Appendix A: Schema Reference¶

This page is a reference for the objects you can use in your Declarations for AS3. For more information on BIG-IP objects and terminology, see the BIG-IP documentation at https://my.f5.com/manage/s/.

Access_Profile¶

Configures an Access Profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“Access_Profile”
enable (boolean)	false	true, false	Apply the profile after updating it. If false (default), the system only updates the profile. Also note ‘ignoreChanges’.
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the profile in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the profile on first deployment, and leaves it untouched afterwards. However, if enable is set to true, the policy will be applied even if ignoreChanges is true
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
ssloCreated (boolean)	false	true, false	Set to true if the profile was created by SSL Orchestrator. If true the non-configurable Kerberos Request-Based Authentication (/Common/rba) and WebSSO (/Common/websso) profiles will not be attached to Services when this profile is attached
url (Resource_URL)			The URL to pull the Access Profile from

Adapt_Profile¶

Configures a request or response Adapt profile or both

Properties:

Name (Type)	Default	Values	Description
allowHTTP10 (boolean)	false	true, false	Specifies whether to forward HTTP 1.0 requests/responses
class (string)		“Adapt_Profile”
enableHttpAdaptation (boolean)	true	true, false	Enable or disable the adaptation of HTTP requests/responses. They will be forwarded to the internal service
internalService (Pointer_Service)			Specifies the name of the internal service to use for adapting the request/response
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
messageType (string)		“response”, “request”, “request-and-response”	The type of Adapt profile. Use both to create a request and response profile with the same property values
previewSize (integer)	1024	[0, 4294967295]	Specifies the maximum size of the preview buffer
serviceDownAction (string)	“ignore”	“ignore”, “reset”, “drop”	Specifies the action to take if the internal service doesn’t exist or is down
timeout (integer)	0	[0, 4294967295]	Specifies how long in miliseconds to wait for the internal service before a timeout error will occur

ADC¶

A declarative configuration for an ADC such as F5 BIG-IP

Properties:

Name (Type)	Default	Values	Description
$schema (string)		format: uri	URL of schema against which to validate. Used by validation in your local environment only (via Visual Studio Code, for example)
class (string)		“ADC”	Indicates this JSON document is an ADC declaration
Common (ADC_Common)			Special tenant Common holds objects other tenants can share
constants (ADC_constants)			Declaration metadata and/or named values for (re-)use by declaration objects
controls (Controls)
id (string)		regex: ^[^x00-x20x22’<>x5c^`\|x7f]*$	Unique identifier for this declaration (max 255 printable chars with no spaces, quotation marks, angle brackets, nor backslashes)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
schemaVersion (string)			Version of ADC Declaration schema this declaration uses
scratch (string)			Holds some system data during declaration processing
target (ADC_target)			Trusted target for config when configuring with BIG-IQ
updateMode (string)	“selective”	“complete”, “selective”	When set to ‘selective’ (default) BIG-IP AS3 does not modify Tenants not referenced in the declaration. Otherwise (‘complete’) BIG-IP AS3 removes unreferenced Tenants.

ADC_Common¶

ADC Common possible properties

Properties:

Name (Type)	Default	Values	Description
class (string)	“Tenant”	“Tenant”
constants (Constants)
controls (Controls)
enable (boolean)		true, false	If declared, you must enable the Common tenant
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
optimisticLockKey (string)	“”		Note: The optimisticLockKey does NOT work when using per-app. When you deploy a declaration with a non-empty ‘key’ value here, that activates an optimistic lock on changes to this Tenant. If the key in your declaration does not match the key BIG-IP AS3 computes for the most-recent previous declaration, then BIG-IP AS3 will NOT update this Tenant and will return an error code. To use optimistic locking, first retrieve a declaration using option ‘showHash=true’ to get the current per-Tenant keys. Make any changes you desire, then deploy your updated declaration. Deployment of each Tenant with a key will succeed only if that Tenant has not been modified since the time you retrieved the declaration. (To overwrite all previous changes to a Tenant simply do NOT include any opportunistic-lock key for that Tenant when you deploy a declaration. That is the default.) Note that only keys computed by BIG-IP AS3 may be used here– you cannot generate your own. If ‘showHash=true’ is used on a POST then the optimisticLockKey will be shown as a part of the output (This helps to avoid the need to do a GET request).
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
Shared (Application_Shared)
verifiers (object)			Data (in ‘key’:’value’ properties) used to verify automated tests. Ordinary declarations do not need this

ADC_constants¶

ADC constants possible properties

Properties:

Name (Type)	Default	Values	Description
class (string)	“Constants”	“Constants”
timestamp (string)		format: date-time	Date+time (this version of) declaration was created (optional but recommended)
version (number \| string)			Version number of declaration; update when you change contents but not ID (optional but recommended)

ADC_target¶

ADC target possible properties

Properties:

Name (Type)	Default	Values	Description
address (string)		format: f5ip	IP address of managed device to be configured
hostname (string)			Host name of managed device to be configured

ADC_Array¶

An array of declarations (ADC) to process

For item definition, see type (ADC)

Address_Discovery¶

Sharable Pool Member information

Properties:

Name (Type)	Default	Values	Description
accessKeyId (string)			Information for discovering AWS nodes that are not in the same region as your BIG-IP (also requires the secretAccessKey field
addressDiscovery (string)		“static”, “fqdn”, “event”, “aws”, “gce”, “azure”, “consul”	Selects how server (node) addresses are discovered
addressFamily (string)	“IPv4”	“IPv4”, “IPv6”	Selects IPv4/6 and DNS A/AAAA RR’s
addressRealm (string)	“private”	“public”, “private”	Specifies whether to look for public or private IP addresses
apiAccessKey (string \| Secret)			Azure registered application API access key (AKA service principal secret). Will be stored in the declaration in an encrypted format.
applicationId (string)			Azure registered application ID (AKA client ID)
autoPopulate (boolean)	false	true, false	If true use multiple server (node) addresses when available, otherwise use only one
class (string)		“Address_Discovery”
credentialUpdate (boolean)	false	true, false	Specifies whether you are updating your credentials
directoryId (string)			Azure Active Directory ID (AKA tenant ID)
downInterval (integer)	5	[0, infinity]	DNS retry interval after resolution failure (seconds)
encodedCredentials (string \| Secret)			Base 64 encoded service account credentials JSON
encodedToken (string \| Secret)			Base 64 encoded bearer token to make requests to the Consul API. Will be stored in the declaration in an encrypted format.
environment (string)	“Azure”		Azure environment name. Required if environment should not be determined by instance metadata.
externalId (string)			External Id
fqdnPrefix (string)	“”		String to prepend onto the hostname to create the node name
hostname (string)		format: hostname
jmesPathQuery (string)			Custom JMESPath Query
minimumMonitors (reference)	1
projectId (string)			For Google Cloud Engine (GCE) only: The ID of the project in which the members are located
queryInterval (integer)	0	[0, infinity]	Normal DNS query interval (seconds, default 0 means RR TTL)
region (string)	“”		Empty string (default) means region in which ADC is running
rejectUnauthorized (boolean)	true	true, false	If true, the server certificate is verified against the list of supplied/default CAs when making requests to the Consul API.
resourceGroup (string)			Azure Resource Group name
resourceId (string)			ID of resource to find nodes by.
resourceType (string)		“tag”, “scaleSet”	Type of resource identified by resourceId. This can be used in place of tagKey/tagValue.
roleARN (string)			Assume a role (also requires the externalId field)
secretAccessKey (string \| Secret)			Will be stored in the declaration as an encrypted string
serverAddresses (array<string>)		format: f5ip	Static IP addresses of servers (nodes). Shorthand for ‘servers’ where you only want to specify the address property.
servers (array<Address_Discovery_servers>)			Same as serverAddresses, but allowing for further specification of each node.
shareNodes (boolean)	false	true, false	If enabled, nodes are created in /Common instead of the tenant’s partition
subscriptionId (string)			Azure subscription ID
tagKey (string)			The tag key associated with the node to add to this pool
tagValue (string)			The tag value associated with the node to add to this pool
trustCA (Pointer_CA_Bundle)			CA Bundle to validate server certificates
undetectableAction (string)	“remove”	“disable”, “remove”	Action to take when node cannot be detected
updateInterval (integer)	60	[1, 3600]	Server-discovery update interval (seconds)
uri (string)			The location of the node data
useManagedIdentity (boolean)	false	true, false	Use Azure managed identity rather than directoryId, applicationId, and apiAccessKey

