AS3 APIs from the BIG-IP device and displayed in the text box.

  4. Update the application JSON.

  5. Optionally, click Manage Endpoint Mappings to configure Dynamic Endpoint Mappings for endpoint discovery, which dynamically updates endpoints in BIG-IP pools whenever endpoints are attached or detached from APIC Endpoint Groups.

  6. Click Submit.

The application is updated on the BIG-IP device.

Note

  • Minimum supported AS3 version for the VRF to Route Domain mapping support is v3.41.
  • Route Domains must be created on the BIG-IP. FASC does not support the creation of Route Domains.
  • Manage Endpoint Mappings APIC VRF field is read-only and is retrieved from the APIC based on the provided information.
  • On clicking Submit, the application is updated asynchronously in the background. Once the application is updated successfully, the app UI loads the latest data. For more details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Delete an application using Advanced mode (Application subtab)

  1. Select the Advanced mode on the Application subtab.
  2. From the Partition list, click the partition you want to delete an app from.
  3. From the Application list, click the application you want to delete.
  4. Click the Delete Icon next to the Application list.
  5. When prompted, click Confirm.

The application is deleted from the BIG-IP device and won’t be listed in the Application list.

When you delete the last application, the corresponding partition is automatically deleted.

Note

Create a partition using FAST template (Basic mode-Application subtab)

  1. Select the Basic mode on Application subtab.
  2. From the Partition list, click Create New Partition. The Application list is disabled.
  3. From the Application drop-down, click Create New Application.
  4. Choose a template from the template drop-down. Fox example service-discovery/http. A form will be displayed. Fill the form with appropriate values.
  5. Click Submit.

A new partition is created on the BIG-IP device.

New partitions and applications are listed in the Partition and Application drop-downs respectively, on this tab.

Note

  • Minimum supported AS3 version for VRF to Route Domain mapping is v3.41.
  • Service-discovery/http template provides endpoint discovery, which dynamically updates endpoints in BIG-IP pools whenever endpoints are attached or detached from APIC Endpoint Groups.
  • On upgrading FASC to v2.11 from any prior versions, users must remove the existing service-discovery/http template from the BIG-IP and install the latest version of service-discovery/http template from L4-L7 Application Services Tab for VRF to Route Domain mapping support.
  • Route Domains must be created on the BIG-IP since the L2-L3 Network Management Tab, as well as AS3 configuration, does not support creation of Route Domains.
  • Minimum supported AS3 version for the VRF to Route Domain mapping support is v3.41.
  • FASC does not support the creation of Route Domains. Route Domains must be created on the BIG-IP.
  • If FAST generated pool monitor is enabled user must fill below fields in the form selected template
    • Hostname title field for bigip-fast-templates/dns template
    • Application domain name title field in bigip-fast-templates/microsoft_sharepoint template
    • Password title field for bigip-fast-templates/ldap template
    • Domain Name title field for bigip-fast-templates/smtp template
  • On clicking Submit, the partition is created asynchronously in the background. Once the partition is created successfully, the app UI loads the latest data. For more details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Delete a partition using FAST Template (Basic mode-Application subtab)

  1. Select the Basic mode on the Application subtab.
  2. From the Partition list, click the partition you want to delete.
  3. Click the Delete icon next to the partition name.
  4. When prompted, confirm that you want to delete the partition.

Note

  • On clicking Delete, the partition is deleted synchronously, application UI loader will appear until operation is completed.

Create an application using FAST Template (Basic mode-Application subtab)

  1. Select the Basic mode on the Application subtab.
  2. From the Partition list, click the partition you want to create a new app in.
  3. From the Application list, click Create New Application.
  4. Choose a template from the template drop-down. Fox example bigip-fast-templates/http. A form will be displayed. Fill the form with appropriate values.
  5. Click Submit.

The new application is created on this BIG-IP device in the specified partition, and the app is listed in the Application list on this tab.

