Non-HTTP Services

This section contains examples of declarations that create non-HTTP services or objects, such as TCP, UDP, and so on. Also see GSLB examples.

Use the index on the right to locate specific examples.

Important

Most of the example declarations have been updated in the documentation for BIG-IP AS3 3.20 to remove any template that was specified, and rename any virtual services that used the name serviceMain to service. In BIG-IP AS3 3.20, the generic template is the default, which allows services to use any name.

This also means that many of these declarations on a version prior to 3.20 they will fail unless you add a template. See this FAQ entry and this Troubleshooting entry for more information.

UDP virtual service

This example is for a UDP DNS load balancer service, and creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_non_http_01.
  • A UDP virtual server named service on port 53.
  • A pool named Pool1 monitored by the default ICMP health monitor.
{
  "class": "AS3",
  "action": "deploy",
  "declaration": {
    "class": "ADC",
    "schemaVersion": "3.0.0",
    "id": "UDP_DNS_Sample",
    "label": "UDP_DNS_Sample",
    "remark": "Sample of a UDP DNS Load Balancer Service",
    "Sample_non_http_01": {
      "class": "Tenant",
      "DNS_Service": {
        "class": "Application",
        "service": {
          "class": "Service_UDP",
          "virtualPort": 53,
          "virtualAddresses": [
            "10.1.20.121"
          ],
          "pool": "Pool1"
        },
        "Pool1": {
          "class": "Pool",
          "monitors": [
            "icmp"
          ],
          "members": [
            {
              "servicePort": 53,
              "serverAddresses": [
                "10.1.10.100"
              ]
            },
            {
              "servicePort": 53,
              "serverAddresses": [
                "10.1.10.101"
              ]
            }
          ]
        }
      }
    }
  }
 }

Back to top


TCP load-balanced to ICAP with custom monitor

This example creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_non_http_02.
  • A TCP virtual server named service on port 1344 (called _A1 in the BIG-IP GUI).
  • A TCP profile using the mptcp-mobile-optimized parent.
  • A pool named svc_pool containing two members (also using port 1344).
  • A custom TCP health monitor with custom Send and Receive strings for ICAP.
{
  "class": "AS3",
  "action": "deploy",
  "persist": true,
  "declaration": {
    "class": "ADC",
    "schemaVersion": "3.0.0",
    "id": "123456abcd",
    "label": "Sample TCP 1",
    "remark": "TCP load-balanced to ICAP with custom monitor",
    "Sample_non_http_02": {
      "class": "Tenant",
      "A1": {
        "class": "Application",
        "service": {
          "class": "Service_TCP",
          "virtualAddresses": [
            "10.0.5.10"
          ],
          "virtualPort": 1344,
          "pool": "svc_pool"
        },
        "svc_pool": {
          "class": "Pool",
          "monitors": [{
            "use": "icap_monitor"
          }],
          "members": [{
            "servicePort": 1344,
            "serverAddresses": [
              "192.0.5.10",
              "192.0.5.11"
            ]
          }]
        },
        "icap_monitor": {
          "class": "Monitor",
          "monitorType": "tcp",
          "send": "OPTIONS icap://icap.example.net/ ICAP/1.0\r\nUser-Agent: f5-ADC\r\n\r\n",
          "receive": "ICAP/1.0 200 OK",
          "adaptive": false
        }
      }
    }
  }
}