Address_Discovery_servers¶

Address_Discovery servers possible properties when object type

Properties:

Name (Type)	Default	Values	Description
address (string)		format: f5ip	Static IP address for this server (node)
name (string)		regex: ^[A-Za-z][0-9A-Za-z_.-]*$

Address_Discovery_Common¶

No description provided

Properties:

Name (Type)	Default	Values	Description
accessKeyId (string)			Information for discovering AWS nodes that are not in the same region as your BIG-IP (also requires the secretAccessKey field
addressDiscovery (reference)
addressFamily (string)	“IPv4”	“IPv4”, “IPv6”	Selects IPv4/6 and DNS A/AAAA RR’s
addressRealm (string)	“private”	“public”, “private”	Specifies whether to look for public or private IP addresses
apiAccessKey (string \| Secret)			Azure registered application API access key (AKA service principal secret). Will be stored in the declaration in an encrypted format.
applicationId (string)			Azure registered application ID (AKA client ID)
autoPopulate (boolean)	false	true, false	If true use multiple server (node) addresses when available, otherwise use only one
credentialUpdate (boolean)	false	true, false	Specifies whether you are updating your credentials
directoryId (string)			Azure Active Directory ID (AKA tenant ID)
downInterval (integer)	5	[0, infinity]	DNS retry interval after resolution failure (seconds)
encodedCredentials (string \| Secret)			Base 64 encoded service account credentials JSON
encodedToken (string \| Secret)			Base 64 encoded bearer token to make requests to the Consul API. Will be stored in the declaration in an encrypted format.
environment (string)	“Azure”		Azure environment name. Required if environment should not be determined by instance metadata.
externalId (string)			External Id
fqdnPrefix (string)	“”		String to prepend onto the hostname to create the node name
hostname (string)		format: hostname
jmesPathQuery (string)			Custom JMESPath Query
minimumMonitors (reference)	1
projectId (string)			For Google Cloud Engine (GCE) only: The ID of the project in which the members are located
queryInterval (integer)	0	[0, infinity]	Normal DNS query interval (seconds, default 0 means RR TTL)
region (string)	“”		Empty string (default) means region in which ADC is running
rejectUnauthorized (boolean)	true	true, false	If true, the server certificate is verified against the list of supplied/default CAs when making requests to the Consul API.
resourceGroup (string)			Azure Resource Group name
resourceId (string)			ID of resource to find nodes by.
resourceType (string)		“tag”, “scaleSet”	Type of resource identified by resourceId. This can be used in place of tagKey/tagValue.
roleARN (string)			Assume a role (also requires the externalId field)
secretAccessKey (string \| Secret)			Will be stored in the declaration as an encrypted string
serverAddresses (array<string>)		format: f5ip	Static IP addresses of servers (nodes). Shorthand for ‘servers’ where you only want to specify the address property.
servers (array<Address_Discovery_Common_servers>)			Same as serverAddresses, but allowing for further specification of each node.
subscriptionId (string)			Azure subscription ID
tagKey (string)			The tag key associated with the node to add to this pool
tagValue (string)			The tag value associated with the node to add to this pool
trustCA (Pointer_CA_Bundle)			CA Bundle to validate server certificates
undetectableAction (string)	“remove”	“disable”, “remove”	Action to take when node cannot be detected
updateInterval (integer)	60	[1, 3600]	Server-discovery update interval (seconds)
uri (string)			The location of the node data
useManagedIdentity (boolean)	false	true, false	Use Azure managed identity rather than directoryId, applicationId, and apiAccessKey

Address_Discovery_Common_servers¶

Address_Discovery_Common servers possible properties when object type

Properties:

Name (Type)	Default	Values	Description
address (string)		format: f5ip	Static IP address for this server (node)
name (string)		regex: ^[A-Za-z][0-9A-Za-z_.-]*$

ALG_Log_Profile¶

Configures an application layer gateway log profle

Properties:

Name (Type)	Default	Values	Description
class (string)		“ALG_Log_Profile”
csvFormat (boolean)	false	true, false	Generate entries in comma-separated-values (csv) format
endControlChannel (ALG_Log_Profile_endControlChannel)	{“action”:”enabled”,”includeDestination”:false}		Event for end of control channel connection
endDataChannel (ALG_Log_Profile_endDataChannel)	{“action”:”enabled”,”includeDestination”:false}		Event for end of data channel connection
inboundTransaction (ALG_Log_Profile_inboundTransaction)	{“action”:”disabled”}		Generates event log entries of SIP messages. Triggered by inbound connection to the BIG-IP system
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
startControlChannel (ALG_Log_Profile_startControlChannel)	{“action”:”disabled”,”includeDestination”:false}		Event for start of control channel connection
startDataChannel (ALG_Log_Profile_startDataChannel)	{“action”:”disabled”,”includeDestination”:false}		Event for start of data channel connection

ALG_Log_Profile_endControlChannel¶

ALG_Log_Profile endControlChannel possible properties

Properties:

Name (Type)	Default	Values	Description
action (string)	“enabled”	“enabled”, “disabled”, “backup-allocation-only”	Specify the logging action to be taken when a particular event is encountered. If ‘enabled’ logging is enabled for the event, regardless of how the flow is created. If ‘disabled’ logging is disabled for the event. If ‘backup-allocation-only’ logging is enabled for the event when the ALG is proxy with a LSN, and translation is taken from the backup pool member only.
includeDestination (boolean)	false	true, false	Include destination address/port in the log message

ALG_Log_Profile_endDataChannel¶

ALG_Log_Profile endDataChannel possible properties

Properties:

Name (Type)	Default	Values	Description
action (string)	“enabled”	“enabled”, “disabled”, “backup-allocation-only”	Specify the logging action to be taken when a particular event is encountered. If ‘enabled’ logging is enabled for the event, regardless of how the flow is created. If ‘disabled’ logging is disabled for the event. If ‘backup-allocation-only’ logging is enabled for the event when the ALG is proxy with a LSN, and translation is taken from the backup pool member only.
includeDestination (boolean)	false	true, false	Include destination address/port in the log message

ALG_Log_Profile_inboundTransaction¶

ALG_Log_Profile inboundTransaction possible properties

Properties:

Name (Type)	Default	Values	Description
action (string)	“disabled”	“enabled”, “disabled”	Specify the logging action to be taken when a particular event is encountered. If ‘enabled’ logging is enabled for the event, regardless of how the flow is created. If ‘disabled’ logging is disabled for the event. Inbound transaction log entry could contain both incoming and outgoing messages.

ALG_Log_Profile_startControlChannel¶

ALG_Log_Profile startControlChannel possible properties

Properties:

Name (Type)	Default	Values	Description
action (string)	“disabled”	“enabled”, “disabled”, “backup-allocation-only”	Specify the logging action to be taken when a particular event is encountered. If ‘enabled’ logging is enabled for the event, regardless of how the flow is created. If ‘disabled’ logging is disabled for the event. If ‘backup-allocation-only’ logging is enabled for the event when the ALG is proxy with a LSN, and translation is taken from the backup pool member only.
includeDestination (boolean)	false	true, false	Include destination address/port in the log message

ALG_Log_Profile_startDataChannel¶

ALG_Log_Profile startDataChannel possible properties

Properties:

Name (Type)	Default	Values	Description
action (string)	“disabled”	“enabled”, “disabled”, “backup-allocation-only”	Specify the logging action to be taken when a particular event is encountered. If ‘enabled’ logging is enabled for the event, regardless of how the flow is created. If ‘disabled’ logging is disabled for the event. If ‘backup-allocation-only’ logging is enabled for the event when the ALG is proxy with a LSN, and translation is taken from the backup pool member only.
includeDestination (boolean)	false	true, false	Include destination address/port in the log message

Analytics_Profile¶

HTTP Analytics profile with configurable options

Properties:

Name (Type)	Default	Values	Description
capturedTrafficExternalLogging (boolean)	false	true, false	Specifies that the system captures a portion of the application traffic which can then be viewed on the System >> Logs >> Captured Transactions screen
capturedTrafficInternalLogging (boolean)	false	true, false	Specifies that the system captures a portion of the application traffic and sends it to a remote server
captureFilter (Capture_Filter)	{}
class (string)		“Analytics_Profile”
collectClientSideStatistics (boolean)	false	true, false	Specifies that the system collects statistics regarding the HTTP request and response times
collectedStatsExternalLogging (boolean)	false	true, false	Specifies that statistics logs are stored on a remote server
collectedStatsInternalLogging (boolean)	true	true, false	Specifies that statistics logs are stored in the system
collectGeo (boolean)	false	true, false	Specifies that the system collects statistics of the names of the countries from which that traffic was sent
collectIp (boolean)	false	true, false	Specifies that the system collects statistics of the IP addresses of where the traffic came from
collectMaxTpsAndThroughput (boolean)	false	true, false	Specifies that the system collects statistics for the maximum number of transactions per second, and the maximum amount of traffic moving through the system, both request and response throughput values
collectMethod (boolean)	true	true, false	Specifies that the system collects statistics about the distribution of HTTP methods found in requests
collectOsAndBrowser (boolean)	true	true, false	Specifies that the system collect statistics about the OSs and Browsers used to send requests
collectPageLoadTime (boolean)	false	true, false	Specifies that the system collects statistics of the round-trip latency between client end-users and the servers
collectResponseCode (boolean)	true	true, false	Specifies that the system collects statistics about the distribution of HTTP response codes returned by the servers
collectSubnet (boolean)	false	true, false	Specifies that the system collects statistics of client subnets
collectUrl (boolean)	false	true, false	Specifies that the system collects statistics of requested URLs
collectUserAgent (boolean)	false	true, false	Specifies that the system collects statistics about browsers used to send traffic
collectUserSession (boolean)	false	true, false	Specifies that the system collects statistics of the number of unique user sessions in the application traffic, as determined by the value of the configured HTTP cookies found in the requests
countriesForStatCollection (array<Enum_Country_Analytics>)			Specifies the countries for collecting statistics
externalLoggingPublisher (Pointer_Log_Publisher)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
notificationByEmail (boolean)	false	true, false	Specifies that the system sends notifications by e-mail
notificationBySnmp (boolean)	false	true, false	Specifies that the system sends notifications as SNMP traps
notificationBySyslog (boolean)	false	true, false	Specifies that the system sends notifications to the syslog
notificationEmailAddresses (array<string>)		format: email	The e-mail addresses of a recipient to whom the system should send email notifications
publishIruleStatistics (boolean)	false	true, false	Specifies that the system collects and displays statistics according to the expressions written in an iRule
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
sessionCookieSecurity (string)	“ssl-only”	“ssl-only”, “always-secure”, “never-secure”	Specify whether to secure session cookies
sessionTimeoutMinutes (integer)	5	[5, 60]	The number of minutes of user non-activity ot allow before the system considers the session to be over
subnetsForStatCollection (array<string>)		format: f5ip	Specifies the requested subnets for collecting statistics
urlsForStatCollection (array<string>)			Specifies the requested URLs for collecting statistics

Analytics_TCP_Profile¶

TCP Analytics profile with configurable options

Properties:

Name (Type)	Default	Values	Description
class (string)		“Analytics_TCP_Profile”
collectCity (boolean)	false	true, false	Specifies that the system saves the name of the city with which traffic was exchanged
collectContinent (boolean)	true	true, false	Specifies that the system saves the name of the continent with which traffic was exchanged
collectCountry (boolean)	true	true, false	Specifies that the system saves the name of the country with which traffic was exchanged
collectedByClientSide (boolean)	true	true, false	Specifies that system collects statistics on the client side
collectedByServerSide (boolean)	true	true, false	Specifies that system collects statistics on the server side
collectedStatsExternalLogging (boolean)	false	true, false	Specifies that statistics logs are stored on a remote server
collectedStatsInternalLogging (boolean)	true	true, false	Specifies that statistics logs are stored in the system
collectNexthop (boolean)	false	true, false	Specifies that the system saves the address to which the traffic is being routed
collectPostCode (boolean)	false	true, false	Specifies that the system saves the name of the postcode with which traffic was exchanged
collectRegion (boolean)	true	true, false	Specifies that the system saves the name of the region with which traffic was exchanged
collectRemoteHostIp (boolean)	false	true, false	Specifies that the system collects IP addresses with which traffic was exchanged
collectRemoteHostSubnet (boolean)	true	true, false	Specifies that the system saves the address of the subnet with which traffic was exchanged
externalLoggingPublisher (Pointer_Log_Publisher)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Application¶

Application declaration main schema

Properties:

Name (Type)	Default	Values	Description
class (string)		“Application”
constants (Constants)
enable (boolean)	true	true, false	Application handles traffic only when enabled (default)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
schemaOverlay (string)			BIG-IQ name for a supplemental validation schema is applied to the Application class definition before the main BIG-IP AS3 schema
serviceMain (reference)			Primary service of the application
template (string)	“generic”		Each application type has certain required and default elements and selects appropriate setup of various ADC/Security features

Application_Shared¶

Special application Shared holds objects other applications can share

Properties:

Name (Type)	Default	Values	Description
class (string)		“Application”
constants (Constants)
enable (boolean)	true	true, false	If declared, you must enable the Shared Application
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
schemaOverlay (string)			BIG-IQ name for a supplemental validation schema is applied to the Application class definition before the main BIG-IP AS3 schema
serviceMain (reference)			Primary service of the application
template (string)		“shared”	Shared Application template is always generic

AS3¶

A body with AS3 Class

Properties:

Name (Type)	Default	Values	Description
$schema (string)		format: uri	URL of schema against which to validate. Used by validation in your local environment only (via Visual Studio Code, for example)
action (string)	“deploy”	“deploy”, “dry-run”, “patch”, “redeploy”, “retrieve”, “remove”	Indicates desired action: ‘deploy’ means deploy the included declaration to targetHost; ‘dry-run’ does NOT deploy the declaration but does do everything short of changing targetHost’s configuration; ‘patch’ modifies the declaration based on the provided set of commands and then deploys the updated declaration; ‘redeploy’ causes an old declaration from targetHost’s declaration history to be re-deployed (property redeployAge (default 0) selects the old declaration, and note redeployUpdateMode as well); ‘retrieve’ returns a copy of a previously-deployed declaration; ‘remove’ deletes the declaration or declaration component.
class (string)		“AS3”	Indicates a BIG-IP AS3 request
declaration (ADC)
historyLimit (number)	4		This value (default 4) limits the number of previously-deployed declarations saved on targetHost for review using GET and for use with POST action=redeploy and redeployAge=N. The limit includes the current and immediately-previous declarations so may not be less than two
logLevel (string)	“warning”	“emergency”, “alert”, “critical”, “error”, “warning”, “notice”, “info”, “debug”	Controls level of detail in logs using RFC 5424 severity levels (default is ‘warning’). Portions of declaration may use different logLevels
patchBody (AS3_Patch_Body)
persist (boolean)	true	true, false	When true (default) make the whole working configuration persistent on targetHost after (and only if) this request deploys any changes. If false, leave the working configuration in memory only (if targetHost restart, you may lose the configuration from memory)
redeployAge (integer)	0	[0, 15]	For action=redeploy (only), chooses which old declaration to deploy again. Value 0 (default) means re-deploy the most recent declaration (the one which set the current configuration of targetHost– useful to erase changes introduced by manual configuration). Value 1 means re-deploy the declaration prior to the most-recent one, etc. Note that whenever re-deploying an old declaration causes ADC configuration changes, that declaration becomes the current declaration (age 0) and the ages of all other declarations in the history increase (0 => 1, 1 => 2, u.s.w.)
redeployUpdateMode (string)	“original”	“original”, “complete”, “selective”	Value ‘original’ (default) means re-deploy the chosen declaration using its original updateMode (which if not explicitly specified in that declaration will default to ‘selective’). Otherwise, forces the updateMode for re-deployment to ‘complete’ or ‘selective’ as specified. Remember, ‘selective’ updates do not affect Tenants not explicitly named. To simply roll-back the targetHost configuration to the state it had immediately after deploying some earlier declaration, put ‘complete’ here (that will remove Tenants created later than the redeployAge declaration). To use action=redeploy as a simple roll-back facility, always deploy (updateMode=)complete declarations.
resourceTimeout (integer)	5	[1, 900]	Maximum delay allowed while communicating with URL resources (seconds, default 5)
retrieveAge (integer \| string)	0		Use this property with action=retrieve. You can usually get a copy of the declaration most recently deployed to targetHost, and often copies of previously-deployed declarations are also available. Value 0 (default) means ‘the last-deployed declaration,’ value 1 means ‘the declaration previous to 0’ and so-forth. To get a list of available declarations, set value ‘list’
syncToGroup (string)	“”		Name (like /Common/my_dg) of the config-sync group TO which the system should synchronize the targetHost configuration after (and only if) this request deploys any changes. When empty (default) this request will not affect config-sync at all. Leave undefined or empty whenever you use auto-sync or manage configuration synchronization separately
targetHost (string)	“localhost”		Hostname or IP address of ADC to which request applies (default localhost)
targetPassphrase (string)			Passphrase for targetUsername account. This is generally not required to configure ‘localhost’ and is not required when you populate targetTokens
targetPort (integer)	0	[0, 65535]	TCP port number of management service on targetHost; default 0 means auto-discover
targetTimeout (integer)	150	[1, 900]	Maximum delay allowed while communicating with targetHost device (seconds, default 150)
targetTokens (AS3_targetTokens)			One or more HTTP headers (each a property, like ‘X-F5-Auth-Token’: ‘ABC123’) you want to send with queries to the targetHost management service as authentication/authorization tokens
targetUsername (string)		regex: ^[^:]*$	Username of principal authorized to modify configuration of targetHost (may not include the character ‘:’). NOTE: this is generally not required to configure ‘localhost’ because client authentication and authorization precede invocation of BIG-IP AS3. It is also not required for any targetHost if you populate targetTokens
trace (boolean)	false	true, false	If true, BIG-IP AS3 creates a detailed trace of the configuration process for subsequent analysis (default false). May be overridden on a per-Declaration and/or per-Tenant basis. Warning: trace files may contain sensitive configuration data

