Appendix A: Schema Reference

This page is a reference for the objects you can use in your Declarations for AS3. For more information on BIG-IP objects and terminology, see the BIG-IP documentation at https://support.f5.com/csp/home.

ADC

A declarative configuration for an ADC such as F5 BIG-IP

Properties:

Name (Type) Default Values Description
class (string)
ADC Indicates this JSON document is an ADC declaration
Common (object)
Special tenant Common holds objects other tenants can share
constants (object)
Declaration metadata and/or named values for (re-)use by declaration objects
controls (object)
Options to control configuration process
id (string)
Unique identifier for this declaration (max 255 printable chars with no spaces, quotation marks, angle brackets, nor backslashes)
label (string)
Optional friendly name for this declaration
remark (string)
Arbitrary (brief) text pertaining to this declaration (optional)
schemaVersion (string)
3.3.0, 3.2.0, 3.1.0, 3.0.0 Version of ADC Declaration schema this declaration uses
scratch (string)
Holds some system data during declaration processing
updateMode (string) selective complete, selective When set to ‘selective’ (default) AS3 does not modify Tenants not referenced in the declaration. Otherwise (‘complete’) AS3 removes unreferenced Tenants.

Application

Application declaration master schema

Properties:

Name (Type) Default Values Description
class (string)
Application
constants (Constants)
enable (boolean) true
Application handles traffic only when enabled (default)
label (Label)
remark (Remark)
serviceMain (reference)
Primary service of the application
template (string)
Each application type has certain required and default elements and selects appropriate setup of various ADC/Security features

Application_Shared

Special application Shared holds objects other applications can share

Properties:

Name (Type) Default Values Description
class (string)
Application
enable (boolean) true true If declared, you must enable the Shared Application
template (string)
shared Shared Application template is always generic

AS3

AS3 request body

Properties:

Name (Type) Default Values Description
action (string) deploy deploy, dry-run, patch, redeploy, retrieve, remove Indicates desired action: ‘deploy’ means deploy the included declaration to targetHost; ‘dry-run’ does NOT deploy the declaration but does do everything short of changing targetHost’s configuration; ‘patch’ modifies the declaration based on the provided set of commands and then deploys the updated declaration; ‘redeploy’ causes an old declaration from targetHost’s declaration history to be re-deployed (property redeployAge (default 0) selects the old declaration, and note redeployUpdateMode as well); ‘retrieve’ returns a copy of a previously-deployed declaration; ‘remove’ deletes the declaration or declaration component.
class (string)
AS3 Indicates the structure of this request
declaration (object)
Declaration to deploy to targetHost
historyLimit (number) 4
This value (default 4) limits the number of previously-deployed declarations saved on targetHost for review using GET and for use with POST action=redeploy and redeployAge=N. The limit includes the current and immediately-previous declarations so may not be less than two
logLevel (string) warning emergency, alert, critical, error, warning, notice, info, debug Controls level of detail in logs using RFC 5424 severity levels (default is ‘warning’). Portions of declaration may use different logLevels
patchBody (array)
An array containing the patch operations to apply on the declaration
persist (boolean) true
When true (default) make the whole working configuration persistent on targetHost after (and only if) this request deploys any changes. If false, leave the working configuration in memory only (if targetHost restart, you may lose the configuration from memory)
redeployAge (integer) 0
For action=redeploy (only), chooses which old declaration to deploy again. Value 0 (default) means re-deploy the most recent declaration (the one which set the current configuration of targetHost– useful to erase changes introduced by manual configuration). Value 1 means re-deploy the declaration prior to the most-recent one, etc. Note that whenever re-deploying an old declaration causes ADC configuration changes, that declaration becomes the current declaration (age 0) and the ages of all other declarations in the history increase (0 => 1, 1 => 2, u.s.w.)
redeployUpdateMode (string) original original, complete, selective Value ‘original’ (default) means re-deploy the chosen declaration using its original updateMode (which if not explicitly specified in that declaration will default to ‘selective’). Otherwise, forces the updateMode for re-deployment to ‘complete’ or ‘selective’ as specified. Remember, ‘selective’ updates do not affect Tenants not explicitly named. To simply roll-back the targetHost configuration to the state it had immediately after deploying some earlier declaration, put ‘complete’ here (that will remove Tenants created later than the redeployAge declaration). To use action=redeploy as a simple roll-back facility, always deploy (updateMode=)complete declarations.
resourceTimeout (integer) 5
Maximum delay allowed while communicating with URL resources (seconds, default 5)
retrieveAge (integer | string) 0
Use this property with action=retrieve. You can usually get a copy of the declaration most recently deployed to targetHost, and often copies of previously-deployed declarations are also available. Value 0 (default) means ‘the last-deployed declaration,’ value 1 means ‘the declaration previous to 0’ and so-forth. To get a list of available declarations, set value ‘list’
syncToGroup (string)  
Name (like /Common/my_dg) of the config-sync group TO which the system should synchronize the targetHost configuration after (and only if) this request deploys any changes. When empty (default) this request will not affect config-sync at all. Leave undefined or empty whenever you use auto-sync or manage configuration synchronization separately
targetHost (string) localhost
Hostname or IP address of ADC to which request applies (default localhost)
targetPassphrase (string)
Passphrase for targetUsername account. This is generally not required to configure ‘localhost’ and is not required when you populate targetTokens
targetPort (integer) 0
TCP port number of management service on targetHost; default 0 means auto-discover
targetTimeout (integer) 150
Maximum delay allowed while communicating with targetHost device (seconds, default 150)
targetTokens (object)
One or more HTTP headers (each a property, like ‘X-F5-Auth-Token’: ‘MF6APSRUYKTMSDBEOOEWLCNSO2’) you want to send with queries to the targetHost management service as authentication/authorization tokens
targetUsername (string)
Username of principal authorized to modify configuration of targetHost (may not include the character ‘:’). NOTE: this is generally not required to configure ‘localhost’ because client authentication and authorization precede invocation of AS3. It is also not required for any targetHost if you populate targetTokens
trace (boolean) false
If true, AS3 creates a detailed trace of the configuration process for subsequent analysis (default false). May be overridden on a per-Declaration and/or per-Tenant basis. Warning: trace files may contain sensitive configuration data

Certificate

PKI certificate with optional private-key and/or chain, optional OCSP stapler

Properties:

Name (Type) Default Values Description
certificate (reference)
X.509 public-key certificate
chainCA (reference)
Bundle of one or more CA certificates in trust-chain from root CA to certificate (optional)
class (string)
Certificate
label (Label)
passphrase (object)
If supplied, used to decrypt privateKey at runtime (optional)
pkcs12 (reference)
PKCS#12 (.p12/.pfx) blob containing both certificate and private key
privateKey (reference)
Private key matching certificate’s public key (optional)
remark (Remark)
staplerOCSP (object)
AS3 pointer to OCSP Stapler declaration (optional)

Controls

Options to control configuration process

Properties:

Name (Type) Default Values Description
class (string) Controls Controls
fortune (boolean) false
If true, AS3 will activate Zoltar mode and read you your fortune
logLevel (string) error emergency, alert, critical, error, warning, notice, info, debug Controls the amount of detail in logs produced while configuring this Tenant (default is whole-declaration Controls/logLevel value)
trace (boolean) false
If true, AS3 creates a detailed trace of the configuration process for this Tenant for subsequent analysis (default is whole-declaration Controls/trace value). Warning: trace files may contain sensitive configuration data

Endpoint_Policy

Policy to manage connections based on metadata and content

Properties:

Name (Type) Default Values Description
class (string)
Endpoint_Policy
customStrategy (object)
AS3 pointer to custom strategy declaration
label (Label)
remark (Remark)
rules (array)
List of policy rules, order is significant
strategy (string) best-match all-match, best-match, first-match, custom Rule-matching strategy; value ‘custom’ means AS3 requires a custom strategy (default is best-match)

Endpoint_Strategy

Strategy for evaluation of an Endpoint policy

Properties:

Name (Type) Default Values Description
class (string)
Endpoint_Strategy
label (Label)
matchMethod (string)
all-match, best-match, first-match Specifies the match method
operands (array)
Specifies the attribute for the rule to match. Sometimes this represents a specific value (for example, http-method or http-status), but frequently the operand needs a specific Selector to identify an instance (for example, http-header needs a Selectorname parameter).
remark (Remark)

Firewall_Address_List

Declares an address-list for use by firewall rules. An address list is a list of IP-address prefixes to compare against the source-IP address and/or destination-IP address in an IP packet

Properties:

Name (Type) Default Values Description
addresses (array)
A list of IPv4 and IPv6 addresses and address ranges. You can specify a network with CIDR slash notation.
addressLists (array)
A list of other address lists (each by AS3 pointer or BIG-IP pathname).
class (string)
Firewall_Address_List
fqdns (array)
A list of fully qualified domain names.
geo (array)
A list of geographic locations (for example, US:Washington).
label (Label)
remark (Remark)

Firewall_Policy

Configures firewall policy

Properties:

Name (Type) Default Values Description
class (string)
Firewall_Policy
label (Label)
remark (Remark)
rules (array)

Firewall_Port_List

Declares a port-list for use by firewall rules. A firewall rule can match a packet’s source port or destination port against one of the ports in a port list, and can take some action (such as ACCEPT or DROP) for a matching packet.

Properties:

Name (Type) Default Values Description
class (string)
Firewall_Port_List
label (Label)
portLists (array)
A list of other port lists (each by AS3 pointer or BIG-IP pathname).
ports (array)
A list of ports and port ranges (for example, 80, “8080-8090”).
remark (Remark)

Firewall_Rule

Declares a network firewall rule.

Properties:

Name (Type) Default Values Description
action (string)
accept, drop Specifies the action that the firewall rule will take on matching packets.
destination (Firewall_Rule_Destination)
iRule (object)
Specifies the name of the iRule (by AS3 pointer or BIG-IP pathname) that the system will trigger when a packet matches the firewall rule.
iRuleSampleRate (integer)
Specifies the rate at which the system will trigger the specified iRule when a packet matches this firewall rule. The default value is 1 and causes the system to trigger the iRule for every packet that matches. A value of 0 disables iRule triggering.
label (Label)
loggingEnabled (boolean) false
Specifies whether the system enables or disables logging for the firewall rule.
name (string)
The name of the firewall rule.
protocol (string) any any, tcp, udp Specifies the protocol to which the firewall rule applies
remark (Remark)
source (Firewall_Rule_Source)

Firewall_Rule_Destination

Declares the packet destinations to which the network firewall rule applies.