Back to top


Using a FIX profile and data groups in a declaration

This example shows how you can create a FIX (Financial Information eXchange) Profile which is commonly used for electronic trading. It also shows how the tag substitution mapping can be configured using data groups. Note: Some FIX features may require appropriate licensing. For more information, see https://www.f5.com/pdf/solution-profiles/fix-solution-profile.pdf. This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_non_http_04.
  • A standard TCP service named service with a pool named poolWeb.
  • A FIX Profile.
  • A tag substitution mapping using data groups.
  • Three types of referenced data groups: (new) internal, (new) external, and an external data group from an existing data-group file.
{
    "class": "ADC",
    "schemaVersion": "3.0.0",
    "id": "profileFix",
    "label": "sample 23 FIX profile",
    "remark": "Sample Application with FIX Profile",
    "Sample_non_http_04": {
        "class": "Tenant",
        "appWeb": {
            "class": "Application",
            "service": {
                "class": "Service_TCP",
                "virtualAddresses": [
                    "192.0.2.21"
                ],
                "virtualPort": 100,
                "pool": "poolWeb",
                "profileTCP": "normal",
                "profileFIX": {
                    "use": "profileFIXcustom"
                }
            },
            "poolWeb": {
                "class": "Pool",
                "monitors": [
                    "tcp-half-open"
                ],
                "members": [
                    {
                        "servicePort": 80,
                        "serverAddresses": [
                            "192.0.2.12",
                            "192.0.2.13"
                        ]
                    }
                ]
            },
            "profileFIXcustom": {
                "class": "FIX_Profile",
                "label": "test",
                "parentProfile": {
                    "bigip": "/Common/fix"
                },
                "errorAction": "drop-connection",
                "fullLogonParsingEnabled": false,
                "messageLogPublisher": {
                    "bigip": "/Common/local-db-publisher"
                },
                "reportLogPublisher": {
                    "bigip": "/Common/local-db-publisher"
                },
                "quickParsingEnabled": true,
                "responseParsingEnabled": true,
                "statisticsSampleInterval": 45,
                "senderTagMappingList": [
                    {
                        "senderId": "ExistingInternalDG",
                        "tagDataGroup": {
                            "bigip": "/Common/testInternalDG"
                        }
                    },
                    {
                        "senderId": "ExistingExternalDG",
                        "tagDataGroup": {
                            "bigip": "/Common/testExternalDG",
                            "isExternal": true
                        }
                    },
                    {
                        "senderId": "RefInternalDG",
                        "tagDataGroup": {
                            "use": "dataGroupRefInternal"
                        }
                    },
                    {
                        "senderId": "RefExternalDG",
                        "tagDataGroup": {
                            "use": "dataGroupRefExternal"
                        }
                    },
                    {
                        "senderId": "RefExternalDGFile",
                        "tagDataGroup": {
                            "use": "dataGroupRefExistingFileNoDG"
                        }
                    }
                ]
            },
            "dataGroupRefInternal": {
                "class": "Data_Group",
                "label": "Tag values mapping",
                "storageType": "internal",
                "name": "Internal Int",
                "keyDataType": "integer",
                "records": [
                    {
                        "key": 121212,
                        "value": "Summer"
                    },
                    {
                        "key": 3434,
                        "value": "Internal Field: \"see guide\""
                    }
                ]
            },
            "dataGroupRefExternal": {
                "class": "Data_Group",
                "label": "From URL or file path",
                "storageType": "external",
                "keyDataType": "string",
                "externalFilePath": "http://yourfile.yourdomain.com",
                "ignoreChanges": true,
                "separator": ":"
            },
            "dataGroupRefExistingFileNoDG": {
                "class": "Data_Group",
                "label": "From existing data-group file",
                "storageType": "external",
                "keyDataType": "string",
                "dataGroupFile": {
                    "bigip": "/Common/dataGroupFileName"
                }
            }
        }
    }
}

Back to top


Using tcpOptions in a TCP Profile

This simple example declaration shows how you use TCP Options for use in a TCP profile. This allows to specify which of the TCP Header option number fields should be collected and stored for iRules. First and Last determines if the first or last appearance of the field is stored. For information on TCP Options, see https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xml. For information on using TCP options in iRules, see https://community.f5.com/t5/technical-articles/accessing-tcp-options-from-irules/ta-p/287183.