AS3_targetTokens¶

AS3 targetTokens possible properties

Properties:

Name (Type)	Default	Values	Description
^[^x00-x20:x7f-xff]{1,254}$ (string)		regex: ^[^x00-x1fx7f-xff]*$

AS3_Array¶

An array of BIG-IP AS3 requests to process

For item definition, see type (AS3)

AS3_Patch_Body¶

An array containing the patch operations to apply on the declaration

For item definition, see type (AS3_Patch_Item)

AS3_Patch_Item¶

Defines a PATCH operation to perform

Properties:

Name (Type)	Values	Description
op (string)		Operation to perform
path (string)		Declaration Object Path relative to URI on which the operation is to be performed
target (AS3_Patch_Item_target)		Optional target device (only applies when configuring with certain hosts such as BIG-IQ)
value (string \| number \| boolean \| object \| array)	true, false	Value to use for the operation

AS3_Patch_Item_target¶

AS3_Patch_Item target possible properties

Properties:

Name (Type)	Default	Values	Description
address (string)		format: f5ip	IP address of managed device to be configured
hostname (string)			Host name of managed device to be configured

Bandwidth_Control_Policy¶

Create a listener to specify how to handle traffic for policy enforcement

Properties:

Name (Type)	Default	Values	Description
categories (Bandwidth_Control_Policy_Category)			This specifies the categories under policy. Note: policy need to be enabled as dynamic to configure categories. Up to a maximum of 32 categories can be configured. All the categories under the dynamic policy share the bandwidth as specified for the category, up to a maximum of maxUserBandwidth.
class (string)		“Bandwidth_Control_Policy”
dynamicControlEnabled (boolean)	false	true, false	Specifies whether the policy is a static or dynamic policy. When enabled, the policy is dynamic, and additional settings are available. A dynamic policy enforces the specified maximum user rate and flow fairness for all traffic associated with the policy and for each session. The default is disabled, which indicates a static policy. A static policy enforces the maximum rate for combined traffic and does not guarantee fairness bandwidth for each session.
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
loggingEnabled (boolean)	false	true, false	Specifies whether the system measures bandwidth on all future instances of this bandwidth control policy. When enabled, the system measures bandwidth and sends it to the log publisher specified by the logPublisher setting. You can override this setting using iRules. For example, if you want measurement on only some instances, keep this setting disabled, and use iRules to enable measurement on specific instances.
logPeriod (integer)	2048	[0, 18446744073709552000]	Specifies the frequency, in milliseconds, with which the system generates bandwidth measurement logs
logPublisher (Pointer_Log_Publisher)
markIP (string \| integer)	“pass-through”	“pass-through”, [0, 63]	Specifies whether to mark traffic that exceeds the per-user limit by setting a Type of Service (ToS) bit in the IP headers of TCP packets associated with this bandwidth control policy. The default value is “pass-through”, which means there is no change to the ToS bit. To set a ToS bit use a value from 0 to 63. If this setting is specified, the bandwidth policy is not enforced, but rather the packets are marked for a downstream system to process.
markL2 (string \| integer)	“pass-through”	“pass-through”, [0, 7]	Specifies whether to mark traffic that exceeds the per-user limit by setting a Quality of Service (QoS) bit in the L2 headers of packets associated with this bandwidth control policy. The default value is “pass-through”, which means there is no change to the QoS bit. To set a QoS bit use a value from 0 to 7. If this setting is specified, the bandwidth policy is not enforced, but rather the packets are marked for a downstream system to process.
maxBandwidth (integer)		[0, 18446744073709552000]	Specifies the maximum amount of bandwidth that traffic associated with the bandwidth control policy can use. The range is from 1 Mbps to 320 Gbps (between 1000000 bps and 320000000000 bps.
maxBandwidthUnit (string)	“Mbps”	“bps”, “Kbps”, “Mbps”, “Gbps”	Specifies the units used by the maxBandwidth property
maxUserBandwidth (integer)	0	[0, 18446744073709552000]	Specifies the maximum amount of bandwidth that each session associated with the bandwidth control policy can use. The range is from 5 Kbps to 2 Gbps. Note: For FTP traffic, the throughput is roughly half of this setting, because the FTP protocol creates two connections per user: a control connection and a data connection.
maxUserBandwidthUnit (string)	“Mbps”	“bps”, “Kbps”, “Mbps”, “Gbps”	Specifies the units used by the maxUserBandwidth property
maxUserPPS (integer)	0	[0, 18446744073709552000]	Specifies the limiter in packets per second that traffic is allowed per instance. It functions as a DoS limiter without fair share allocation. The system applies whichever value is lower, between this value and the specified Maximum Rate Per User. When both values are specified, both must pass for packets to go through. You can specify the rate in packets per second (PPS), kilo packets per second (KPPS), mega packets per second (MPPS), or giga packets per second (GPPS). The default value is 0 (not configured).
maxUserPPSUnit (string)	“Mpps”	“bpps”, “Kpps”, “Mpps”, “Gpps”	Specifies the units used by the maxUserBandwidthPPS property
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Bandwidth_Control_Policy_Category¶

Create a listener to specify how to handle traffic for policy enforcement

Properties:

Name (Type)	Default	Values	Description
markIP (string \| integer)	“pass-through”	“pass-through”, [0, 63]	Specifies whether to mark traffic that exceeds the per-user limit by setting a Type of Service (ToS) bit in the IP headers of TCP packets associated with this bandwidth control policy. The default value is “pass-through”, which means there is no change to the ToS bit. To set a ToS bit use a value from 0 to 63. If this setting is specified, the bandwidth policy is not enforced, but rather the packets are marked for a downstream system to process.
markL2 (string \| integer)	“pass-through”	“pass-through”, [0, 7]	Specifies whether to mark traffic that exceeds the per-user limit by setting a Quality of Service (QoS) bit in the L2 headers of packets associated with this bandwidth control policy. The default value is “pass-through”, which means there is no change to the QoS bit. To set a QoS bit use a value from 0 to 7. If this setting is specified, the bandwidth policy is not enforced, but rather the packets are marked for a downstream system to process.
maxBandwidth (integer)		[0, 18446744073709552000]	Specifies the maximum bandwidth that this category of traffic can use when associated with this bandwidth control policy. The range is from 5 kbps to the value set for Maximum Rate Per User.
maxBandwidthUnit (string)	“Mbps”	“bps”, “Kbps”, “Mbps”, “Gbps”, “%”	Specifies the units used by the maxBandwidth property
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Basic_Auth¶