Note

  • Minimum supported AS3 version for the VRF to Route Domain mapping support is v3.41.
  • Service-discovery/http template provides endpoint discovery, which dynamically updates endpoints in BIG-IP pools whenever endpoints are attached or detached from APIC Endpoint Groups.
  • On upgrading FASC to v2.11 from any prior versions, users must remove the existing service-discovery/http template from the BIG-IP and install the latest version of service-discovery/http template from L4-L7 Application Services Tab for VRF to Route Domain mapping support.
  • Route Domains must be created on the BIG-IP. FASC does not support the creation of Route Domains.
  • On clicking Submit, the application is created asynchronously in the background. Once the operation is successful, the app UI loads the latest data. For more details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Update an application using FAST Template (Basic Mode-Application subtab)

  1. Select the Basic mode on the Application subtab.
  2. From the Partition list, click the partition to which the application belongs.
  3. From the Application list, click the application you want to update.
  4. Template name and corresponding pre-filled form will appear on the UI. Update the form values.
  5. Click Submit.

The application is updated on the BIG-IP device.

Note

Delete an application using FAST Template (Basic mode-Application subtab)

  1. Select the Basic mode on the Application subtab.
  2. From the Partition list, click the partition you want to delete an app from.
  3. From the Application list, click the application you want to delete.
  4. Click the Delete Icon next to the Application list.
  5. When prompted, click Confirm.

Note

Upload a new FAST Template set using Basic mode (Application subtab)

  1. Select the Basic mode on Application subtab.
  2. From the Template list, click Upload New Template. An input file browser will appear on the UI.
  3. Select a valid FAST template file from the system.
  4. Click Upload.
  5. F5 ACI ServiceCenter will upload this FAST template set on BIG-IP

Upload a new FAST Template set (Dynamic Endpoint Discovery) using Basic mode

F5 ACI ServiceCente provides the dynamic service discovery custom fast template service_discovery/http for endpoint attach and detach functionality using FAST templates.

  1. Select the Basic mode on the Application subtab.
  2. From the Partition list, click on Create New Partition.
  3. From the Template list, click on service-discovery/http. confirmation window will appear on the UI.
  4. Click on Upload

Delete custom FAST Template Set using Basic mode (Application subtab)

  1. Select the Basic mode on Application subtab.
  2. From the Partition list, click Create New Partition.
  3. From the Template list, click the template which is to be deleted.
  4. Click the Delete icon next to the template name.
  5. The template will be deleted from the BIG-IP FAST Database.

Note

  • Deleting the default FAST template set (bigip_fast_templates/) is not allowed from F5 ACI ServiceCenter.
  • Delete template operation will delete the entire template set from the BIG-IP.

View AS3/FAST Applications (Application Inventory sub-tab)

  1. Click the Application Inventory tab on the L4-L7 App Services tab.

  2. This will display a list of all the AS3 applications present on the BIG-IP device. The list will have the following columns:

    Partition

    • Displays the BIG-IP partition of the application

    Application

    • Displays the application name. Each application name in this table has a hyperlink to the Application sub-tab to the respective mode (either Basic/Advanced) used during creation of the application.

    Template

    • Displays the name of the template used. If the application was created using Advanced mode, this column will display ‘-‘.

    Pool

    • BIG-IP pool names which are present in this application. Each pool should be displayed on a separate row. The pool has a hyperlink to the BIG-IP UI to the same pool.

    Route Domain

    • BIG-IP Route Domain which is associated with this application. The Route Domain is displayed in <RD_name>|<RD_ID> format. If the application is mapped with Route Domain 0, this column will display ‘-‘.

    Port

    • BIG-IP Port which is associated with this application. If the application was created using FAST mode, this column will display ‘-‘.

    Tenant

    • APIC Tenant which is mapped with this application.

    Application Profile

    • APIC Application Profile which is mapped with this application.

    Endpoint Group

    • APIC Endpoint Group which is mapped with this application.

    VRF

    • APIC VRF which is mapped with this application.