  • Partition (tenant) named Sample_non_http_06.
  • A TCP profile named pTcpOptions that uses tcpOptions.
{
    "class": "ADC",
    "schemaVersion": "3.6.0",
    "id": "TEST_TCP_OPTIONS",
    "Sample_non_http_06": {
      "class": "Tenant",
      "TEST_TCP_Profile": {
        "class": "Application",
        "pTcpOptions" : {
            "class": "TCP_Profile",
            "tcpOptions": [
                {
                    "option": 8,
                    "when": "first"
                },
                {
                    "option": 28,
                    "when": "last"
                }
            ]
        }
      }
    }
  }

Back to top


Using existing FTP and SIP profiles in a declaration

This example shows how you can use existing SIP and FTP profiles in a declaration. In this example, our BIG-IP system already has testSIP and testFTP profiles in the Common partition. See the Schema Reference for usage options and information.

Note

In BIG-IP AS3 3.39 and later, you can also reference a SIP profile from the Service_UDP class.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_profile_03.
  • Two TCP services (virtual servers) named service, with Descriptions of A1 and A2.
  • A profileSIP object that references our existing testSIP profile.
  • A profileFTP object that references our existing testFTP profile.
{
    "class": "AS3",
    "action": "deploy",
    "persist": true,
    "declaration": {
       "class": "ADC",
       "schemaVersion": "3.0.0",
       "id": "fghijkl7890",
       "label": "existing SIP and FTP profiles",
       "Sample_profile_03": {
          "class": "Tenant",
          "A1": {
             "class": "Application",
             "service": {
                "class": "Service_TCP",
                "virtualAddresses": [
                   "10.0.6.100"
                ],
                "virtualPort": 443,
                "profileSIP":  {
                    "bigip": "/Common/testSIP"
             },
                "pool": "tcp_pool"
             },
            "tcp_pool": {
                "class": "Pool",
                "monitors": [
                   "tcp"
                ],
                "members": [{
                   "servicePort": 443,
                   "serverAddresses": [
                      "192.0.6.10",
                      "192.0.6.11"
                   ]
                }]
             }
          },

         "A2": {
             "class": "Application",
             "service": {
                "class": "Service_TCP",
                "virtualAddresses": [
                   "10.0.6.100"
                ],
                "virtualPort": 443,
                "profileFTP":  {
                    "bigip": "/Common/testFTP"
             },
                "pool": "ftp_pool"
             },

             "ftp_pool": {
                "class": "Pool",
                "monitors": [
                   "tcp"
                ],
                "members": [{
                   "servicePort": 21,
                   "serverAddresses": [
                      "192.0.6.10",
                      "192.0.6.11"
                   ]
                }]
             }
          }
       }     
    }
}

Back to top


Creating an FTP profile in a declaration

This example shows how you can create an FTP profile in a declaration (the previous example showed how to use an existing FTP profile).

See FTP_Profile in the Schema Reference for more usage options and information.

New in BIG-IP AS3 3.43
BIG-IP AS3 3.43 adds the ability to include an ALG Log Profile and log publisher to an FTP profile, allowing flexibility when setting logging parameters.

Important

In the following example, the algLogProfile and logPublisher properties require the CGNAT module to be provisioned and BIG-IP version to be 15.1 or higher.

This declaration creates the following objects on the BIG-IP (NOTE If you attempt to use this declaration on an AS3 version prior to 3.43, it will fail. Remove the ALG profile and log publisher for previous versions):