Describes the basic authentication to access a resource

Properties:

Name (Type)	Values	Description
method (string)	“basic”	Specifies the authentication method
passphrase (Property_Passphrase \| reference)		Specifies the password for authentication
username (string)		Specifies the user name for authentication

Bearer_Token¶

Describes using a bearer token to access a resource

Properties:

Name (Type)	Default	Values	Description
method (string)		“bearer-token”	Specifies the authentication method
token (string \| Bearer_Token_token)			Specifies the bearer token

Bearer_Token_token¶

Bearer_Token token possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)		true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

CA_Bundle¶

Bundle of one or more PKI Certificate-Authority certificates

Properties:

Name (Type)	Values	Description
bundle (Pointer_F5_String_Or_BIGIP \| reference \| reference)		Reference to a CA bundle or string of PEM encoded certificates
class (string)	“CA_Bundle”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Capture_Filter¶

Criteria determining when the system captures a portion of the application traffic

Properties:

Name (Type)	Default	Values	Description
capturedProtocols (string)	“all”	“all”, “http”, “https”	Specifies whether the system captures traffic data that is sent using any protocol, or a specific type of protocol
capturedReadyForJsInjection (string)	“disabled”	“disabled”, “enabled”	Specifies whether the system captures all traffic data from all transactions or only from transactions that qualify for JavaScript injection
clientIps (array<string>)		format: f5ip	Specifies the client IP addresses to collect stats for. If none are specified, then all will be collected
dosActivity (string)	“any”	“any”, “mitigated-by-dosl7”	Specifies whether the system captures traffic data mitigated by the DoS Layer 7 Enforcer, or traffic regardless of DoS activity
methods (array<string>)			Specifies whether the system captures traffic data based on the HTTP method that was requested. If none are specified then all will be collected
nodeAddresses (array<string>)			Specifies whether the system captures traffic data sent from/to all nodes, or only from/to specific nodes. If none are specified then all will be collected
requestCapturedParts (string)	“none”	“all”, “body”, “headers”, “none”	Specifies which parts of the request data the system captures
requestContentFilterSearchPart (string)	“none”	“all”, “headers”, “body”, “none”, “uri”	Specifies the part of the request that should be filtered by the search string
requestContentFilterSearchString (string)			Specifies the string the request should be searched for
responseCapturedParts (string)	“none”	“all”, “body”, “headers”, “none”	Specifies which parts of the response data the system captures
responseCodes (array<integer>)		[100, 999]	Specifies whether the system captures traffic data based on the HTTP response status codes that the requests return. If none are specified then all will be collected
responseContentFilterSearchPart (string)	“none”	“all”, “body”, “headers”, “none”	Specifies the part of the response that should be filtered by the search string
responseContentFilterSearchString (string)			Specifies the string the response should be searched for
urlFilterType (string)	“all”	“all”, “black-list”, “white-list”	Specifies how the URL path prefixes are interpreted
urlPathPrefixes (array<string>)			Specifies URLs the filter type is to be applied to. If none are specified then all will be collected
userAgentSubstrings (array<string>)			Specifies whether the system captures traffic sent from all browsers, or only traffic sent from a specific browser
virtualServers (array<string>)			Specifies whether the system captures traffic data sent from/to all virtual servers, or only from/to specific virtual servers. If none are specified then all will be collected

Certificate¶

Configures a Certificate

Properties:

Name (Type)	Values	Description
certificate (Pointer_System_All_Or_F5_String \| reference \| reference)		X.509 public-key certificate
chainCA (Certificate_chainCA \| string)		Bundle of one or more CA certificates in trust-chain from root CA to certificate (optional)
class (string)	“Certificate”
issuerCertificate (Certificate_issuerCertificate)		Specifies the name of the issuer certificate for this certificate
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
passphrase (Certificate_passphrase)		If supplied, used to decrypt privateKey at runtime (optional)
pkcs12 (Pointer_F5_String_Or_BIGIP \| reference \| reference)		The pkcs12 value which may be a url to fetch the binary file from or base64 encoded string
pkcs12Options (Certificate_pkcs12Options)		Options for importing PKCS12 file
privateKey (Pointer_System_All_Or_F5_String \| reference \| reference)		Private key matching certificate’s public key (optional)
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
staplerOCSP (Pointer_Certificate_Validator_OCSP)		BIG-IP AS3 pointer to OCSP Stapler declaration (optional)

Certificate_chainCA¶

Certificate chainCA possible properties

Properties:

Name (Type)	Default	Values	Description
base64 (Property_Base64)
bigip (string)			Path to BIG-IP object
copyFrom (Pointer_Copy_From)
text (Property_Text)
url (Resource_URL)
use (Property_Use \| reference)

Certificate_issuerCertificate¶

Certificate issuerCertificate possible properties

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP SSL certificate
use (string)			BIG-IP AS3 pointer to SSL certificate declaration

Certificate_passphrase¶

Certificate passphrase possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

Certificate_pkcs12Options¶

Certificate pkcs12Options possible properties

Properties:

Name (Type)	Default	Values	Description
ignoreChanges (boolean)	false	true, false	Key has to be decrypted and re-encrypted as part of extraction, resulting in a diff. Set to true to exclude the pkcs12 object for subsequent deployments.
internalOnly (array<string \| number \| boolean \| object \| array>)		true, false	BIG-IP AS3 uses this property internally. Any values supplied here will be ignored
keyImportFormat (string)	“pkcs8”	“pkcs8”, “openssl-legacy”	Determines the format in which the private key is saved. Default is PKCS#8.

Certificate_Validator_OCSP¶

OCSP validator for certificates

Properties:

Name (Type)	Default	Values	Description
class (string)		“Certificate_Validator_OCSP”
dnsResolver (Pointer_DNS_Resolver)			BIG-IP AS3 pointer to DNS resolver used to resolve hostnames in client requests
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
responderUrl (string)			Specifies the absolute URL that overrides the OCSP responder URL obtained from the certificate’s AIA extension(s). This should be a HTTP based URL.
signingCertificate (Pointer_SSL_Certificate)			Specifies the certificate object to use for OCSP responders that require the request to be signed
signingHashAlgorithm (string)	“sha256”	“sha1”, “sha256”	Specifies a hash algorithm used to sign an OCSP request
timeout (integer)	8	[1, 300]	Specifies the time interval (in seconds) that the BIG-IP waits for before ending the connection to the OCSP responder. The default value is 8

Cipher_Group¶

Configures a Cipher Group

Properties:

Name (Type)	Default	Values	Description
allowCipherRules (array<Pointer_Cipher_Rule>)	[object Object]		Allow the following Cipher Rules.
class (string)		“Cipher_Group”
excludeCipherRules (array<Pointer_Cipher_Rule>)			Exclude the following Cipher_Rules from the Allowed list.
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
order (string)	“default”	“default”, “speed”, “strength”, “fips”, “hardware”	Configure the order of the specified Cipher Rules.
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
requireCipherRules (array<Pointer_Cipher_Rule>)			Restrict the Allowed list to the following Cipher_Rules.

Cipher_Rule¶

Configures a cipher rule

Properties:

Name (Type)	Values	Description
cipherSuites (array<string>)		Specifies the cipher suites
class (string)	“Cipher_Rule”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
namedGroups (array<string>)	“DEFAULT”, “P256”, “P384”, “X25519”	Specifies the Elliptic Curve Diffie Hellman key agreement algorithms used to negotiate SSL/TLS connections. namedGroups are only supported on BIG-IP 14.0 and later.
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
signatureAlgorithms (array<string>)	“DEFAULT”, “DSA-SHA1”, “DSA-SHA256”, “DSA-SHA384”, “DSA-SHA512”, “ECDSA-SHA1”, “ECDSA-SHA256”, “ECDSA-SHA384”, “ECDSA-SHA512”, “RSA-PKCS1-SHA1”, “RSA-PKCS1-SHA256”, “RSA-PKCS1-SHA384”, “RSA-PKCS1-SHA512”, “RSA-PSS-SHA256”, “RSA-PSS-SHA384”, “RSA-PSS-SHA512”	Specifies the digital signature algorithms used for authentication. signatureAlgorithms are only supported on BIG-IP 14.0 and later.