    Action

    • View details icon - Shows the raw JSON of the AS3 application
    • Sync Endpoints to BIG-IP icon - Retrieves all the Endpoints from associated Tenant|Application|EPG and creates them to the associated pool of the application
    • View Pool Endpoints icon - Lists the endpoints present in the service discovery endpoint of the BIG-IP https:///<BIG-IP>/mgmt/shared/service-discovery/task/~Partition~Application~Pool
    • View Application JSON icon - Shows the raw JSON of the AS3 application

Refresh the L4-L7 App Services tab

  • In the top right of the L4-L7 App Services tab, click Refresh.

The content on the tab is refreshed.

AS3 Async Task Processing

For any configuration on the L4-L7 app services tab, all AS3 operations support asynchronous mode by default and return a success response with code 202, even if the configuration hasn’t completed yet on the BIG-IP device. Along with the 202 response, AS3 also returns a BIG-IP task id URL which can be used to track the pending task.

  1. F5 ACI ServiceCenter tracks all pending asynchronous tasks and users can monitor them on the L4-L7 App Services tab using the Pending Tasks icon.
  2. Click the Pending Tasks icon to view the list of last 20 pending AS3 tasks.
  3. Once the AS3 task completes, the status gets updated against that task entry in the Pending Tasks table with the appropriate status code and message. The UI also loads the updated data in the L4-L7 App Services view.

Pending Tasks maintains the list of tasks only for the current user session. On closing the F5 ACI ServiceCenter app, the Pending tasks table gets cleared.

Frequently Asked Questions (FAQ)

Q. Why is my L4-L7 App Services tab disabled?

For the L4-L7 App Services tab to work correctly, f5-appsvcs RPM version 3.19.1 or later is required. Installation steps are available here: https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest/userguide/installation.html#installation

Q. Why is there a warning about “f5-appsvcs package” installation when I log in to my BIG-IP device?

See above.

Q. Why do I see error code 503 with the message “Error: Configuration operation in progress on device <BIG-IP IP>, Please try again in 2 minutes” on the ‘Pending tasks’ table of the app?

If a BIG-IP is already processing an AS3 asynchronous task, it displays this message for any successive async operations. Once the asynchronous operation is completed, it is possible to perform the next operation like create/update/delete partition or application. Wait for a few minutes and try the configuration again.

It is also possible that you may see an error message such as ‘HTTPError’ object that has no attribute ‘message’. Wait for a few minutes and try the configuration again.

Q. For all L4-L7 App Services operations, why do I see the message “BIG-IP is processing the request. Please click the ‘Pending Tasks’ icon to check the status of the pending request.”?

All the L4-L7 App Services are processed in an asynchronous manner in the background. This message is displayed for every operation done on this tab. The Pending Tasks icon shows the status of the latest few such pending requests and their status. Also, once any such pending task is completed on the BIG-IP, the UI reloads the data to display the latest AS3 information about partitions and applications.

For more details, see: https://clouddocs.f5.com/f5-aci-servicecenter/latest/l4-l7.html#as3-async-task-processing

Q. Why do I see warning signs against APIC Endpoints in the View EPs table?

It is possible that the BIG-IP’s AS3 plugin is unable to sync the dynamic endpoints and create them as BIG-IP pool members due to various unsupported configurations, such as:

  1. A duplicate node with the same IP as the endpoint is already present in another partition.
  2. More than 60 endpoints have been added to this BIG-IP pool. AS3 currently supports only a maximum of 60 endpoints in an AS3 application pool.
  3. The node IP is a substring of another node IP.

Check if you have done any unsupported configurations. For details, refer to https://clouddocs.f5.com/f5-aci-servicecenter/latest/release-notes.html#dynamic-endpoint-attach-detach

Q. I deleted an application services declaration from the F5 ACI ServiceCenter application. Why do I still see partitions in the declaration?

If your AS3 declaration contains “optimisticLockKey” mentioned explicitly, the AS3 configuration may not be deleted completely, even after multiple attempts from the application UI. However, the configuration gets removed from the BIG-IP device.

Workaround: Upload one more AS3 sample declaration to the app and then perform a Delete all operation. (Use View AS3 Declaration and click Delete.)

Q. For the L4-L7 App Service tab, why does the partition get deleted when I delete the last application belonging to that partition?