  • Partition (tenant) named TEST_FTP_Profile.
  • An Application named Application
  • A virtual server named service that references the FTP profile
  • A FTP profile named sampleFTPprofile which includes an ALG Log profile and log publisher.
{
    "class": "ADC",
    "schemaVersion": "3.43.0",
    "id": "FTP_Profile",
    "TEST_FTP_Profile": {
        "class": "Tenant",
        "Application": {
            "class": "Application",
            "service": {
                "class": "Service_TCP",
                "virtualAddresses": [
                    "192.0.2.210"
                ],
                "virtualPort": 10,
                "profileFTP": {
                    "use": "sampleFTPprofile"
                }
            },
            "sampleFTPprofile": {
                "class": "FTP_Profile",
                "remark": "description",
                "port": 300,
                "ftpsMode": "disallow",
                "enforceTlsSessionReuseEnabled": true,
                "activeModeEnabled": false,
                "securityEnabled": true,
                "translateExtendedEnabled": false,
                "inheritParentProfileEnabled": true,
                "algLogProfile": {
                    "bigip": "/Common/alg_log_profile"
                },
                "logPublisher": {
                    "bigip": "/Common/local-db-publisher"
                }
            }
        }
    }
}

Back to top


Creating a TFTP profile in a declaration

This updated example shows how you can create a TFTP (Trivial File Transfer Protocol) profile in a declaration using BIG-IP AS3 3.43 and later. In previous versions of BIG-IP AS3, you could reference an existing profile, but not create one.

The TFTP profile allows you to configure the BIG-IP system to read and write files from or to a remote server. See the Using the TFTP ALG profile to transfer files chapter of the BIG-IP documentation for detailed information.

See TFTP_Profile in the Schema Reference for information on available properties and AS3 usage options.

Important

In the following example, the algLogProfile and logPublisher properties require the CGNAT module to be provisioned and BIG-IP version to be 15.1 or higher.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Example_Service_UDP.
  • An Application named Application.
  • A virtual service named service that references the TFTP profile
  • A TFTP profile named TFTP_profile with a number of configured properties.
  • An ALG Log Profile named ALG_Log_profile with a number of configured properties.
{
    "class": "ADC",
    "schemaVersion": "3.43.0",
    "Example_Service_UDP": {
        "class": "Tenant",
        "Application": {
            "class": "Application",
            "service": {
                "class": "Service_UDP",
                "virtualAddresses": [
                    "1.1.1.10"
                ],
                "virtualPort": 10,
                "profileTFTP": {
                    "use": "TFTP_profile"
                }
            },
            "TFTP_profile": {
                "class": "TFTP_Profile",
                "remark": "My Remark",
                "idleTimeout": "indefinite",
                "algLogProfile": {
                    "use": "ALG_Log_profile"
                },
                "logPublisher": {
                    "bigip": "/Common/local-db-publisher"
                }
            },
            "ALG_Log_profile": {
                "class": "ALG_Log_Profile",
                "remark": "My Remark",
                "csvFormat": true,
                "startControlChannel": {
                    "action": "enabled",
                    "includeDestination": false
                },
                "endControlChannel": {
                    "action": "disabled",
                    "includeDestination": true
                },
                "startDataChannel": {
                    "action": "backup-allocation-only",
                    "includeDestination": false
                },
                "endDataChannel": {
                    "action": "enabled",
                    "includeDestination": true
                },
                "inboundTransaction": {
                    "action": "enabled"
                }
            }
        }
    }
}

Back to top


Setting BBR Congestion Control in a TCP profile with AS3

This simple example shows how you can now use bbr as a Congestion Control option in the TCP profile. This feature is only available in BIG-IP versions 14.1 and later. When Congestion Control is set to bbr, the system uses a TCP algorithm that is optimized to achieve higher bandwidths and lower latencies. See the Overview of the TCP profile (14.x) for detailed information.