Classification_Profile¶

Configures a classification profile

Properties:

Name (Type)	Default	Values	Description
appDetectionEnabled (boolean)	true	true, false	Enables/disables Application Detection feature
class (string)		“Classification_Profile”
iRuleEventEnabled (boolean)	false	true, false	Enables/disables CLASSIFICATION_DETECTED iRule event generation
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
logPublisher (Pointer_Log_Publisher)
logUnclassifiedDomain (boolean)	false	true, false	Enables/disables unclassified domain logging
parentProfile (Pointer_Classification_Profile)	{“bigip”:”/Common/classification”}		Specifies the name of the object to inherit the settings from
preset (Pointer_Classification_Preset)	{“bigip”:”/Common/ce”}
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
statisticsCollectionEnabled (boolean)	false	true, false	Enables/disables statistics collection
statisticsPublisher (Pointer_Log_Publisher)
urlCategorizationEnabled (boolean)	false	true, false	Enables/disables URL Categorization feature

Clone_Pools¶

Specifies a pool that the virtual server uses to replicate either client or server traffic

Properties:

Name (Type)	Default	Values	Description
egress (Pointer_Pool)			Egress (server-side context) clone pool
ingress (Pointer_Pool)			Ingress (client-side context) clone pool

Controls¶

Optional controls configuration

Properties:

Name (Type)	Default	Values	Description
archiveId (number \| string)			Read-only property present when you GET a declaration from configuration system. Archived versions of declaration are identified by a combination of ‘id’ and ‘archiveId’
archiveTimestamp (string)		format: date-time	Read-only property present when you GET a declaration from configuration system. Indicates when this version (see archiveId) of declaration was archived
class (string)	“Controls”	“Controls”
dryRun (boolean)	false	true, false	Boolean that indicates if this declaration will be run as a dry-run. If true, the declaration will NOT make any changes to the system, but will respond with whether or not it would.
fortune (boolean)		true, false	If true, BIG-IP AS3 will activate Zoltar mode and read you your fortune
logLevel (string)	“error”	“emergency”, “alert”, “critical”, “error”, “warning”, “notice”, “info”, “debug”	Controls the amount of detail in logs produced while configuring this Tenant (default is whole-declaration Controls/logLevel value)
trace (boolean)	false	true, false	If true, BIG-IP AS3 creates a detailed trace of the configuration process for this Tenant for subsequent analysis (default is whole-declaration Controls/trace value). Warning: trace files may contain sensitive configuration data
traceResponse (boolean)	false	true, false	If true, the response will contain the trace files
userAgent (string)			User Agent information to include in TEEM report

Data_Group¶

Configures a data group object which contains list of data

Properties:

Name (Type)	Default	Values	Description
class (string)		“Data_Group”
dataGroupFile (Pointer_Data_Group_File)
externalFilePath (Resource_URL \| reference)			Specifies the location (URI) from where the records will be copied
ignoreChanges (boolean)	false	true, false	If false (default), the system updates data group in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the data group on first deployment, and leaves it untouched afterwards
keyDataType (string)		“integer”, “ip”, “string”	Specifies the type of record keys the data group contains. If string, the value will be escaped by default
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
records (array<Data_Group_records>)			List of records
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
separator (string)	“:=”		Specifies the character(s) that separate the record key and value
storageType (string)	“internal”	“internal”, “external”	Toggles whether the data group is internal or external

Data_Group_records¶

Data_Group records possible properties when object type

Properties:

Name (Type)	Default	Values	Description
value (string)			Value to store

Data_Group_Records_Base¶

Configures data group records to store

Properties:

Name (Type)	Default	Values	Description
records (array<Data_Group_Records_Base_records>)			List of records

Data_Group_Records_Base_records¶

Data_Group_Records_Base records possible properties when object type

Properties:

Name (Type)	Default	Values	Description
value (string)			Value to store

Data_Group_Records_Integer¶

A specialization of Data_Group_Records_Base where all items in the records property must be integers.

Properties:

Name (Type)	Default	Values	Description
records (array<Data_Group_Records_Integer_records>)			List of records

Data_Group_Records_Integer_records¶

Data_Group_Records_Integer records possible properties when object type

Properties:

Name (Type)	Default	Values	Description
value (string)			Value to store

Data_Group_Records_IP¶

A specialization of Data_Group_Records_Base where all items in the records property must be IP addresses.

Properties:

Name (Type)	Default	Values	Description
records (array<Data_Group_Records_IP_records>)			List of records

Data_Group_Records_IP_records¶

Data_Group_Records_IP records possible properties when object type

Properties:

Name (Type)	Default	Values	Description
value (string)			Value to store

Data_Group_Records_String¶

A specialization of Data_Group_Records_Base where all items in the records property must be strings.

Properties:

Name (Type)	Default	Values	Description
records (array<Data_Group_Records_String_records>)			List of records

Data_Group_Records_String_records¶

Data_Group_Records_String records possible properties when object type

Properties:

Name (Type)	Default	Values	Description
value (string)			Value to store

Datagroup_Value¶

Reference to a data-group containing the values

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP Data-Group
use (string)			BIG-IP AS3 pointer to Data_Group

DNS_Cache¶

Configures a DNS cache

Properties:

Name (Type)	Default	Values	Description
allowedQueryTime (integer)	200	[0, 4294967295]	The time allowed for a query to stay in the queue before replaced by a new query when the number of concurrent distinct queries exceeds the limit. The default value is 200 milliseconds.
answerDefaultZones (boolean)	false	true, false	Specifies whether the system answers DNS queries for the default zones localhost, reverse 127.0.0.1 and ::1, and AS112
class (string)		“DNS_Cache”
forwardZones (DNS_Cache_forwardZones \| DNS_Zone_Forward)			Manage the set of Forward Zones used by this DNS Cache
ignoreCd (boolean)	false	true, false	Ignore client queries setting of checking-disabled. Perform validation anyway and only return secure answers. The default value is no
keyCacheSize (integer)	1048576	[0, 4294967295]	Number of bytes allocated for the DNSKEY cache. The default value is 1m
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
localZones (DNS_Cache_localZones \| DNS_Zone_Local)			Configures resource records that a DNS cache uses to resolve matching DNS queries with authoritative DNS responses
maxConcurrentQueries (integer)	1024	[0, 4294967295]	Maximum number of concurrent queries used by the resolver. The default value is 1024
maxConcurrentTcp (integer)	20	[0, 4294967295]	Maximum number of concurrent TCP flows used by the resolver. The default value is 20
maxConcurrentUdp (integer)	8192	[0, 4294967295]	Maximum number of concurrent UDP flows used by the resolver. The default value is 8192
messageCacheSize (integer)	1048576	[0, 4294967295]	Specifies the maximum size of the message cache in bytes
msgCacheSize (integer)	1048576	[0, 4294967295]	Number of bytes allocated for the message cache. The default value is 1m
nameserverCacheCount (integer)	16536	[0, 4294967295]	Number of DNS nameservers to cache. The default value is 16k
prefetchKey (boolean)	true	true, false	Fetch DNSKEY early in validation process. The default value is yes
randomizeQueryNameCase (boolean)	true	true, false	Enables resolver to randomize the case of query names. The default value is yes
recordCacheSize (integer)	10485760	[1, 4294967295]	Specifies the maximum size of the resource record (RR) cache in bytes
recordRotationMethod (string)	“none”	“none”, “query-id”	Specifies the resource record rotation method used within cached responses
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
rootHints (array<string>)			List of IP addresses to use for root name servers. Defaults are known Internet root servers.
routeDomain (Pointer_Route_Domain)	{“bigip”:”/Common/0”}
trustAnchors (array<string>)			List of DNSKEY or DS resource records used to establish DNSSEC validator trust. Specified in string form (e.g. dig or drill format). The default is none
type (string)		“transparent”, “resolver”, “validating-resolver”	Type of DNS cache
unwantedQueryReplyThreshold (integer)	0	[0, 4294967295]	The threshold count of unsolicited query replies which triggers an alert (potential DOS attack underway). The default value is 0 (or off)
useIpv4 (boolean)	true	true, false	Enables resolver to issue IPv4 queries. The default value is yes
useIpv6 (boolean)	true	true, false	Enables resolver to issue IPv6 queries. The default value is yes
useTcp (boolean)	true	true, false	Enables resolver to issue tcp queries. The default value is yes
useUdp (boolean)	true	true, false	Enables resolver to issue udp queries. The default value is yes