Properties:

Name (Type) Default Values Description
addressLists (array)
A list of address lists (each by AS3 pointer or BIG-IP pathname).
portLists (array)
A list of port lists (each by AS3 pointer or BIG-IP pathname).

Firewall_Rule_List

Declares a list of network firewall rules. You can reuse a rule list in multiple firewalls, such as the firewalls for self IPs, routing domains, and the global firewall.

Properties:

Name (Type) Default Values Description
class (string)
Firewall_Rule_List
label (Label)
remark (Remark)
rules (array)
A list of network firewall rules.

Firewall_Rule_Source

Declares the packet sources to which the network firewall rule applies.

Properties:

Name (Type) Default Values Description
addressLists (array)
A list of address lists (each by AS3 pointer or BIG-IP pathname).
portLists (array)
A list of port lists (each by AS3 pointer or BIG-IP pathname).

HTTP_Compress

HTTP Compression profile with configurable options

Properties:

Name (Type) Default Values Description
allowHTTP10 (boolean) false
If true, AS3 may compress HTTP/1.0 responses (default false)
bufferSize (integer) 4096
Maximum number of response octets to buffer before deciding whether to apply compression (default 4096)
class (string)
HTTP_Compress
contentTypeExcludes (array)
List of response Content-Type values which AS3 should not compress. Values are regular expressions that match Content-Type strings
contentTypeIncludes (array) text/, application/(xml|x-javascript)
List of response Content-Type values which AS3 should compress. Values are regular expressions that match Content-Type strings
cpuSaver (boolean) true
If true (default), system will reduce compression rate when CPU utilization exceeds cpuSaverHigh threshold and increase it when CPU utilization falls below cpuSaverLow threshold
cpuSaverHigh (integer) 90
CPU utilization percentage (default 90) above which AS3 should moderate compression
cpuSaverLow (integer) 75
CPU utilization percentage (default 75) below which the system returns compression to normal
gzipLevel (integer) 1
Compression level (default 1); higher values produce greater compression but use more CPU cycles
gzipMemory (integer) 8
Compression memory allocation in kilobytes (default 8), should be a power of two
gzipWindowSize (integer) 16
Compression window size in kilobytes (default 16), should be a power of two
keepAcceptEncoding (boolean) false
If true, pool member may compress responses; if false (default) ADC will compress responses. Set to true when pool member stores/caches pre-compressed responses
label (Label)
minimumSize (integer) 1024
AS3 will not compress responses of fewer octets than this (default 1024)
preferMethod (string) gzip gzip, deflate Select preferred compression method (default gzip, strongly recommended)
remark (Remark)
selective (boolean) false
If true, AS3 will only compress a response when an iRule attached to the virtual server requests it (default is false, meaning AS3 will compress responses which meet the criteria in this profile)
uriExcludes (array)
List of request URI’s for which AS3 should not compress responses. Values are regular expressions that match request URI strings
uriIncludes (array)
List of request URI’s for which AS3 should compress responses. Values are regular expressions that match URI strings
varyHeader (boolean) true
If true (default), a Vary header will appear in compressed responses

HTTP_Profile

HTTP profile with configurable options

Properties:

Name (Type) Default Values Description
allowedResponseHeaders (array)
By default AS3 passes HTTP headers in responses from pool members to clients unaltered. You may list names of allowed response headers here and AS3 removes any you do not list from responses.
class (string)
HTTP_Profile
cookiePassphrase (object)
Used to create secret key for cookie encryption (when missing, AS3 uses a system-generated key)
encryptCookies (array)
List cookies to encrypt en-route to the client and decrypt en-route to a pool member
fallbackRedirect (string)
Domain name (or IP address) of service (if any) to which AS3 should redirect a request when no pool member is responsive or selected pool member returns a fallbackStatusCode
fallbackStatusCodes (array)
When a pool member responds to a request with one of these HTTP status codes (for example, 500), redirect the client to the fallbackRedirect
hstsIncludeSubdomains (boolean) true
If true then HSTS headers (see hstsInsert) will tell clients to apply HSTS settings to the hostnames of this service and all their possible subdomains. Warning: an incorrect value here can make multiple websites unreachable, not just this service
hstsInsert (boolean) false
If true, insert HSTS (HTTP Strict Transport Security) headers into responses sent to clients (default false). Warning: misconfiguration of HSTS can make a website unreachable
hstsPeriod (integer) 7862400
If hstsInsert is true, this value tells each client how long (in seconds; default 7862400 equals 91 days) to wait before refreshing HSTS settings for this service. Warning: once a client receives erroneous HSTS settings it will ignore any attempt to correct them until this period has expired
hstsPreload (boolean) false
If true, include the domain for the web site associated with this HTTP profile in the browser’s preload list. This forces the client to send packets over SSL/TLS.
insertHeader (object)
You may insert one header into each request before AS3 sends it to a pool member. The header value may be a simple string or the result of an iRules TCL expression (for example, [IP::client_addr]). This is the most efficient way to insert a single header; to insert multiple headers use an iRule or an Endpoint policy
knownMethods (array) CONNECT, DELETE, GET, HEAD, LOCK, OPTIONS, POST, PROPFIND, PUT, TRACE, UNLOCK
List of HTTP request methods AS3 should recognize as normal. Any method not in this list will provoke the ‘unknownMethodAction’ action
label (Label)
maxRequests (integer) 0
When AS3 has processed more than this number of requests through a connection, the system closes it. Default 0 means permit unlimited requests
multiplexTransformations (boolean) true
If true (default), AS3 adjusts request headers to work properly when the virtual server uses a Multiplex profile
otherXFF (array)
Names of request headers to treat as equivalent to X-Forwarded-For (see trustXFF)
pipelineAction (string) allow allow, reject, pass-through Default ‘allow’ means clients may pipeline HTTP/1.1 requests to pool members which support pipelining. Otherwise, ‘reject’ prevents pipelining, and ‘pass-through’ causes the connection to switch to pass-through mode when the system detects pipelining
proxyType (string) reverse reverse, transparent, explicit Default value ‘reverse’ is usually appropriate. You may use ‘transparent’ when virtual server will handle a mix of HTTP and non-HTTP traffic. You may use ‘explicit’ when clients will ask ADC to proxy connections to arbitrary remote services
remark (Remark)
requestChunking (string) preserve selective, preserve, rechunk Controls handling of HTTP payload chunking in requests from clients (default is ‘preserve’)
responseChunking (string) selective selective, preserve, unchunk, rechunk Controls handling of HTTP payload chunking in responses from pool members (default ‘selective’ adapts to most situations)
rewriteRedirects (string) none none, all, matching, addresses In selected Location-header values (default none) of redirect responses from pool members, change protocol HTTP to HTTPS before passing redirects to clients
serverHeaderValue (string) BigIP
Server header value to place in responses generated by the ADC itself (not obtained from a pool member)
trustXFF (boolean) false
If true, WAF (ASM) and AVR may trust X-Forwarded-For headers found in incoming requests and report statistics using client IP addresses appearing in them (default false). Use this feature only when you control upstream gateway(s)
unknownMethodAction (string) allow allow, reject, pass-through Default ‘allow’ means clients may make HTTP requests using unknown methods. Otherwise, ‘reject’ means to discard any unknown-method request and reject the client connection, and ‘pass-through’ causes the connection to switch to pass-through mode upon the first unknown-method request
viaHost (string)
Hostname to place in Via header when viaRequest or viaResponse is ‘append’
viaRequest (string) remove append, preserve, remove Controls treatment of Via: headers in requests from clients. When set to ‘append’ AS3 requires viaHost
viaResponse (string) remove append, preserve, remove Controls treatment of Via: headers in responses from pool members. When set to ‘append’ AS3 requires viaHost
whiteOutHeader (string)
You may name one request header you want whited-out of each request before AS3 sends it to a pool member. To remove more than a single named header, use an iRule or an Endpoint policy. (Whiting-out a header leaves its name but replaces its value in the request with space characters (ASCII 0x20) to avoid changing the length of the headers.)
xForwardedFor (boolean) true
If true, insert an X-Forwarded-For header carrying the client IP address into each HTTP request sent to a pool member (default false)

HTTP_Profile_Explicit

Extra HTTP profile configurable options when proxyType is ‘explicit’

Properties:

Name (Type) Default Values Description
badRequestMessage (string) <html><head><title>Bad Request</title></head><body><h2>Invalid proxy request</h2></body></html>
Message returned to client when proxy request is erroneous. May include iRules TCL expressions
badResponseMessage (string) <html><head><title>Bad Response</title></head><body><h2>Proxy request provoked invalid response</h2></body></html>
Message returned to client when response to proxy request is erroneous. May include iRules TCL expressions
connectErrorMessage (string) <html><head><title>Connection Error</title></head><body><h2>Unable to connect to host in proxy request</h2></body></html>
Message returned to client when the system cannot establish a proxy connection. May include iRules TCL expressions
defaultConnectAction (string) deny deny, allow By default (value ‘deny’) the system refuses CONNECT requests from clients except when there is a virtual server listening to the tunnelName tunnel to accept and process them (typically to authorize and/or intercept outbound TLS connections). Value ‘allow’ will let clients CONNECT to arbitrary remote services
dnsErrorMessage (string) <html><head><title>DNS Resolution Error</title></head><body><h2>Cannot resolve hostname in proxy request</h2></body></html>
Message returned to the client when the system cannot resolve the hostname in the request. May include iRules TCL expressions
doNotProxyHosts (array) none
When a client makes a (proxy-type) request to some host on this list, that request will simply be load-balanced to a pool member (without DNS resolution). This is ineffective for HTTPS requests
ipv6 (boolean) false
Specifies the relative order of IPv4 and IPv6 DNS resolutions for URIs. If false (default), then the system performs IPv4 lookup before IPv6.
maxHeaderCount (integer) 64
When the number of headers in an incoming HTTP request exceeds this value, discard the request and reset the client connection
maxHeaderSize (integer) 32768
When the total size in octets of the headers of an incoming HTTP request exceeds this value, discard the request and reset the client connection
resolver (object)
AS3 pointer to DNS resolver used to resolve hostnames in client requests
routeDomain (integer) 0
Proxy requests will leave the ADC from a Self IP in this route domain (default 0)
truncatedRedirects (boolean) false
If false (default) elide malformed redirects from pool members, otherwise pass them to client
tunnelName (string) http-tunnel
Name of tunnel used for outbound CONNECT requests (default ‘http-tunnel’)

HTTP_Profile_Reverse

Extra HTTP profile configurable options when proxyType is ‘reverse’

Properties:

Name (Type) Default Values Description
maxHeaderCount (integer) 64
When the number of headers in an incoming HTTP request exceeds this value, discard the request and reset the client connection
maxHeaderSize (integer) 32768
When the total size in octets of the headers of an incoming HTTP request exceeds this value, discard the request and reset the client connection
truncatedRedirects (boolean) false
If false (default) elide malformed redirects from pool members, otherwise pass them to client

HTTP_Profile_Transparent

Extra HTTP profile configurable options when proxyType is ‘transparent’

Properties:

Name (Type) Default Values Description
excessClientHeaders (string) pass-through pass-through, reject When a client request violates maxHeaderCount, either switch to pass-through mode (default) or reject the connection
excessServerHeaders (string) pass-through pass-through, reject When a pool member response violates maxHeaderCount, either switch to pass-through mode (default) or reject the connection
maxHeaderCount (integer) 32
When the number of headers in a request or response exceeds this value (default 32), take the excessX…Headers action
maxHeaderSize (integer) 16384
When the total size in octets of the headers of request or response exceeds this value (default 16384), take the oversizeX…Headers action
oversizeClientHeaders (string) pass-through pass-through, reject When a client request violates maxHeaderSize, either switch to pass-through mode (default) or reject the connection
oversizeServerHeaders (string) pass-through pass-through, reject When a pool member response violates maxHeaderSize, either switch to pass-through mode (default) or reject the connection
truncatedRedirects (boolean) true
If true (default) pass malformed redirects to client

iRule

An iRule

Properties:

Name (Type) Default Values Description
class (string)
iRule
expand (boolean) true
If true (default), expand backquoted variables in iRule
iRule (reference)
label (Label)
remark (Remark)

L4_Profile

Configures a Fast Layer 4 profile

Properties:

Name (Type) Default Values Description
class (string)
L4_Profile
clientTimeout (integer) 30
Number of seconds allowed for a client to transmit enough data to select a server when you have late binding enabled. Value -1 means indefinite (not recommended)
idleTimeout (integer) 300
Number of seconds (default 300; may not be 0) connection may remain idle before it becomes eligible for deletion. Value -1 (not recommended) means infinite
label (Label)
looseClose (boolean) false
When true, system closes a loosely-initiated connection when the system receives the first FIN packet from either the client or the server (default false).
looseInitialization (boolean) false
When true, system initializes a connection when it receives any TCP packet, rather than requiring a SYN packet for connection initiation (default false).
maxSegmentSize (integer) 0
Sets MSS advertised to peer. Value 0 (default) will set MSS automatically in proportion to interface MTU. Default 0 is usually the best choice
remark (Remark)
resetOnTimeout (boolean) true
If true (default), connections which time out will be reset (that is, the system sends an RST packet to the peer) before the system expunges them
tcpCloseTimeout (integer) 5
Specifies an TCP close timeout in seconds. Value -1 means indefinite (not recommended)
tcpHandshakeTimeout (integer) 5
Specifies a TCP handshake timeout in seconds. The default value is 5 seconds. Value -1 means indefinite (not recommended)

Log_Destination

TODO

Properties:

Name (Type) Default Values Description
class (string)
Log_Destination
label (Label)
remark (Remark)
type (string)
remote-syslog, remote-high-speed-log The type of the log destination

Log_Destination_Remote_High_Speed_Log

Sends received messages to a specified pool

Properties:

Name (Type) Default Values Description
distribution (string) adaptive adaptive, balanced, replicated Specifies the distribution method used to send messages to pool members
pool (object)
AS3 pointer to pool if any (declared separately)
protocol (string) tcp tcp, udp Specifies the protocol for the system to use to send logs to the pool

Log_Destination_Remote_Syslog

Configures Remote Syslog destinations to format log messages into Syslog format and forward them to a Remote High-Speed Log destination

Properties:

Name (Type) Default Values Description
defaultFacility (string) local0 local0, local1, local2, local3, local4, local5, local6, local7 Specifies the facility given to log messages received that do not already have a facility listed
defaultSeverity (string) info alert, crit, debug, emerg, err, info, notice, warn Specifies the severity given to log messages received that do not already have a severity listed
format (string) rfc3164 legacy-bigip, rfc3164, rfc5424 Specifies the method to use to format the logs
remoteHighSpeedLog (object)
Specifies a remote high-speed log destination, which the system uses to forward the logs to a pool of remote log servers

Log_Publisher

Configures lists of destinations for the common logging interface

Properties:

Name (Type) Default Values Description
class (string)
Log_Publisher
destinations (array)
specify log destinations for this log publisher to use
label (Label)
remark (Remark)

Monitor

Declares a (possibly complex) monitor

Properties:

Name (Type) Default Values Description
class (string)
Monitor
interval (integer) 5
Poll interval (seconds)
label (Label)
monitorType (string)
external, http, https, icmp, sip, smtp, tcp, tcp-half-open, udp You may customize each monitor type
remark (Remark)
targetAddress (string)  
IP address monitor should probe; if empty (default) then pool member address
timeout (integer) 16
Time limit for node to respond (seconds)
timeUntilUp (integer) 0
Delay between successful probe and sending traffic to node (seconds)
upInterval (integer) 0
Poll interval when service is already up (seconds)

Monitor_HTTP

Additional Monitor class properties available when monitorType = http or https

Properties:

Name (Type) Default Values Description
adaptive (boolean) false
If true, use adaptive probe timing
adaptiveDivergenceMilliseconds (integer) 500
Probe fails if response latency exceeds mean by this number of milliseconds
adaptiveDivergencePercentage (integer) 100
Probe fails if response latency exceeds mean by this percentage
adaptiveDivergenceType (string) relative absolute, relative Adaptive divergence, ‘absolute’ selects milliseconds, ‘relative’ (default) selects percentage
adaptiveLimitMilliseconds (integer) 1000
Probe fails if response latency exceeds this number of milliseconds
adaptiveWindow (integer) 180
Time window over which the system samples latency (seconds)
dscp (integer) 0
Value for IP DSCP (ex-TOS) field (default 0)
passphrase (object)
Passphrase if any for query authentication
receive (string) HTTP/1.
Mark node up upon receipt of this (backquote-expanded) string
receiveDown (string)  
Mark node down upon receipt of this (backquote-expanded) string (optional; must be empty when ‘reverse’ is true)
reverse (boolean) false
If true, mark node down upon receipt of ‘receive’ string
send (string) HEAD / HTTP/1.0rnrn
Send this (backquote-expanded) string to query node
transparent (boolean) false
If true, treat pool member address as gateway to server (node) (default false)
username (string)
Username if any for query authentication

Monitor_HTTPS

Additional Monitor class properties available when monitorType = https

Properties:

Name (Type) Default Values Description
adaptive (boolean) false
If true, use adaptive probe timing
adaptiveDivergenceMilliseconds (integer) 500
Probe fails if response latency exceeds mean by this number of milliseconds
adaptiveDivergencePercentage (integer) 100
Probe fails if response latency exceeds mean by this percentage
adaptiveDivergenceType (string) relative absolute, relative Adaptive divergence, ‘absolute’ selects milliseconds, ‘relative’ (default) selects percentage
adaptiveLimitMilliseconds (integer) 1000
Probe fails if response latency exceeds this number of milliseconds
adaptiveWindow (integer) 180
Time window over which the system samples latency (seconds)
ciphers (string) DEFAULT
Ciphersuite selection string
clientCertificate (string)
AS3 pointer to client Certificate declaration, for TLS authentication (optional)

Monitor_ICMP

Additional Monitor class properties available when monitorType = icmp

Properties:

Name (Type) Default Values Description
adaptive (boolean) false
If true, use adaptive probe timing
adaptiveDivergenceMilliseconds (integer) 500
Probe fails if response latency exceeds mean by this number of milliseconds
adaptiveDivergencePercentage (integer) 100
Probe fails if response latency exceeds mean by this percentage
adaptiveDivergenceType (string) relative absolute, relative Adaptive divergence, ‘absolute’ selects milliseconds, ‘relative’ (default) selects percentage
adaptiveLimitMilliseconds (integer) 1000
Probe fails if response latency exceeds this number of milliseconds
adaptiveWindow (integer) 180
Time window over which the system samples latency (seconds)
transparent (boolean) false
If true, treat pool member address as gateway to server (node) (default false)

Monitor_Send_Recv

Additional Monitor class properties available when monitorType = tcp or udp

Properties:

Name (Type) Default Values Description
receive (string)
Mark node up upon receipt of this (backquote-expanded) string
receiveDown (string)  
Mark node down upon receipt of this (backquote-expanded) string (optional; must be empty when ‘reverse’ is true)
reverse (boolean) false
If true, mark node down upon receipt of ‘receive’ string
send (string)
Send this (backquote-expanded) string to node
transparent (boolean) false
If true, treat pool member address as gateway to server (node) (default false)

Monitor_SIP

Additional Monitor class properties available when monitorType = sip

Properties:

Name (Type) Default Values Description
ciphers (string) DEFAULT
Ciphersuite selection string
clientCertificate (string)
AS3 pointer to client Certificate declaration, for TLS authentication (optional)
codesDown (array)
List of status codes meaning service is down (0 matches any code)
codesUp (array)
List of additional (to all 1/2/3xx) status codes meaning service is up (0 matches any code)
headers (string)  
SIP headers to send in probes (if any)–separate by newlines (backquote-expanded)
protocol (string) udp sips, tcp, tls, udp SIP transport protocol
request (string)  
SIP request to send in probes (default empty)

Monitor_SMTP

Additional Monitor class properties available when monitorType = smtp

Properties:

Name (Type) Default Values Description
domain (string)  
Mail domain to check, if any (backquote-expanded)

Monitor_TCP_Half_Open

Additional Monitor class properties available when monitorType = tcp-half-open

Properties:

Name (Type) Default Values Description
transparent (boolean) false
If true, treat pool member address as gateway to server (node) (default false)

NAT_Policy

Configures network address translation policy

Properties:

Name (Type) Default Values Description
class (string)
NAT_Policy
label (Label)
remark (Remark)
rules (array)
A list of NAT rules

NAT_Rule

Network address translation rule

Properties:

Name (Type) Default Values Description
destination (NAT_Rule_Destination)
label (Label)
name (string)
NAT rule name
protocol (string) any any, tcp, udp Specifies the IP protocol against which the packet will be compared
remark (Remark)
source (NAT_Rule_Source)
sourceTranslation (object)
AS3 pointer to NAT source translation declaration

NAT_Rule_Destination

Network address translation destination configuration

Properties:

Name (Type) Default Values Description
addressLists (array)
A list of address lists (each by AS3 pointer or BIG-IP pathname)
portLists (array)
A list of port lists (each by AS3 pointer or BIG-IP pathname)

NAT_Rule_Source

Network address translation source configuration

Properties:

Name (Type) Default Values Description
addressLists (array)
A list of address lists (each by AS3 pointer or BIG-IP pathname)
portLists (array)
A list of port lists (each by AS3 pointer or BIG-IP pathname)

NAT_Source_Translation

Configures a Security network address translation source translation object

Properties:

Name (Type) Default Values Description
addresses (array)
Specifies addresses on which source translation is performed
allowEgressInterfaces (array)
Specifies the egress interfaces (tunnels and VLANs) on which source translation is allowed
class (string)
NAT_Source_Translation
disallowEgressInterfaces (array)
Specifies the egress interfaces (tunnels and VLANs) on which source translation is not allowed
label (Label)
mapping (NAT_Source_Translation_Mapping)
ports (array)
Specifies source ports and port ranges on which source translation is performed
remark (Remark)
type (string)
dynamic-pat, static-nat, static-pat Specifies the type of source translation item

NAT_Source_Translation_Mapping

Configure the mapping settings for translation entries. It is the preservation of a public-side IP address for a client from session to session. Only available if type is dynamic-pat.