If there is a single application in a particular partition, and if that application is deleted through the application, the partition that has no other applications under it will be deleted from the BIG-IP device. This is standard F5 BIG-IP behavior. You will be warned about this in the delete confirmation prompt.

Q. When I create an AS3 application using the L4-L7 Application Services → Application → Basic tab, I don’t see this application listed under the L4-L7 Application Services → Application → Advanced tab. How shall I view the raw JSON of this AS3 application?

The Basic and Advanced sub-tabs of ‘L4-L7 Application Services → Application’ tab list only the applications created from the respective tabs. If you wish to view details (raw JSON) of any AS3 application, please go to L4-L7 Application Services → Application Inventory tab which lists all the applications. Traverse to row with the application of interest and click on the “View Application JSON” icon in the “Action” column to view the raw JSON.

Q. When I create an FAST application using the L4-L7 Application Services → Application → Basic tab, can I update this application via Application Services → BIG-IP tab?

The application created through the L4-L7 Application Services → Application → Basic tab should be updated through the same tab. If for some reason it needs to be updated via the BIG-IP tab; For example, if the virtual server address is to be updated from X to Y, then the same value needs to get updated from X to Y in the Constants → appsvcsFormData section of the application JSON from the BIG-IP tab. If the constants section is not updated, it will show inconsistent values when traversed back to the Basic tab.

Q. While deleting Partition OR Application using L4-L7 Application Services, why do I get the error “All objects must be removed from a partition <Partition-Name> before the partition may be removed”?

This issue is observed when there are additional objects created under a BIG-IP Partition. In order to see which objects are present in this partition: 1. Login to BIG-IP using ssh and as root user 2. cd to “/partitions/<Partition-Name>/” and check the contents of the file “bigip.conf” 3. This file should shows the details of the objects that you need to remove to be able to successfully delete the partition from BIG-IP

Q. Why do I see ‘Install f5-appscvs-templates package’ warning on L4-L7 tab even though I have added FAST template plugin on BIG-IP?

If FAST Template plugin api is unable to respond due to a REST operation failure on the BIG-IP, you may see the ‘Install f5-appscvs-templates package’ warning on L4-L7 UI as FASC doesnt get response from FAST. Check if restnoded and restjavad is working on the BIG-IP.

Q. Why is Dynamic Endpoint Discovery not supported for default FAST template set bigip-fast-templates/?

Dynamic Endpoint Discovery functionality is provided by F5ACIServiceCenter and hence is only supported by service_discovery/http template. (This template can be accessed from the FASC → L4-L7 App Services → Application → Basic sub-tab’s template drop-down).

Q. Why are ‘bigip-fast-templates/microsoft adfs’ and ‘bigip-fast-templates/microsoft exchange’ FAST templates not working in F5 ACI ServiceCenter?

bigip-fast-templates/microsoft adfs and bigip-fast-templates/microsoft exchange are FAST Beta Version Templates. They might not work in F5 ACI serviceCenter. Report any issues, or an RFE, on the FAST GitHub repository.

Q.Pool members are not displayed if :guilabel:`shared node` option for application created using service discovery fast template is disabled afterwords

To view pool members after share node option is disabled for an existing partition user need to sync endpoint manually to BIG-IP by Application inventory → Partition → Sync EP icon

Q.Why are older partitions that no longer exist on the BIG-IP still retrieved by the AS3 endpoint?

The Application Inventory tab under L4-L7 App Services in FASC Application displays a list of all FAST and AS3 applications created on the BIG-IP device as well as on the FASC application. The Application Inventory tab on FASC always pulls the current AS3 configurations present on the BIG-IP device and it gets updated whenever the tab is clicked or reloaded. However in case of misconfigurations or configuration failures on the BIG-IP, users might see certain FAST/AS3 applications displaying on the Application Inventory tab which no longer exist on the BIG-IP. If you run into this condition, you can do a GET request through Postman on the following AS3 Endpoint API to verify if the relevant partition is still present on the BIG-IP in the API response.