See TCP_Profile in the Schema Reference for usage options.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Example_BBR_CC.
  • A virtual service named BBRcc that only creates a TCP Profile with Congestion Control set to bbr.
{
    "class": "ADC",
    "schemaVersion": "3.14.0",
    "id": "TCP_Profile",
    "Example_BBR_CC": {
        "class": "Tenant",
        "Application": {
            "class": "Application",
            "BBRcc": {
                "class": "TCP_Profile",
                "congestionControl": "bbr"
            }
        }
    }
}

Back to top


Configuring SCTP services and referencing SCTP profiles in a declaration

This example shows how you can reference existing SCTP profiles in a BIG-IP AS3 declaration. It also shows the new Service_SCTP class, which creates a virtual service that uses the SCTP protocol. For information on BIG-IP and the SCTP profile, see SCTP Profile Type in the product manual. For AS3, see Service_SCTP for detailed information and usage for the SCTP Class, and Pointer_SCTP_Profile for the SCTP profile.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_sctp_01.
  • An application named mySCTP that uses the sctp template.
  • A virtual service named service that uses Service_SCTP, and references an existing SCTP profile on the BIG-IP system.
{
  "class": "AS3",
  "action": "deploy",
  "persist": true,
  "declaration": {
    "class": "ADC",
    "schemaVersion": "3.15.0",
    "id": "service-sctp",
    "label": "Sample Service_SCTP",
    "remark": "Simple SCTP application reference",
    "Sample_sctp_01": {
      "class": "Tenant",
      "mySCTP": {
        "class": "Application",
        "service": {
          "class": "Service_SCTP",
          "virtualAddresses": [
            "10.0.1.10"
          ],
          "virtualPort": 132,
          "profileSCTP": {
            "bigip": "/Common/sctp"
          }
        }
      }
    }
  }
}

Back to top


Referencing existing ICAP profiles in a declaration

This example shows how you can reference an existing ICA (Internet Content Adaptation Protocol) profile in a declaration. You can use an ICAP profile when you want to use the BIG-IP content adaptation feature for adapting HTTP requests and responses. This feature allows a BIG-IP virtual server to conditionally forward HTTP requests and HTTP responses to a pool of ICAP servers for modification, before sending a request to a web server or returning a response to the client system. For more information on using the ICAP profile, see the BIG-IP documentation.

Important

ICAP profile must use TCP services and is only supported in Service_TCP.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Sample_ICAP_profile.
  • An application named TCP_Service that uses the tcp template.
  • A virtual service named service that references an existing ICAP profile on the BIG-IP system.
{
    "class": "ADC",
    "schemaVersion": "3.16.0",
    "label": "ICAP_profile_existing",
    "remark": "ICAP_profile_existing",
    "Sample_ICAP_profile": {
        "class": "Tenant",
        "TCP_Service": {
            "class": "Application",
            "service": {
                "class": "Service_TCP",
                "virtualPort": 8181,
                "virtualAddresses": [
                    "192.0.2.100"
                ],
                "virtualType": "internal",
                "profileICAP": {
                    "bigip": "/Common/icap"
                }
            }
        }
    }
}

Using IP or L2 Forwarding in a declaration

In this example, we show how you can use the Service_Forwarding class to create IP or L2 Forwarding virtual services.

An IP forwarding virtual server accepts traffic that matches the virtual server address and forwards it to the destination IP address that is specified in the request rather than load balancing the traffic to a pool. For more information, see Overview of IP forwarding virtual servers.

A L2 forwarding virtual server does not have pool members to load balance and forwards packets based on routing decisions. For more information and requirements, see Overview of the Forwarding (Layer 2) virtual server.

New in BIG-IP AS3 3.31
BIG-IP AS3 3.31 added support for referencing an existing NAT policy using a BIG-IP AS3 pointer (use). AFM NAT policies are ordered lists of NAT rules. You must have the AFM module provisioned to use this feature. For information on NAT policies, see BIG-IP AFM: NAT Policies and Implementations.


Important

In BIG-IP AS3 3.27 and later, ARP and ICMP Echo are disabled on virtualAddresses by default.

For additional details and BIG-IP AS3 usage, see Service_Forwarding in the Schema Reference.

Warning

This example has been updated to include referencing a NAT policy introduced in BIG-IP AS3 3.31. If you attempt to use this declaration on a previous version, it will fail unless you remove the lines highlighted in yellow (only the comma from line 27).