Properties:

Name (Type) Default Values Description
mode (string) none address-pooling-paired, endpoint-independent-mapping, none Specifies the mapping mode for translation entries
timeout (integer) 300
Specifies the timeout (in seconds) for address and port mapping

Persist

Declares a persistence method

Properties:

Name (Type) Default Values Description
class (string)
Persist
label (Label)
matchAcrossPools (boolean) false
Specifies that the system can use any pool that contains this persistence record
matchAcrossVirtualAddresses (boolean) false
Specifies that all persistent connections from the same client IP address go to the same node
matchAcrossVirtualPorts (boolean) false
Specifies that all persistent connections from a client IP address that go to the same virtual IP address also go to the same node
mirror (boolean) false
If true, try to maintain persistence even after HA failover of ADC (default false)
overrideConnectionLimit (boolean) false
If true, do not enforce pool member connection limit for persisted connections (default false)
persistenceMethod (string)
cookie, destination-address, hash, msrdp, sip-info, source-address, tls-session-id, universal You may customize each basic persistence method
remark (Remark)

Persist_Addr

Configures an address affinity persistence profile

Properties:

Name (Type) Default Values Description
addressMask (string)
Optional mask selects portion of address used by simple persistence (if omitted the system uses all address bits)
duration (integer) 180
Lifetime of persistence record (seconds, default 180)
hashAlgorithm (string) default carp, default Specifies the algorithm the system uses for hash persistence load balancing. The hash result is the input for the algorithm.

Persist_Hash

Configures a hash persistence profile

Properties:

Name (Type) Default Values Description
bufferLimit (integer) 0
Number of octets to buffer while pattern-matching
count (integer) 0
Number of octets in cookie value to hash; 0 (default) means all
duration (integer) 180
Lifetime of persistence record (seconds, default 180)
endPattern (string)  
Regular expression which matches end of data to hash; default “” averts matching
hashAlgorithm (string) default carp, default Specifies the algorithm the system uses for hash persistence load balancing. The hash result is the input for the algorithm.
iRule (object)
AS3 pointer to iRule if any (declared separately)
startAt (integer) 0
Index of first octet in packet to hash
startPattern (string)  
Regular expression which matches start of data to hash; default “” averts matching

Persist_MSRDP

Configures a Microsoft(r) Remote Display Protocol (MSRDP) persistence profile

Properties:

Name (Type) Default Values Description
duration (integer) 300
Lifetime of persistence record (seconds, default 300)
sessionBroker (boolean) true
If true (default), the system will persist the client to the server chosen by session broker

Persist_SIP

Configures a Session Initiation Protocol (SIP) persistence profile

Properties:

Name (Type) Default Values Description
duration (integer) 180
Lifetime of persistence record (seconds, default 180)
header (string)
Suggested values include: Call-ID, To, From, SIP-ETag, and Subject

Persist_TLS_Session

Configures a Secure Socket Layer (SSL) persistence profile

Properties:

Name (Type) Default Values Description
duration (integer) 300
Lifetime of persistence record (seconds, default 300)

Persist_UIE

Configures a universal persistence profile

Properties:

Name (Type) Default Values Description
duration (integer) 180
Lifetime of persistence record (seconds, default 180)
iRule (object)
AS3 pointer to required iRule (declared separately)

Policy_Action

LTM policy action

Properties:

Name (Type) Default Values Description
type (string)
httpRedirect, waf, forward, drop Selects the LTM policy action this object describes

Policy_Action_Drop

Reset connection

Properties:

Name (Type) Default Values Description
event (string) ssl-client-hello ssl-client-hello, request When to run this event in the request-response cycle

Policy_Action_Forward

Controls where the system forwards a connection

Properties:

Name (Type) Default Values Description
event (string) ssl-client-hello ssl-client-hello, request When to run this event in the request-response cycle
select (Policy_Action_Forward_Select)
Select appropriate location for forwarding the connection based on specified parameters

Policy_Action_Forward_Select

Select appropriate location for forwarding the connection based on specified parameters

Properties:

Name (Type) Default Values Description
pool (object)
AS3 pointer to pool if any (declared separately)
service (object)
AS3 pointer to service if any (declared separately)

Policy_Action_HTTP_Redirect

Redirect an HTTP request to a different URL

Properties:

Name (Type) Default Values Description
event (string) proxy-request proxy-request, request, response When to run this event in the request-response cycle
location (string)
The new URL for which the system will send a redirect response; you can use a Tcl command substitution for this field

Policy_Action_WAF

Control web security

Properties:

Name (Type) Default Values Description
event (string) request client-accepted, proxy-request, request When to run this event in the request-response cycle
policy (object)
AS3 pointer to WAF (ASM) policy declaration

Policy_Compare_Number

Perform a comparison against number values

Properties:

Name (Type) Default Values Description
operand (string) equals equals, less, greater, less-or-equal, greater-or-equal Specifies the comparison that the system should perform with values
values (array)
A list of numbers to do comparisons against

Policy_Compare_String

Perform a comparison against string values

Properties:

Name (Type) Default Values Description
caseSensitive (boolean) false
Specifies if the comparison the system should perform with case sensitivity
operand (string) equals equals, starts-with, ends-with, contains Specifies the comparison that the system should perform with values
values (array)
A list of strings to do comparisons against

Policy_Condition

LTM policy condition

Properties:

Name (Type) Default Values Description
type (string)
httpHeader, httpUri Selects the LTM policy condition this object describes

Policy_Condition_HTTP_Header

Match against any HTTP header

Properties:

Name (Type) Default Values Description
all (Policy_Compare_String)
Match on the full HTTP header
event (string) proxy-request proxy-request, request, proxy-connect, proxy-response, response When to evaluate this condition in the request-response cycle
name (string)
Specify the name of the particular HTTP header whose value you want to use

Policy_Condition_HTTP_URI

Inspect the URI on a request and match on various parts or the entire URI

Properties:

Name (Type) Default Values Description
all (Policy_Compare_String)
Match on the full URI
event (string) request request When to evaluate this condition in the request-response cycle
extension (Policy_Compare_String)
Match on the file extension in the URI (e.g. jpg, html, cgi)
host (Policy_Compare_String)
Match on the hostname in the URI
index (integer)
The numeric order of the item whose value you want to use, start at 1; negative values indicate counting right to left
name (string)
Specify the name of the particular query parameter whose value you want to use
normalized (boolean) false
Normalizes the result to a canonical form to allow consistent comparisons
path (Policy_Compare_String)
Match on the URI path
pathSegment (Policy_Compare_String)
Match a part of the URI path by a numeric index
port (Policy_Compare_Number)
Match on the port number in the URI
queryParameter (Policy_Compare_String)
Match value of the named query parameter from the query string
queryString (Policy_Compare_String)
Match against text in the query string
scheme (Policy_Compare_String)
Match on the scheme (e.g. http, https, ftp, file)
unnamedQueryParameter (Policy_Compare_String)
Match the value of a query parameter by a numeric index instead of by name

Pool

Declares a service pool

Properties:

Name (Type) Default Values Description
class (string)
Pool
label (Label)
loadBalancingMode (string) round-robin dynamic-ratio-member, dynamic-ratio-node, fastest-app-response, fastest-node, least-connections-member, least-connections-node, least-sessions, observed-member, observed-node, predictive-member, predictive-node, ratio-least-connections-member, ratio-least-connections-node, ratio-member, ratio-node, ratio-session, round-robin, weighted-least-connections-member, weighted-least-connections-node Load-balancing mode
members (array)
Set of Pool members
minimumMembersActive (integer) 1
Pool is down when fewer than this number of members are up
minimumMonitors (integer)
Member is down when fewer than minimum monitors report it healthy
monitors (array)
http,https,icmp,tcp-half-open,tcp List of health monitors (each by name or AS3 pointer)
remark (Remark)
reselectTries (integer) 0
Maximum number of attempts to find a responsive member for a connection
serviceDownAction (string) none drop, none, reselect, reset Specifies connection handling when member is non-responsive
slowRampTime (integer) 10
AS3 slowly the connection rate to a newly-active member slowly during this interval (seconds)

Pool_Member

Declares a service-pool member

Properties:

Name (Type) Default Values Description
adminState (string) enable enable, disable, offline Setting adminState to enable will create the node in an operational state. Set to disable to disallow new connections but allow existing connections to drain. Set to offline to force immediate termination of all connections.
bigip (string)
If defined, pathname of existing BIG-IP node
connectionLimit (integer) 0
Maximum concurrent connections to member
dynamicRatio (integer) 1
Specifies a range of numbers that you want the system to use in conjunction with the ratio load balancing method
enable (boolean) true
Maps to BIG-IP pool member state
minimumMonitors (integer)
Member is down when fewer than minimum monitors report it healthy
monitors (array)
http,https,icmp,tcp-half-open,tcp List of monitors (each by name or AS3 pointer)
priorityGroup (integer) 0
Specifies the priority group within the pool for this pool member
rateLimit (integer) -1
Value zero prevents use of member
ratio (integer) 1
Specifies the weight of the pool member for load balancing purposes
remark (Remark)
servicePort (integer)
Service L4 port (optional port-discovery may override)

Security_Log_Profile

Configures a Security log profile

Properties:

Name (Type) Default Values Description
botDefense (Security_Log_Profile_Bot_Defense)
class (string)
Security_Log_Profile
classification (Security_Log_Profile_Classification)
dosApplication (Security_Log_Profile_Dos_Application)
dosNetwork (Security_Log_Profile_Dos_Network)
ipIntelligence (Security_Log_Profile_Ip_Intelligence)
label (Label)
nat (Security_Log_Profile_Nat)
network (Security_Log_Profile_Network)
protocolDns (Security_Log_Profile_Protocol_Dns)
protocolDnsDos (Security_Log_Profile_Protocol_Dns_Dos)
protocolSip (Security_Log_Profile_Protocol_Sip)
protocolSipDos (Security_Log_Profile_Protocol_Sip_Dos)
protocolTransfer (Security_Log_Profile_Protocol_Transfer)
remark (Remark)
sshProxy (Security_Log_Profile_Ssh_Proxy)

Security_Log_Profile_Bot_Defense

Specifies, when enabled, that the system logs events from the Proactive Bot Defense mechanism. Depending on settings, the system logs Illegal requests, Legal requests and BIGIP Challenges.