API URL: https://<BIGIP-IP:Port-Here>/mgmt/shared/appsvcs/declare?showHash=true Request type: GET Authentication type: Basic Auth (Enter username & password of the BIG-IP here)

Therefore, if the relevant partition is present in the API response, report this issue with the F5 BIG-IP AS3 team. If the relevant partition is not present in the API response, report this issue with F5 FASC team at https://github.com/F5Networks/f5-aci-servicecenter/issues

Q.Why do I receive an error when updating the Route Domain of an AS3/FAST Application with Service Discovery?

The FASC application throws the following error message when trying to update the Route Domain with Service Discovery: “On updating the Route domain of this application, the Virtual Server of this application would reference the new Route domain. However, the Pool members of this Endpoint group may not reference the new Route domain. To continue, kindly delete this application and create a new one with the required Route domain.” This behavior was observed due to an existing bug in the AS3 Service Discovery plugin found in v3.41, where on moving an existing AS3 application from one Route Domain to another, the Service Discovery nodes are not updated to the new Route Domain. For example, if an application is mapped to a Tenant | Application Profile | EPG from the APIC and you are trying to update the Route Domain of this application from the default Route Domain 0 to a non-default Route Domain, the Virtual Server of this application will get updated with the newly assigned Route Domain while the pool members learned from the APIC by Service Discovery will still reference to the original default Route Domain 0 on the BIG-IP. Please refer to below URL for more info on this AS3 Service Discovery bug: https://github.com/F5Networks/f5-appsvcs-extension/issues/669.

As a workaround suggested in the error message, you can delete the AS3/FAST application and create a new one with the desired Route Domain. Please note that if the application is the only application in that partition, the FASC App will attempt to delete the partition from the BIG-IP as well. Since the BIG-IP does not support deleting a partition if there are any existing objects present in it, in our case - the Route Domain, the delete application operation would fail. In this scenario, you should create a new application in this partition first and then delete the older application instead as a workaround.

Note that this issue can be seen in v2.11.1 and prior releases. This was fixed in v2.11.2.

Q. When I try to create a new partition to deploy a new application with Service Discovery, why don’t I find the options to map the APIC endpoints to a Route Domain that resides in a non-common partition?

Currently, when trying to create a new partition from the L4-L7 Basic or Advanced tab, the Route Domain dropdown can only display the Route Domains that reside in the common partition from the BIG-IP. If you would like to create a new partition and associate its application with a Route Domain that resides in a non-common partition, please follow the steps below:

  1. Select “Create New Partition” option from the L4-L7 Basic or Advanced tab and enter the desired partition name.
  2. Enter “To-Be-Deleted” as the Application Name.
  3. In the “Route Domain” field, Select a Route Domain from the Route Domains dropdown.
  4. Click “Submit” and the AS3 application “To-Be-Deleted” will be created in the newly created partition on the BIG-IP.
  5. Next, go to the BIG-IP UI and create a new Route Domain per your requirement under the newly created partition.
  6. Refresh the L4-L7 Tab on the FASC application. After the refresh, the Route Domains dropdown will now display the new Route Domain under the newly created partition at step 1.
  7. Next, under the same partition created at step 1, select “Create New Application” and enter the desired application name. In the “Route Domain” field, select the new Route Domain created at step 6 from the Route Domains dropdown.
  8. Click “Submit” and the new AS3 application will be created in the Route Domain that resides in the non-common partition on the BIG-IP.
  9. Last, delete the “To-Be-Deleted” application.

Starting from v2.11.2, you no longer need to create a dummy application “To-Be-Deleted” first in order to place your new application in a Route Domain that resides in a non-common partition.

Q. Why do I receive an AS3 error “TMSH CLI script failed during execution” when trying to delete a partition or an application with a Route Domain that resides in a non-common partition?

Please note that if the application is the only application in a partition, the FASC App will attempt to delete the partition from the BIG-IP as well. Thus, when you are trying to delete a partition or the only application in a partition that resides in a non-default Route Domain 0, you must remove the Route Domain from the BIG-IP first. It is because BIG-IP does not support deleting a partition if there are any existing objects present in it including the Route Domain.