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Forward_tenant.
  • An Application named SampleApp.
  • A IP Forwarding virtual server named myService which uses the Service_Forwarding class, and references an existing NAT policy.
  • A pointer to a NAT policy that already exists on the BIG-IP.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
    "class": "ADC",
    "schemaVersion": "3.31.0",
    "id": "TEST_Service_Forwarding",
    "remark": "Example Forwarding Virtual Server",
    "Forward_tenant": {
        "class": "Tenant",
        "SampleApp": {
            "class": "Application",
            "myService": {
                "class": "Service_Forwarding",
                "remark": "Example Forwarding Virtual Server with policyNAT",
                "policyNAT": {
                    "use": "natPolicy"
                },
                "virtualAddresses": [
                    [
                        "192.0.1.11",
                        "1.2.3.4/32"
                    ]
                ],
                "virtualPort": 0,
                "forwardingType": "ip",
                "layer4": "tcp",
                "profileL4": "basic",
                "snat": "none"
            },
            "natPolicy": {
                "class": "NAT_Policy"
            }
        }
    }
}

Back to top


Creating multiple forwarding virtual services on different ports

In this example, we show how you can create multiple forwarding virtual services (servers) on different ports in a single declaration.

This example contains three forwarding virtual services, one on a specific port, and the others that use 0 and any.

Both 0 and any signify a wildcard (any port) and can be used interchangeably.

For more information and requirements, see Overview of the Forwarding (Layer 2) virtual server. For additional details and BIG-IP AS3 usage, see Service_Forwarding in the Schema Reference.

Important

In BIG-IP AS3 3.27 and later, ARP and ICMP Echo are disabled on virtualAddresses by default.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named FirstAppForwarder.
  • An Application named SampleApp.
  • A IP Forwarding virtual server named myService0 which uses the Service_Forwarding class, with two virtual addresses and a virtual port of 0 (any port).
  • An Application named SecondAppForwarder.
  • A IP Forwarding virtual server named myService55000 which uses the Service_Forwarding class, with the same two virtual addresses and a virtual port of 55000.
  • An Application named ThirdAppForwarder.
  • A IP Forwarding virtual server named myServiceAny which uses the Service_Forwarding class, with the same two virtual addresses and a virtual port of Any (any port).
{
    "class": "ADC",
    "schemaVersion": "3.21.0",
    "id": "TEST_Service_Forwarding",
    "remark": "Example Forwarding Virtual Server",
    "FirstAppForwarder": {
        "class": "Tenant",
        "SampleApp": {
            "class": "Application",
            "template": "generic",
            "myService0": {
                "class": "Service_Forwarding",
                "remark": "Example Forwarding Virtual Server 1",
                "virtualAddresses": [
                    [
                        "0.0.0.0",
                        "1.2.3.4/32"
                    ]
                ],
                "virtualPort": 0,
                "forwardingType": "ip",
                "layer4": "tcp",
                "profileL4": "basic"
            }
        },
        "SecondAppForwarder": {
            "class": "Application",
            "myService55000": {
                "class": "Service_Forwarding",
                "template": "generic",
                "remark": "Example Forwarding Virtual Server 2",
                "virtualAddresses": [
                    [
                        "0.0.0.0",
                        "199.0.2.22/32"
                    ]
                ],
                "virtualPort": 55000,
                "forwardingType": "ip",
                "layer4": "tcp",
                "profileL4": "basic"
            }
        },
        "ThirdAppForwarder": {
            "class": "Application",
            "myServiceAny": {
                "class": "Service_Forwarding",
                "template": "generic",
                "remark": "Example Forwarding Virtual Server 3",
                "virtualAddresses": [
                    [
                        "0.0.0.0",
                        "199.0.2.22/32"
                    ]
                ],
                "virtualPort": "any",
                "forwardingType": "ip",
                "layer4": "tcp",
                "profileL4": "basic"
            }
        }
    }
}

Back to top


Creating a stateless UDP virtual server

In this example, we show how you can create a stateless UDP virtual server with an AS3 declaration. Using a stateless UDP virtual server can save BIG-IP resources and improve performance when you don’t need to use the advanced properties of a UDP virtual server. For more information on stateless virtual servers, see Overview of the stateless virtual server on AskF5.