Properties:

Name (Type) Default Values Description
localPublisher (object)
Specifies, when enabled, a Log Publisher to log events to (Note: This publisher should have a single local-database destination)
logBotSignatureMatchedRequests (boolean) false
This option enables or disables the logging of reported bot signature requests
logCaptchaChallengedRequests (boolean) false
This option enables or disables the logging of captcha challenged requests
logChallengedRequests (boolean) false
This option enables or disables the logging of challenged requests
logIllegalRequests (boolean) true
This option enables or disables the logging of illegal requests
logLegalRequests (boolean) false
This option enables or disables the logging of legal requests
remotePublisher (object)
Enables selecting a Log Publisher that has Splunk enabled

Security_Log_Profile_Classification

Specifies, when enabled, that the system logs events from the Classification engine.

Properties:

Name (Type) Default Values Description
logAllMatches (boolean) false
This option enables or disables the logging of all matches
publisher (object)
Specifies where the system sends log messages

Security_Log_Profile_Dos_Application

Specifies, when enabled, that the system logs detected application DoS attacks

Properties:

Name (Type) Default Values Description
localPublisher (object)
Specifies the local log publisher used for Application DoS attacks (Note: This publisher should have a single local-database destination)
remotePublisher (object)
Specifies the remote log publisher used for Application DoS attacks (Note: This publisher should have ArcSight or Splunk destinations)

Security_Log_Profile_Dos_Network

Specifies, when enabled, that the system logs detected network DoS attacks

Properties:

Name (Type) Default Values Description
publisher (object)
Specifies the name of the log publisher used for logging Network DoS events

Security_Log_Profile_Ip_Intelligence

Specifies, when enabled, that the system logs IP Intelligence events

Properties:

Name (Type) Default Values Description
logTranslationFields (boolean) false
Specifies, when enabled, that the system logs translation values if and when it logs a network firewall event
publisher (object)
Specifies the name of the log publisher used for logging IP Intelligence events
rateLimitAggregate (integer) 4294967295
Defines a rate limit for all combined IP intelligence log messages per second

Security_Log_Profile_Nat

Specifies, when enabled, that the system logs Firewall NAT events

Properties:

Name (Type) Default Values Description
formatEndInboundSession (Security_Log_Profile_Nat_Storage_Format)
formatEndOutboundSession (Security_Log_Profile_Nat_Storage_Format)
formatErrors (Security_Log_Profile_Nat_Storage_Format)
formatQuotaExceeded (Security_Log_Profile_Nat_Storage_Format)
formatStartInboundSession (Security_Log_Profile_Nat_Storage_Format)
formatStartOutboundSession (Security_Log_Profile_Nat_Storage_Format)
logEndInboundSession (boolean) false
Generates event log entries at the end of the incoming connection event for a translated endpoint. Triggered when the system frees the inbound session.
logEndOutboundSession (boolean) false
Generates event log entries at end of translation event for a NAT client. Triggered when the system frees the outbound session.
logErrors (boolean) false
Generates event log entries when a NAT translation errors occur
logQuotaExceeded (boolean) false
Generates event log entries when a NAT client exceeds allocated resources
logStartInboundSession (boolean) false
Generates event log entries at the start of the incoming connection event for a translated endpoint. Triggered when the system creates the inbound session.
logStartOutboundSession (boolean) false
Generates event log entries at start of the translation event for a NAT client. Triggered when the system creates the outbound session.
logSubscriberId (boolean) false
Logs the subscriber ID associated with a subscriber IP address
publisher (object)
Specifies the name of the log publisher used for logging Network Address Translation events
rateLimitAggregate (integer) 4294967295
This option sets the aggregate rate for all the Firewall NAT log events that the system can log per second
rateLimitEndInboundSession (integer) 4294967295
This option rate limits the end inbound session log events per second
rateLimitEndOutboundSession (integer) 4294967295
This option rate limits the end outbound session log events per second
rateLimitErrors (integer) 4294967295
This option rate limits the errors the system logs per second
rateLimitQuotaExceeded (integer) 4294967295
This option rate limits the quota exceeded log events per second
rateLimitStartInboundSession (integer) 4294967295
This option rate limits the start inbound session log events per second
rateLimitStartOutboundSession (integer) 4294967295
This option rate limits the start outbound session log events per second

Security_Log_Profile_Nat_Storage_Format

Specifies the format type for log messages

Properties:

Name (Type) Default Values Description
delimiter (string) .
Specifies a field delimiter in the predefined storage format
fields (array)
Replaces a set of fields in the predefined storage format

Security_Log_Profile_Network

Specifies, when enabled, that the system logs ACL rule matches, TCP events, and/or TCP/IP errors sent to the network firewall

Properties:

Name (Type) Default Values Description
alwaysLogRegion (boolean) false
Specifies, when enabled, that when a geolocation event causes a network firewall event, the system logs the associated IP address
logIpErrors (boolean) false
Specifies, when enabled, that the system logs IP error packets
logRuleMatchAccepts (boolean) false
Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Accept
logRuleMatchDrops (boolean) false
Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Drop
logRuleMatchRejects (boolean) false
Specifies, when enabled, that the system logs packets that match ACL rules configured with action = Reject
logTcpErrors (boolean) false
Specifies, when enabled, that the system logs TCP error packets
logTcpEvents (boolean) false
Specifies, when enabled, that the system logs TCP events (open and close of TCP sessions)
logTranslationFields (boolean) false
Specifies, when enabled, that the system logs translation values if and when it logs a network firewall event
publisher (object)
Specifies the name of the log publisher used for logging Network events
rateLimitAggregate (integer) 4294967295
This option sets the aggregate rate limit that applies to any network logging message
rateLimitIpErrors (integer) 4294967295
This option enables or disables the logging of IP error packets
rateLimitRuleMatchAccepts (integer) 4294967295
This option sets rate limits for the logging of packets that match ACL rules configured with action = Accept or action = Accept Decisively
rateLimitRuleMatchDrops (integer) 4294967295
This option sets rate limits for the logging of packets that match ACL rules configured with action = Accept or action = Accept Decisively
rateLimitRuleMatchRejects (integer) 4294967295
This option sets rate limits for the logging of packets that match ACL rules configured with action = Reject
rateLimitTcpErrors (integer) 4294967295
This option sets rate limits for the logging of TCP error packets
rateLimitTcpEvents (integer) 4294967295
This option sets rate limits for the logging of TCP events on client side
storageFormat (reference)
Specifies the format type for log messages

Security_Log_Profile_Protocol_Dns

Specifies, when enabled, that the system logs DNS security events

Properties:

Name (Type) Default Values Description
logDroppedRequests (boolean) false
Specifies, when enabled, that the system logs dropped DNS requests
logFilteredDroppedRequests (boolean) false
Specifies, when enabled, that the system logs DNS requests dropped due to DNS query/header-opcode filtering. The system does not log DNS requests dropped due to errors in the way the system processes DNS packets.
logMalformedRequests (boolean) false
Specifies, when enabled, that the system logs malformed DNS requests
logMaliciousRequests (boolean) false
Specifies, when enabled, that the system logs malicious DNS requests
logRejectedRequests (boolean) false
Specifies, when enabled, that the system logs rejected DNS requests
publisher (object)
Specifies the name of the log publisher used for logging DNS security events
storageFormat (reference)
Specifies the format type for log messages

Security_Log_Profile_Protocol_Dns_Dos

Specifies, when enabled, that the system logs detected DNS DoS attacks

Properties:

Name (Type) Default Values Description
publisher (object)
Specifies the name of the log publisher used for logging DNS DoS events

Security_Log_Profile_Protocol_Sip

Specifies, when enabled, that the system logs SIP protocol security events

Properties:

Name (Type) Default Values Description
logDroppedRequests (boolean) false
Specifies, when enabled, that the system logs dropped requests
logGlobalFailures (boolean) false
Specifies, when enabled, that the system logs global failures
logMalformedRequests (boolean) false
Specifies, when enabled, that the system logs malformed requests
logRedirectedResponses (boolean) false
Specifies, when enabled, that the system logs redirection responses
logRequestFailures (boolean) false
Specifies, when enabled, that the system logs request failures
logServerErrors (boolean) false
Specifies, when enabled, that the system logs server errors
publisher (object)
Specifies the name of the log publisher used for logging SIP protocol security events
storageFormat (reference)
Specifies the format type for log messages

Security_Log_Profile_Protocol_Sip_Dos

Specifies, when enabled, that the system logs detected SIP DoS attacks

Properties:

Name (Type) Default Values Description
publisher (object)
Specifies the name of the log publisher used for logging SIP DoS events

Security_Log_Profile_Protocol_Transfer

Specifies, when enabled, that the system logs HTTP, FTP, and SMTP protocol security events

Properties:

Name (Type) Default Values Description
publisher (object)
Specifies where the system sends log messages

Security_Log_Profile_Ssh_Proxy

Specifies, when enabled, that the system logs SSH Proxy events

Properties:

Name (Type) Default Values Description
logAllowedChannelAction (boolean) false
Specifies, when enabled, that the system logs allowed channel actions
logClientAuthFail (boolean) false
Specifies the name of the log publisher used for logging SSH Proxy events
logClientAuthPartial (boolean) false
Specifies, when enabled, that the system logs client auth partial events
logClientAuthSuccess (boolean) false
Specifies, when enabled, that the system logs client auth success events
logDisallowedChannelAction (boolean) false
Specifies, when enabled, that the system logs disallowed channel actions
logNonSshTraffic (boolean) false
Specifies, when enabled, that the system logs non-SSH traffic events
logServerAuthFail (boolean) false
Specifies, when enabled, that the system logs server auth failure events
logServerAuthPartial (boolean) false
Specifies, when enabled, that the system logs server auth partial events
logServerAuthSuccess (boolean) false
Specifies, when enabled, that the system logs server auth failure events
logSshTimeout (boolean) false
Specifies, when enabled, that the system logs SSH timeouts
publisher (object)
Specifies the name of the log publisher used for logging SSH Proxy events

Service_Address

Service IP address definition (BIG-IP virtual-address)

Properties:

Name (Type) Default Values Description
arpEnabled (boolean) true
If true (default), the system services ARP requests on this address
class (string)
Service_Address
icmpEcho (string) enable enable, disable, selective If true (default), the system answers ICMP echo requests on this address
label (Label)
remark (Remark)
virtualAddress (string)
The virtual IP address

Service_HTTP

HTTP virtual server

Properties:

Name (Type) Default Values Description
addressStatus (boolean) true
Specifies whether the virtual server will contribute to the operational status of the associated virtual address
allowVlans (array)
Names of existing VLANs to add to this virtual server to allow.
class (string)
Service_HTTP
enable (boolean) true
Virtual server handles traffic only when enabled (default)
fallbackPersistenceMethod (Basic_Persist)
iRules (array)
List iRules for this virtual server (order is significant)
label (Label)
lastHop (string | object) default
Name of built-in last-hop method or AS3 pointer to last-hop pool (default ‘default’ means use system setting)
maxConnections (integer) 0
Specifies the maximum number of concurrent connections you want to allow for the virtual server
mirroring (string) none none, L4 Controls connection-mirroring for high-availability
persistenceMethods (array) cookie
Default ‘cookie’ is generally good
policyFirewallEnforced (object)
AS3 pointer to firewall (ASM) policy declaration
policyFirewallStaged (object)
AS3 pointer to firewall (ASM) policy declaration
policyIAM (object)
AS3 pointer to IAM (APM) policy declaration
policyNAT (object)
AS3 pointer to NAT policy declaration
policyWAF (object)
AS3 pointer to WAF (ASM) policy declaration
pool (object)
AS3 pointer to pool if any (declared separately)
profileHTTP (string | object) basic
HTTP profile; name of built-in or else AS3 pointer
profileHTTPAcceleration (string | object)
Web acceleration profile; name of built-in or else AS3 pointer
profileHTTPCompression (string | object)
HTTP compression profile; name of built-in or else AS3 pointer
profileMultiplex (string | object)
Multiplex (OneConnect) profile; name of built-in or else AS3 pointer
rejectVlans (array)
Names of existing VLANs to add to this virtual server to reject.
remark (Remark)
securityLogProfiles (array)
Specifies the log profile applied to the virtual server
snat (string | object) auto
Name of built-in SNAT method or AS3 pointer to SNAT pool. If ‘self’, the system uses the virtual-server address as SNAT address
translateClientPort (boolean) false
If true, hide client’s port number from server (default false)
translateServerAddress (boolean) true
If true (default), make server-side connection to server address (otherwise, treat server as gateway to virtual-server address)
translateServerPort (boolean) true
If true (default), make server-side connection to server port (otherwise, connect to server on virtual-server port)
virtualAddresses (array)
Virtual server will listen to each IP address in list. To accept connections only from certain subnet(s), replace IP address with array [IP-address, accept-from-subnet]
virtualPort (integer) 80
Default 80 is well-known HTTP port

Service_HTTPS

HTTPS (HTTP+TLS) virtual server

Properties:

Name (Type) Default Values Description
addressStatus (boolean) true
Specifies whether the virtual server will contribute to the operational status of the associated virtual address
allowVlans (array)
Names of existing VLANs to add to this virtual server to allow.
class (string)
Service_HTTPS
enable (boolean) true
Virtual server handles traffic only when enabled (default)
fallbackPersistenceMethod (Basic_Persist)
iRules (array)
List iRules for this virtual server (order is significant)
label (Label)
lastHop (string | object) default
Name of built-in last-hop method or AS3 pointer to last-hop pool (default ‘default’ means use system setting)
maxConnections (integer) 0
Specifies the maximum number of concurrent connections you want to allow for the virtual server
mirroring (string) none none, L4 Controls connection-mirroring for high-availability
persistenceMethods (array)
List of persistence methods (each by name or AS3 pointer). Element 0 is primary (default) persistence method
policyFirewallEnforced (object)
AS3 pointer to firewall (ASM) policy declaration
policyFirewallStaged (object)
AS3 pointer to firewall (ASM) policy declaration
policyNAT (object)
AS3 pointer to NAT policy declaration
pool (object)
AS3 pointer to pool if any (declared separately)
redirect80 (boolean) true
If true, AS3 redirects HTTP traffic to any virtualAddress on port 80 to virtualPort
rejectVlans (array)
Names of existing VLANs to add to this virtual server to reject.
remark (Remark)
securityLogProfiles (array)
Specifies the log profile applied to the virtual server
snat (string | object) auto
Name of built-in SNAT method or AS3 pointer to SNAT pool. If ‘self’, the system uses the virtual-server address as SNAT address
translateClientPort (boolean) false
If true, hide client’s port number from server (default false)
translateServerAddress (boolean) true
If true (default), make server-side connection to server address (otherwise, treat server as gateway to virtual-server address)
translateServerPort (boolean) true
If true (default), make server-side connection to server port (otherwise, connect to server on virtual-server port)
virtualAddresses (array)
Virtual server will listen to each IP address in list. To accept connections only from certain subnet(s), replace IP address with array [IP-address, accept-from-subnet]
virtualPort (integer) 443
Default 443 is well-known HTTPS port

Service_L4

Declares a L4 (FastL4) virtual server

Properties:

Name (Type) Default Values Description
addressStatus (boolean) true
Specifies whether the virtual server will contribute to the operational status of the associated virtual address
allowVlans (array)
Names of existing VLANs to add to this virtual server to allow.
class (string)
Service_L4
enable (boolean) true
Virtual server handles traffic only when enabled (default)
fallbackPersistenceMethod (Basic_Persist)
iRules (array)
List iRules for this virtual server (order is significant)
label (Label)
lastHop (string | object) default
Name of built-in last-hop method or AS3 pointer to last-hop pool (default ‘default’ means use system setting)
layer4 (string) tcp any, tcp, udp, 3pc, a/n, ah, argus, aris, ax.25, bbn-rcc, bna, br-sat-mon, cbt, cftp, chaos, compaq-peer, cphb, cpnx, crdup, crtp, dccp, dcn, ddp, ddx, dgp, dsr, egp, eigrp, emcon, encap, esp, etherip, fc, fire, ggp, gmtp, gre, hip, hmp, hopopt, i-nlsp, iatp, icmp, idpr, idpr-cmtp, idrp, ifmp, igmp, igp, il, ip, ipcomp, ipcv, ipencap, ipip, iplt, ippc, ipv6, ipv6-auth, ipv6-crypt, ipv6-frag, ipv6-icmp, ipv6-nonxt, ipv6-opts, ipv6-route, ipx-in-ip, irtp, isis, iso-ip, iso-tp4, kryptolan, l2tp, larp, leaf-1, leaf-2, manet, merit-inp, mfe-nsp, micp, mobile, mpls-in-ip, mtp, mux, narp, netblt, nsfnet-igp, nvp, ospf, pgm, pim, pipe, pnni, prm, ptp, pup, pvp, qnx, rdp, rsvp, rsvp-e2e-ignore, rvd, sat-expak, sat-mon, scc-sp, scps, sctp, sdrp, secure-vmtp, shim6, skip, sm, smp, snp, sprite-rpc, sps, srp, sscopmce, st, stp, sun-nd, swipe, tcf, tlsp, tp++, trunk-1, trunk-2, ttp, udplite, uti, vines, visa, vmtp, vrrp, wb-expak, wb-mon, wesp, wsn, xnet, xns-idp, xtp The L4 protocol type for this virtual server
maxConnections (integer) 0
Specifies the maximum number of concurrent connections you want to allow for the virtual server
mirroring (string) none none, L4 Controls connection-mirroring for high-availability
persistenceMethods (array) source-address
Default ‘source-address’ is generally good
policyFirewallEnforced (object)
AS3 pointer to firewall (ASM) policy declaration
policyFirewallStaged (object)
AS3 pointer to firewall (ASM) policy declaration
policyNAT (object)
AS3 pointer to NAT policy declaration
pool (object)
AS3 pointer to pool if any (declared separately)
profileL4 (string | object) basic
L4 profile; name of built-in or else AS3 pointer
rejectVlans (array)
Names of existing VLANs to add to this virtual server to reject.
remark (Remark)
securityLogProfiles (array)
Specifies the log profile applied to the virtual server
snat (string | object) auto
Name of built-in SNAT method or AS3 pointer to SNAT pool. If ‘self’, the system uses the virtual-server address as SNAT address
translateClientPort (boolean) false
If true, hide client’s port number from server (default false)
translateServerAddress (boolean) true
If true (default), make server-side connection to server address (otherwise, treat server as gateway to virtual-server address)
translateServerPort (boolean) true
If true (default), make server-side connection to server port (otherwise, connect to server on virtual-server port)
virtualAddresses (array)
Virtual server will listen to each IP address in list. To accept connections only from certain subnet(s), replace IP address with array [IP-address, accept-from-subnet]
virtualPort (integer)
virtual server port

Service_TCP

Declares a TCP virtual server (w/optional TLS)

Properties:

Name (Type) Default Values Description
addressStatus (boolean) true
Specifies whether the virtual server will contribute to the operational status of the associated virtual address
allowVlans (array)
Names of existing VLANs to add to this virtual server to allow.
class (string)
Service_TCP
clientTLS (object)
AS3 pointer to TLS Client declaration
enable (boolean) true
Virtual server handles traffic only when enabled (default)
fallbackPersistenceMethod (Basic_Persist)
iRules (array)
List iRules for this virtual server (order is significant)
label (Label)
lastHop (string | object) default
Name of built-in last-hop method or AS3 pointer to last-hop pool (default ‘default’ means use system setting)
layer4 (string) tcp tcp For TCP virtual server, Layer 4 protocol must be TCP
maxConnections (integer) 0
Specifies the maximum number of concurrent connections you want to allow for the virtual server
mirroring (string) none none, L4 Controls connection-mirroring for high-availability
persistenceMethods (array) source-address
Default ‘source-address’ is generally good
policyEndpoint (object)
AS3 pointer to Endpoint policy declaration
policyFirewallEnforced (object)
AS3 pointer to firewall (ASM) policy declaration
policyFirewallStaged (object)
AS3 pointer to firewall (ASM) policy declaration
policyNAT (object)
AS3 pointer to NAT policy declaration
pool (object)
AS3 pointer to pool if any (declared separately)
profileTCP (string | object) normal
TCP profile; name of built-in or else AS3 pointer
rejectVlans (array)
Names of existing VLANs to add to this virtual server to reject.
remark (Remark)
securityLogProfiles (array)
Specifies the log profile applied to the virtual server
serverTLS (object)
AS3 pointer to TLS Server declaration
snat (string | object) auto
Name of built-in SNAT method or AS3 pointer to SNAT pool. If ‘self’, the system uses the virtual-server address as SNAT address
translateClientPort (boolean) false
If true, hide client’s port number from server (default false)
translateServerAddress (boolean) true
If true (default), make server-side connection to server address (otherwise, treat server as gateway to virtual-server address)
translateServerPort (boolean) true
If true (default), make server-side connection to server port (otherwise, connect to server on virtual-server port)
virtualAddresses (array)
Virtual server will listen to each IP address in list. To accept connections only from certain subnet(s), replace IP address with array [IP-address, accept-from-subnet]
virtualPort (integer)
virtual server TCP port