IMPORTANT
For a stateless UDP virtual server, you need do the following:

  • Set virtualType to stateless
  • Set translateClientPort and translateServerPort to false
  • Supply a pool in the declaration.

For additional details and BIG-IP AS3 usage, see Service_UDP in the Schema Reference.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Tenant.
  • An Application named Application.
  • A virtual server named service using the Service_UDP class and type set to stateless and translateClientPort and translateServerPort to false. It also references an existing pool on the BIG-IP.
{
    "class": "AS3",
    "action": "deploy",
    "declaration": {
        "class": "ADC",
        "schemaVersion": "3.40.0",
        "Tenant": {
            "class": "Tenant",
            "Application": {
                "class": "Application",
                "service": {
                    "class": "Service_UDP",
                    "virtualType": "stateless",
                    "translateClientPort": false,
                    "translateServerPort": false,
                    "virtualPort": 53,
                    "virtualAddresses": [
                        "192.0.0.51"
                    ],
                    "pool": { "bigip": "/Common/myPool" }
                }
            }
        }
    }
}

Back to top


Creating port and address lists for a service

In this example, we show how you can create address and port lists for a virtual service in AS3 3.46 and later. These objects were already supported in AS3, but not directly on a virtual service. Using address and port lists allows you to define multiple addresses and ports for a single virtual service.

Although this example uses both Firewall_Address_List, Firewall_Port_List, it is not a requirement and either can be used alone. You can also use Net_Address_List and Net_Port_List.

When you include a port or address list in a declaration, BIG-IP AS3 creates a traffic-matching-criteria object in the background which defines how traffic is steered towards the virtual service.

For additional details and BIG-IP AS3 usage, see Firewall_Address_List, Firewall_Port_List (and Net_Address_List and Net_Port_List), and Service_TCP in the Schema Reference.

This declaration creates the following objects on the BIG-IP:

  • Partition (tenant) named Tenant.
  • An Application named Application.
  • Multiple firewall address lists. One is used for source addresses, and the others for destination addresses.
  • A firewall port list named portList that includes port 8080 and a range of ports from 1-999.
  • A traffic-matching-critera object that defines how traffic is directed based on the lists.
  • A virtual server named service using the Service_TCP class that references the traffic-matching-criteria object.
{
    "class": "AS3",
    "action": "deploy",
    "persist": true,
    "declaration": {
        "class": "ADC",
        "schemaVersion": "3.46.0",
        "id": "addressList",
        "Tenant": {
            "class": "Tenant",
            "Application": {
                "class": "Application",
                "sourceAddressList": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "192.168.2.10/32",
                        "192.168.2.50-192.168.2.60"
                    ]
                },
                "destinationAddressList1": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "192.168.2.1-192.168.2.10"
                    ]
                },
                "destinationAddressList2": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "192.168.2.20/32"
                    ]
                },
                "destinationAddressList3": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "192.168.2.100/32"
                    ],
                    "addressLists": [
                        {
                            "use": "destinationAddressList1"
                        },
                        {
                            "use": "destinationAddressList2"
                        }
                    ]
                },
                "portList": {
                    "class": "Firewall_Port_List",
                    "ports": [
                        8080,
                        "1-999"
                    ]
                },
                "tcpService": {
                    "class": "Service_TCP",
                    "sourceAddress": {
                        "use": "sourceAddressList"
                    },
                    "virtualAddresses": {
                        "use": "destinationAddressList3"
                    },
                    "virtualPort": {
                        "use": "portList"
                    }
                }
            }
        }
    }
}

Back to top