Service_UDP

Declares a UDP virtual server (w/optional (D)TLS)

Properties:

Name (Type) Default Values Description
addressStatus (boolean) true
Specifies whether the virtual server will contribute to the operational status of the associated virtual address
allowVlans (array)
Names of existing VLANs to add to this virtual server to allow.
class (string)
Service_UDP
clientTLS (object)
AS3 pointer to TLS Client declaration
enable (boolean) true
Virtual server handles traffic only when enabled (default)
fallbackPersistenceMethod (Basic_Persist)
iRules (array)
List iRules for this virtual server (order is significant)
label (Label)
lastHop (string | object) default
Name of built-in last-hop method or AS3 pointer to last-hop pool (default ‘default’ means use system setting)
layer4 (string) udp udp For UDP virtual server, Layer 4 protocol must be UDP
maxConnections (integer) 0
Specifies the maximum number of concurrent connections you want to allow for the virtual server
mirroring (string) none none, L4 Controls connection-mirroring for high-availability
persistenceMethods (array) source-address
Default ‘source-address’ is generally good
policyEndpoint (object)
AS3 pointer to Endpoint policy declaration
policyFirewallEnforced (object)
AS3 pointer to firewall (ASM) policy declaration
policyFirewallStaged (object)
AS3 pointer to firewall (ASM) policy declaration
policyNAT (object)
AS3 pointer to NAT policy declaration
pool (object)
AS3 pointer to pool if any (declared separately)
profileUDP (string) normal
UDP profile; name of built-in or else AS3 pointer
rejectVlans (array)
Names of existing VLANs to add to this virtual server to reject.
remark (Remark)
securityLogProfiles (array)
Specifies the log profile applied to the virtual server
serverTLS (object)
AS3 pointer to TLS Server declaration
snat (string | object) auto
Name of built-in SNAT method or AS3 pointer to SNAT pool. If ‘self’, the system uses the virtual-server address as SNAT address
translateClientPort (boolean) false
If true, hide client’s port number from server (default false)
translateServerAddress (boolean) true
If true (default), make server-side connection to server address (otherwise, treat server as gateway to virtual-server address)
translateServerPort (boolean) true
If true (default), make server-side connection to server port (otherwise, connect to server on virtual-server port)
virtualAddresses (array)
Virtual server will listen to each IP address in list. To accept connections only from certain subnet(s), replace IP address with array [IP-address, accept-from-subnet]
virtualPort (integer)
Virtual server UDP port

SNAT_Pool

Declares a list of SNAT addresses

Properties:

Name (Type) Default Values Description
class (string)
SNAT_Pool
label (Label)
remark (Remark)
snatAddresses (array)
List of SNAT addresses– may include both IPv4 and IPv6

TCP_Profile

Configures a Transmission Control Protocol (TCP) profile

Properties:

Name (Type) Default Values Description
abc (boolean) true
If true (default), AS3 adjusts the congestion window per rfc3465
ackOnPush (boolean) true
If true (default), the system immediately acknowledges segments with the PSH flag set
autoProxyBufferSize (boolean) true
If true (default), AS3 adjusts the proxy buffer size automatically to optimize throughput
autoReceiveWindowSize (boolean) true
If true (default), AS3 adjusts the receive window size automatically to optimize throughput
autoSendBufferSize (boolean) true
If true (default), AS3 adjusts the send buffer size automatically to optimize throughput
class (string)
TCP_Profile
closeWaitTimeout (integer) 5
Number of seconds (default 5) connection will remain in LAST-ACK state before exiting. Value -1 means indefinite, limited by maximum retransmission timeout
congestionControl (string) woodside cdg, chd, cubic, high-speed, illinois, new-reno, none, reno, scalable, vegas, westwood, woodside Selects TCP congestion-control algorithm (default ‘woodside’)
congestionMetricsCache (boolean) true
If true (default), the system may cache congestion metrics to inform the congestion control algorithm
congestionMetricsCacheTimeout (integer) 0
Number of seconds for which entries in the congestion metrics cache are valid (default 0 means use system default)
deferredAccept (boolean) false
If true, ADC will defer allocating resources to a connection until some payload data has arrived from the client (default false). This may help minimize the impact of certain DoS attacks but adds undesirable latency under normal conditions. Note: ‘deferredAccept’ is incompatible with server-speaks-first application protocols
delayedAcks (boolean) true
If true (default), the system may coalesce multiple adjacent ACK responses
delayWindowControl (boolean) false
If true, AS3 uses queueing delay as well as packet loss to estimate congestion (default false)
dsack (boolean) false
If true, AS3 uses rfc2883 duplicate selective-acknowledgements extension (default false). Do not enable this option unless you are certain all peers support D-SACK
earlyRetransmit (boolean) true
If true (default), AS3 uses rfc5827 Early Retransmit recovery
ecn (boolean) true
If true (default), AS3 may send explicit congestion notification (ECN) flags (CWR, ECE) to peers
enhancedLossRecovery (boolean) true
If true (default), AS3 uses Selective ACK data to increase throughput
fastOpen (boolean) true
If true (default), the system can use the TCP Fast Open protocol extension to reduce latency by sending payload data with initial SYN
fastOpenCookieExpiration (integer) 21600
Sets maximum lifetime in seconds (default 21600 = six hours) of TCP Fast Open cookies
finWait2Timeout (integer) 300
Number of seconds (default 300) connection will remain in LAST-ACK state before closing. Value -1 means indefinite, limited by maximum retransmission timeout
finWaitTimeout (integer) 5
Number of seconds (default 5) connection will remain in FIN-WAIT-1 or closing state before exiting. Value -1 means indefinite, limited by maximum retransmission timeout
idleTimeout (integer) 300
Number of seconds (default 300; may not be 0) connection may remain idle before it becomes eligible for deletion. Value -1 (not recommended) means infinite
initCwnd (integer) 16
Sets the initial congestion-window size (default 16) in multiples of MSS (not in octets)
initRwnd (integer) 16
Sets the initial receive-window size (default 16) in multiples of MSS (not in octets)
ipDfMode (string) pmtu clear, pmtu, preserve, set Controls DF (Don’t Fragment) flag in outgoing packets. Value ‘pmtu’ (default) sets DF based on IP PMTU value. Value ‘preserve’ copies DF from received packets. Value ‘set’ forces DF true in all outgoing packets. Value ‘clear’ forces DF false in all outgoing packets
ipTosToClient (integer | string) 0
Specifies the IP DSCP/TOS value in packets sent to clients (default 0). Numeric values in this property are decimal representations of eight-bit numbers, of which the leftmost six bits are the DSCP per rfc2474 (and the system uses the rightmost two bits for congestion signaling when ‘ecn’ is true). You may have to calculate the value of this property by multiplying a DSCP code, such as CS5+EF = 46, by four to obtain the proper ‘ipTosToClient’ value, such as 184. Value ‘pass-through’ sets DSCP from the initial server-side value. Value ‘mimic’ copies DSCP from the most-recently received server-side packet (allowing DSCP to vary during the life of a connection)
keepAliveInterval (integer) 1800
Number of seconds (default 1800) between keep-alive probes
label (Label)
limitedTransmit (boolean) true
When true (default), the system can use rfc3042 limited transmit recovery scheme
linkQosToClient (integer | string) 0
Specifies the Layer-2 QOS code in packets sent to clients (default 0). Ethernet-type networks recognize codes from 0 to 7. Value ‘pass-through’ sets QOS from the initial server-side value
maxRetrans (integer) 8
Sets maximum number of times the system may retransmit a segment (default 8)
maxSegmentSize (integer) 0
Sets MSS advertised to peer. Value 0 (default) will set MSS automatically in proportion to interface MTU. Default 0 is usually the best choice
md5Signature (boolean) false
If true, the system signs TCP headers using MD5 per rfc2385 (default false)
md5SignaturePassphrase (object)
Passphrase from which the system derives the key for MD5 signatures (MACs) when ‘md5signature’ is true
minimumRto (integer) 1000
Minimum retransmission timeout in milliseconds (default 1000)
mptcp (string) disable disable, enable, passthrough Value ‘disable’ (default) excludes use of Multipath TCP (MPTCP) through virtual server. Value ‘enable’ means virtual server will accept and participate in MPTCP connections. Value ‘passthrough’ means MPTCP packets may pass through virtual server
mptcpCsum (boolean) false
If true, the system calculates MPTCP checksums (default false)
mptcpCsumVerify (boolean) false
If true, the system verifies MPTCP checksums (default false)
mptcpFallback (string) reset accept, active-accept, reset, retransmit Selects action on fallback from MPTCP to ordinary TCP
mptcpFastJoin (boolean) false
If true, the system may send data with MP_JOIN SYN packet, reducing connection latency (default false)
mptcpIdleTimeout (integer) 300
Number of seconds (default 300) connection may remain idle before it becomes eligible for deletion
mptcpJoinMax (integer) 5
Limit on number of subflows which the system may add to the MPTCP connection (default 5)
mptcpMakeAfterBreak (boolean) false
If true, the system can add additional subflows during the ‘mptcpTimeout’ period, even if the ADC is not currently handling an active connection (default false)
mptcpNoJoinDssAck (boolean) false
If true, no DSS option will sent with MP_JOIN ACK packet (default false)
mptcpRetransmitMin (integer) 1000
Minimum value in milliseconds (default 1000) of MPTCP retransmission timer
mptcpRtoMax (integer) 5
Maximum number of retransmission timeouts which may occur before the system declares a subflow dead
mptcpSubflowMax (integer) 6
Maximum number of subflows per connection (default 6)
mptcpTimeout (integer) 3600
Number of seconds (default 3600) after which the system may expunge an MPTCP session with no active flow
nagle (string) auto disable, enable, auto Value ‘enable’ means to use Nagle’s algorithm to minimize the transmission of short TCP segments (note: Nagle’s algorithm yields undesirable results with many application protocols). Value ‘auto’ (default) means the ADC will choose automatically whether to enable Nagle’s algorithm. Value ‘disable’ averts application of Nagle’s algorithm
pktLossIgnoreBurst (integer) 0
Modulates use of congestion control when losing multiple packets. Value 0 (default) means to perform congestion control if any packet loss occurs. Higher values increase tolerance for lost packets before signaling congestion
pktLossIgnoreRate (integer) 0
Sets threshold of packet loss rate (lost-packets/million-packets) above which the system performs congestion control. Value 0 (default) means to perform congestion control if any packet loss occurs. Higher values increase tolerance for lost packets before signaling congestion
proxyBufferHigh (integer) 262144
The system closes the receive window when the number of octets in proxy buffer rises above this value
proxyBufferLow (integer) 196608
The system opens the receive window when the number of octets in proxy buffer falls below this value
proxyMSS (boolean) true
If true (default), the MSS value advertised on the server side will match that negotiated with the client, if permitted by MTU and other constraints
proxyOptions (boolean) false
If true, TCP options such as timestamp advertised on the server side will match those negotiated with client (default false)
pushFlag (string) auto auto, default, none, one Controls when ADC sets PSH flag in outbound TCP segments. Limiting the sending of segments with PSH improves performance. Value ‘auto’ (recommended) sets PSH according to a system algorithm optimal in most cases. Value ‘default’ (not recommended) sets the PUSH flag in every segment which happens to empty the send buffer. Value ‘none’ prevents use of the PSH flag, and ‘one’ means the system sets PSH only when FIN is, at the end of a connection
ratePace (boolean) true
If true (default), system will automatically pace rate of data transmission to optimize throughput
ratePaceMaxRate (integer) 0
Limit maximum data-transmission rate in octets/second to this value when ‘ratePace’ is true. Default 0 means choose maximum rate automatically
receiveWindowSize (integer) 131072
Maximum size of receive window (octets, default 131072)
remark (Remark)
resetOnTimeout (boolean) true
If true (default), connections which time out will be reset (that is, the system will send an RST packet to the peer) before the system expunges them. Value false is not recommended
retransmitThreshold (integer) 3
Specifies the number of duplicate ACKs to start fast recovery
selectiveAcks (boolean) true
If true (default), the system negotiates rfc2018 Selective Acknowledgements with peers
selectiveNack (boolean) false
If true, the system negotiates Selective Negative Acknowledgements with peers (default false)
sendBufferSize (integer) 262144
Maximum size of send buffer (octets, default 262144)
slowStart (boolean) true
If true (default), AS3 adjusts the initial window size per rfc3390. This generally makes connections start more quickly, NOT more slowly
synCookieEnable (boolean) true
If true (default), the system may use SYN cookies to avert connection-table overflow (for example, from DoS attacks)
synCookieWhitelist (boolean) false
If true, after a client responds successfully to a SYN cookie challenge, the system accepts additional connection requests from that client without challenge for 30 seconds (default false)
synMaxRetrans (integer) 3
Maximum number of times the system retransmits a SYN when it does not receive a SYN+ACK (default 3)
synRtoBase (integer) 3000
Number of milliseconds (default 3000) to which the system initially sets the SYN retransmission timer. The system adjusts the timer after each retransmission to implement binary-exponential-backoff
tailLossProbe (boolean) true
If true (default), the system uses the Tail Loss Probe scheme to reduce retransmission timeouts
tcpOptions (array)
Selects which TCP Option values the system captures for reference by iRules
timestamps (boolean) true
If true (default and recommended), AS3 enables rfc1323 timestamps
timeWaitRecycle (boolean) true
If true (default), the system reuses connection resources immediately when it receives a SYN during the TIME-WAIT period
timeWaitTimeout (integer) 2000
Number of milliseconds (default 2,000) connection will remain in TIME-WAIT state before closing. Value -1 means indefinite
ttlIPv4 (integer) 255
TTL the system sets in outgoing IPv4 packets
ttlIPv6 (integer) 64
TTL the system sets in outgoing IPv6 packets
ttlMode (string) proxy decrement, preserve, proxy, set Controls IP TTL in outgoing packets. Value ‘set’ forces TTL to value of property ‘ttlIPv4’ or ‘ttlIPv6’ as appropriate. Value ‘proxy’ (default) forces TTL to the default value for IPv4 or IPv6 as appropriate. Value ‘preserve’ copies TTL from received packet. Value ‘decrement’ sets TTL to one less than received packet’s TTL
verifiedAccept (boolean) false
If true, the system must establish a server-side connection before a it accepts a corresponding client-side connection (default false). Value ‘true’ is incompatible with iRules
zeroWindowTimeout (integer) 20000
Number of milliseconds (default 20,000) connection will persist with window-size of zero (effective timeout is value rounded up to the nearest multiple of 5000). Value -1 means indefinite

Tenant

Declares a Tenant

Properties:

Name (Type) Default Values Description
class (string)
Tenant
constants (Constants)
controls (Controls)
defaultRouteDomain (integer) 0
Selects the default route domain for IP traffic to and from this Tenant’s application resources (note: affects declared IP addresses which do not include a %RD route-domain specifier). You must choose an existing route domain–this option cannot create one. Route domain 0 (default) is always available
enable (boolean) true
Tenant handles traffic only when enabled (default)
label (Label)
remark (Remark)
Shared (Application_Shared)
verifiers (object)
Data (in ‘key’:’value’ properties) used to verify automated tests. Ordinary declarations do not need this

TLS_Client

TLS client parameters (connections leaving ADC)

Properties:

Name (Type) Default Values Description
ciphers (string) DEFAULT
Ciphersuite selection string
class (string)
TLS_Client
clientCertificate (string)
AS3 pointer to client Certificate declaration (optional)
ignoreExpired (boolean) false
If false (default) drop connections with expired server certificates
ignoreUntrusted (boolean) false
If false (default) drop connections with untrusted server certificates
label (Label)
remark (Remark)
sendSNI (string) none
FQDN to send in SNI (optional)
serverName (string) none
FQDN which server certificate must match (optional)
sessionTickets (boolean) false
If false (default) do not use rfc5077 session tickets
trustCA (string)
CA’s trusted to validate server certificate; ‘generic’ (default) or else AS3 pointer to declaration of CA Bundle
validateCertificate (boolean) false
If false (default) accept any cert from server, else validate server cert against trusted CA bundle

TLS_Server

TLS server parameters (connections arriving to ADC)

Properties:

Name (Type) Default Values Description
authenticationFrequency (string) one-time one-time, every-time Client certificate authentication frequency
authenticationInviteCA (object)
AS3 pointer to declaration of CA Bundle used to invite client certificates
authenticationMode (string) ignore ignore, request, require Client certificate authentication mode
authenticationTrustCA (object)
AS3 pointer to declaration of CA Bundle used to validate client certificates
certificates (array)
Primary and (optional) additional certificates (order is significant, element 0 is primary cert)
ciphers (string) DEFAULT
Ciphersuite selection string
class (string)
TLS_Server
label (Label)
remark (Remark)
requireSNI (boolean) false
When a client sends no or unknown SNI and Require SNI is false (default), the system uses the primary certificate, otherwise the system rejects the client

UDP_Profile

Configures a User Datagram Protocol (UDP) profile

Properties:

Name (Type) Default Values Description
allowNoPayload (boolean) false
When true, forward UDP datagrams with empty payloads (default false)
bufferMaxBytes (integer) 655350
Limit to number of octets which the system may buffer for a UDP flow (default 655350)
bufferMaxPackets (integer) 0
Limit to number of packets which the system may buffer for a UDP flow (default 0)
class (string)
UDP_Profile
datagramLoadBalancing (boolean) false
When true, process UDP datagrams independently, without recognizing flows (default false)
idleTimeout (integer) 60
Number of seconds (default 60) flow may remain idle before it becomes eligible for deletion. Value 0 allows system to recover per-flow resources whenever convenient (always safe with UDP). Value -1 means indefinite (not recommended)
ipDfMode (string) pmtu clear, pmtu, preserve, set Controls DF (Don’t Fragment) flag in outgoing datagrams. Value ‘pmtu’ (default) sets DF based on IP PMTU value. Value ‘preserve’ copies DF from received datagram. Value ‘set’ forces DF true in all outgoing datagrams. Value ‘clear’ forces DF false in all outgoing datagrams
ipTosToClient (integer | string) 0
Specifies the IP TOS/DSCP value in packets sent to clients (default 0). Numeric values in this property are decimal representations of eight-bit numbers, of which the leftmost six bits are the DSCP code per rfc2474 (and the rightmost two bits reserved). You may have to calculate the value of this property by multiplying a DSCP code, such as CS5+EF = 46, by four, to obtain the ‘ipTosToClient’ value, such as 184. Value ‘pass-through’ sets DSCP from the initial server-side value. Value ‘mimic’ copies DSCP from the most-recently received server-side packet (allowing DSCP to vary during the life of a connection)
label (Label)
linkQosToClient (integer | string) 0
Specifies the Layer-2 QOS value in packets sent to clients (default 0). Ethernet-type networks recognize numeric codes from 0 to 7. Value ‘pass-through’ sets QOS from the initial server-side value
proxyMSS (boolean) false
When true, MSS advertised on the server side will match that negotiated with the client, if permitted by MTU and other constraints (default false)
remark (Remark)
ttlIPv4 (integer) 255
TTL the system sets in outgoing IPv4 datagrams
ttlIPv6 (integer) 64
TTL the system sets in outgoing IPv6 datagrams
ttlMode (string) proxy decrement, preserve, proxy, set Controls IP TTL in outgoing datagrams. Value ‘set’ forces TTL to value of property ‘ttlIPv4’ or ‘ttlIPv6’ as appropriate. Value ‘proxy’ forces TTL to the default value for IPv4 or IPv6 as appropriate. Value ‘preserve’ copies TTL from received datagram. Value ‘decrement’ sets TTL to one less than received datagrams’s TTL
useChecksum (boolean) false
When true, system will validate UDP checksums for IPv4 datagrams (default false). Checksums are always validated for IPv6

WAF_Policy

A Web Application Firewall Policy

Properties:

Name (Type) Default Values Description
class (string)
WAF_Policy
file (string)
The absolute file path for the ASM policy stored on the BIG-IP
ignoreChanges (boolean) false
If false (default), the system updates the policy in every AS3 declaration deployment. If true, AS3 creates the policy on first deployment, and leaves it untouched afterwards
label (Label)
remark (Remark)
url (string)
The URL to pull the ASM policy from