DNS_Cache_Resolver¶

DNS Cache with recursive resolver

Properties:

Name (Type)	Default	Values	Description
allowedQueryTime (integer)	200	[0, 4294967295]	The time allowed for a query to stay in the queue before replaced by a new query when the number of concurrent distinct queries exceeds the limit. The default value is 200 milliseconds.
answerDefaultZones (boolean)	false	true, false	Specifies whether the system answers DNS queries for the default zones localhost, reverse 127.0.0.1 and ::1, and AS112
forwardZones (DNS_Cache_Resolver_forwardZones \| DNS_Zone_Forward)			Manage the set of Forward Zones used by this DNS Cache
localZones (DNS_Cache_Resolver_localZones \| DNS_Zone_Local)			Configures resource records that a DNS cache uses to resolve matching DNS queries with authoritative DNS responses
maxConcurrentQueries (integer)	1024	[0, 4294967295]	Maximum number of concurrent queries used by the resolver. The default value is 1024
maxConcurrentTcp (integer)	20	[0, 4294967295]	Maximum number of concurrent TCP flows used by the resolver. The default value is 20
maxConcurrentUdp (integer)	8192	[0, 4294967295]	Maximum number of concurrent UDP flows used by the resolver. The default value is 8192
msgCacheSize (integer)	1048576	[0, 4294967295]	Number of bytes allocated for the message cache. The default value is 1m
nameserverCacheCount (integer)	16536	[0, 4294967295]	Number of DNS nameservers to cache. The default value is 16k
randomizeQueryNameCase (boolean)	true	true, false	Enables resolver to randomize the case of query names. The default value is yes
recordCacheSize (integer)	10485760	[0, 4294967295]	Number of bytes allocated for the resource record set cache. The default value is 10m
recordRotationMethod (string)	“none”	“none”, “query-id”	Select which resource record set rotation method should be used on cache responses
rootHints (array<string>)			List of IP addresses to use for root name servers. Defaults are known Internet root servers.
routeDomain (Pointer_Route_Domain)	{“bigip”:”/Common/0”}
unwantedQueryReplyThreshold (integer)	0	[0, 4294967295]	The threshold count of unsolicited query replies which triggers an alert (potential DOS attack underway). The default value is 0 (or off)
useIpv4 (boolean)	true	true, false	Enables resolver to issue IPv4 queries. The default value is yes
useIpv6 (boolean)	true	true, false	Enables resolver to issue IPv6 queries. The default value is yes
useTcp (boolean)	true	true, false	Enables resolver to issue tcp queries. The default value is yes
useUdp (boolean)	true	true, false	Enables resolver to issue udp queries. The default value is yes

DNS_Cache_Transparent¶

Properties for a DNS transparent cache

Properties:

Name (Type)	Default	Values	Description
answerDefaultZones (boolean)	false	true, false	Specifies whether the system answers DNS queries for the default zones localhost, reverse 127.0.0.1 and ::1, and AS112
localZones (DNS_Cache_Transparent_localZones \| DNS_Zone_Local)			Configures resource records that a DNS cache uses to resolve matching DNS queries with authoritative DNS responses
messageCacheSize (integer)	1048576	[0, 4294967295]	Specifies the maximum size of the message cache in bytes
recordCacheSize (integer)	10485760	[1, 4294967295]	Specifies the maximum size of the resource record (RR) cache in bytes
recordRotationMethod (string)	“none”	“none”, “query-id”	Specifies the resource record rotation method used within cached responses

DNS_Cache_Validating_Resolver¶

DNS Cache with recursive resolver and DNSSEC validation

Properties:

Name (Type)	Default	Values	Description
allowedQueryTime (integer)	200	[0, 4294967295]	The time allowed for a query to stay in the queue before replaced by a new query when the number of concurrent distinct queries exceeds the limit. The default value is 200 milliseconds.
answerDefaultZones (boolean)	false	true, false	Specifies whether the system answers DNS queries for the default zones localhost, reverse 127.0.0.1 and ::1, and AS112
forwardZones (DNS_Cache_Validating_Resolver_forwardZones \| DNS_Zone_Forward)			Manage the set of Forward Zones used by this DNS Cache
ignoreCd (boolean)	false	true, false	Ignore client queries setting of checking-disabled. Perform validation anyway and only return secure answers. The default value is no
keyCacheSize (integer)	1048576	[0, 4294967295]	Number of bytes allocated for the DNSKEY cache. The default value is 1m
localZones (DNS_Cache_Validating_Resolver_localZones \| DNS_Zone_Local)			Configures resource records that a DNS cache uses to resolve matching DNS queries with authoritative DNS responses
maxConcurrentQueries (integer)	1024	[0, 4294967295]	Maximum number of concurrent queries used by the resolver. The default value is 1024
maxConcurrentTcp (integer)	20	[0, 4294967295]	Maximum number of concurrent TCP flows used by the resolver. The default value is 20
maxConcurrentUdp (integer)	8192	[0, 4294967295]	Maximum number of concurrent UDP flows used by the resolver. The default value is 8192
msgCacheSize (integer)	1048576	[0, 4294967295]	Number of bytes allocated for the message cache. The default value is 1m
nameserverCacheCount (integer)	16536	[0, 4294967295]	Number of DNS nameservers to cache. The default value is 16k
prefetchKey (boolean)	true	true, false	Fetch DNSKEY early in validation process. The default value is yes
randomizeQueryNameCase (boolean)	true	true, false	Enables resolver to randomize the case of query names. The default value is yes
recordCacheSize (integer)	10485760	[0, 4294967295]	Number of bytes allocated for the resource record set cache. The default value is 10m
recordRotationMethod (string)	“none”	“none”, “query-id”	Select which resource record set rotation method should be used on cache responses
rootHints (array<string>)			List of IP addresses to use for root name servers. Defaults are known Internet root servers.
routeDomain (Pointer_Route_Domain)	{“bigip”:”/Common/0”}
trustAnchors (array<string>)			List of DNSKEY or DS resource records used to establish DNSSEC validator trust. Specified in string form (e.g. dig or drill format). The default is none
unwantedQueryReplyThreshold (integer)	0	[0, 4294967295]	The threshold count of unsolicited query replies which triggers an alert (potential DOS attack underway). The default value is 0 (or off)
useIpv4 (boolean)	true	true, false	Enables resolver to issue IPv4 queries. The default value is yes
useIpv6 (boolean)	true	true, false	Enables resolver to issue IPv6 queries. The default value is yes
useTcp (boolean)	true	true, false	Enables resolver to issue tcp queries. The default value is yes
useUdp (boolean)	true	true, false	Enables resolver to issue udp queries. The default value is yes

DNS_Logging_Profile¶

Configures a Domain Name System (DNS) logging profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“DNS_Logging_Profile”
includeCompleteAnswer (boolean)	true	true, false	Specifies whether the system logs the complete answer from the query
includeQueryId (boolean)	false	true, false	Specifies whether the system logs the ID of the query
includeSource (boolean)	true	true, false	Specifies whether the system logs the source (the BIG-IP system that receives the packet)
includeTimestamp (boolean)	true	true, false	Specifies whether the system logs the timestamp of when the query was created
includeView (boolean)	true	true, false	Specifies whether the system includes the view in the log
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
logPublisher (Pointer_Log_Publisher)
logQueriesEnabled (boolean)	true	true, false	Specifies whether the system logs queries
logResponsesEnabled (boolean)	false	true, false	Specifies whether the systems logs responses
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

DNS_Nameserver¶

Configures a DNS nameserver

Properties:

Name (Type)	Default	Values	Description
address (string)	“127.0.0.1”	format: f5ip	Specifies the IP address on which the DNS nameserver (client) or back-end DNS authoritative server (DNS Express server) listens for DNS messages
class (string)		“DNS_Nameserver”
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
port (integer)	53	[0, 65535]	Specifies the service port on which the DNS nameserver (client) or back-end DNS authoritative server (DNS Express server) listens for DNS messages
routeDomain (Pointer_Route_Domain)	{“bigip”:”/Common/0”}
tsigKey (Pointer_DNS_TSIG_Key)

DNS_Profile¶

Configures a Domain Name System (DNS) profile

Properties:

Name (Type)	Default	Values	Description
cache (Pointer_DNS_Cache)
cacheEnabled (boolean)	false	true, false	Specifies whether the system caches DNS responses
class (string)		“DNS_Profile”
dns64AdditionalSectionRewrite (string)	“disabled”	“disabled”, “v6-only”, “v4-only”, “any”	Select an option to allow improved network efficiency for both Unicast and Multicast DNS-SD responses
dns64Mode (string)	“disabled”	“disabled”, “secondary”, “immediate”, “v4-only”	Specifies handling of AAAA and A DNS queries and responses
dns64Prefix (string)	“0:0:0:0:0:0:0:0”		Specifies the prefix to use for the IPv6-formatted IP addresses that the system converts to IPv4-formatted IP addresses
dnsExpressEnabled (boolean)	true	true, false	Specifies whether the DNS Express engine is enabled. The DNS Express engine receives zone transfers from the authoritative DNS server for the zone. If the Zone Transfer setting is also enabled on this profile, the DNS Express engine also responds to zone transfer requests made by the nameservers configured as zone transfer clients for the DNS Express zone.
dnssecEnabled (boolean)	true	true, false	Specifies whether the system signs responses with DNSSEC keys and replies to DNSSEC specific queries (e.g., DNSKEY query type)
globalServerLoadBalancingEnabled (boolean)	true	true, false	Specifies whether the system uses Global Traffic Manager to manage the response
hardwareQueryValidationEnabled (boolean)	false	true, false	On supported platforms, indicates whether the hardware will accelerate query validation
hardwareResponseCacheEnabled (boolean)	false	true, false	On supported platforms, indicates whether the hardware will cache responses
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
localBindServerEnabled (boolean)	true	true, false	Specifies whether the system forwards non-wide IP queries to the local BIND server on the BIG-IP system. For best performance, disable this setting when using a DNS cache.
loggingEnabled (boolean)	true	true, false	Specifies whether to process client-side DNS packets with Recursion Desired set in the header. If set to Disabled, processing of the packet is subject to the unhandled-query-action option.
loggingProfile (Pointer_DNS_Logging_Profile)
parentProfile (Pointer_DNS_Profile)	{“bigip”:”/Common/dns”}		Specifies the name of the object to inherit the settings from
rapidResponseEnabled (boolean)	false	true, false	When enabled, if the query name matches a GTM wide IP name and GTM is enabled on this profile, the DNS query will bypass Rapid Response. Note: This setting is supported only on physical BIG-IP hardware because it needs a High-Speed Bridge (HSB) to work. When using BIG-IP Virtual Edition, however, the system does not prevent you from selecting an action, even though the setting is ignored.
rapidResponseLastAction (string)	“drop”	“allow”, “drop”, “noerror”, “nxdomain”, “refuse”, “truncate”	Specifies what action the system takes when Rapid Response Mode is enabled and the incoming DNS query does not match a DNS Express Zone
recursionDesiredEnabled (boolean)	true	true, false	Specifies whether to process client-side DNS packets with Recursion Desired set in the header. If set to Disabled, processing of the packet is subject to the unhandled-query-action option.
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
securityEnabled (boolean)	true	true, false	Specifies whether DNS firewall capability is enabled.
securityProfile (Pointer_DNS_Security_Profile)
statisticsSampleRate (integer)	0	[0, 4294967295]	Sets AVR DNS statistics sampling rate. A value of 0 (zero) means that no query will be sent to the analytics database. A value of 1 means that every query will be sent. A value of n means that every nth query will be sent, and that the analytics database will count that query n times. When sampling rate is greater than one, the statistics will be inaccurate if the traffic volume is low. However, when the traffic volume is high, the system performance will benefit from sampling and the inaccuracy will be negligible. DNS statistics contain query name, query type, virtual server IP and client IP.
unhandledQueryAction (string)	“allow”	“allow”, “drop”, “hint”, “noerror”, “reject”	Specifies whether the system uses the local BIND server on the BIG-IP system
zoneTransferEnabled (boolean)	false	true, false	Specifies whether the system answers zone transfer requests for a DNS zone created on the system. The DNS Express and Zone Transfer settings on a DNS profile affect how the system responds to zone transfer requests.

DNS_TSIG_Key¶

Configures a TSIG key

Properties:

Name (Type)	Default	Values	Description
algorithm (string)	“hmacmd5”	“hmacmd5”, “hmacsha1”, “hmacsha256”	Specifies the algorithm the system uses to authenticate AXFR zone transfer requests as coming from an approved DNS nameserver, or to authenticate AXFR zone transfers as coming from an approved back-end DNS authoritative server. The algorithm involves a cryptographic hash function in combination with a secret, which is specified in the Secret field. The default is HMAC MD5 (the Hash-based Message Authentication Code MD5).
class (string)		“DNS_TSIG_Key”
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
secret (DNS_TSIG_Key_secret)			Specifies the secret used with the algorithm in the verification process. The secret must be generated by a third-party tool such as BIND’s keygen utility; the BIG-IP system does not generate the TSIG key secret.

DNS_TSIG_Key_secret¶

DNS_TSIG_Key secret possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

DNS_Zone¶

Configures a DNS zone

Properties:

Name (Type)	Default	Values	Description
class (string)		“DNS_Zone”
dnsExpress (DNS_Zone_DNS_Express)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
responsePolicyEnabled (boolean)	false	true, false	Specifies if this is a response policy zone. If this is set to yes, this zone may be assigned as an RPZ to a DNS Cache
serverTsigKey (Pointer_DNS_TSIG_Key)
transferClients (array<Pointer_DNS_Nameserver>)			Specifies the DNS nameservers to which the system sends NOTIFY messages. The system allows only the DNS nameservers in the Active column to initiate AXFR zone transfers for this DNS zone.

DNS_Zone_DNS_Express¶

Configure zone DNS Express settings

Properties:

Name (Type)	Default	Values	Description
allowNotifyFrom (array<string>)		format: f5ip	Specifies the IP addresses from which the system accepts NOTIFY messages for this DNS Express zone
enabled (boolean)	true	true, false	Specifies whether DNS Express is enabled to process queries for this zone
nameserver (Pointer_DNS_Nameserver)			Specifies the back-end authoritative DNS server from which the BIG-IP system receives AXFR zone transfers for the DNS Express zone. The options are None and user-defined nameservers.
notifyAction (string)	“consume”	“consume”, “bypass”, “repeat”	Specifies the action the system takes when a NOTIFY message is received for this DNS Express zone. NOTIFY responses are assumed to be sent by the authoritative nameserver for the zone, except when the action is Consume, and then DNS Express generates the response. Note: If a TSIG key is configured for the zone, the signature is only validated for Consume and Repeat actions.
verifyNotifyTsig (boolean)	true	true, false	Specifies whether the system verifies the identity of the authoritative nameserver that sends updated information for this DNS Express zone

DNS_Zone_Forward¶

Manage the set of Forward Zones used by DNS Cache

Properties:

Name (Type)	Default	Values	Description
nameservers (array<string>)			An array of nameservers and ports

DNS_Zone_Local¶

Configures resource records that a DNS cache uses to resolve matching DNS queries with authoritative DNS responses

Properties:

Name (Type)	Default	Values	Description
records (array<string>)			A or AAAA record entry
type (string)	“transparent”	“deny”, “redirect”, “refuse”, “static”, “transparent”, “type-transparent”	Describes how the cache handles a non-matching query for the local zone

DOS_Auto_Denylist_Settings¶

Adds the source IP address to the denylist category assigned to the Denial-of-Service (DoS) vector

Properties:

Name (Type)	Default	Values	Description
attackDetectionTime (integer)	60	[1, 4294967295]	Specifies the time in seconds before a vector is denylisted
category (Pointer_Denylist_Category)	{“bigip”:”/Common/denial_of_service”}		Specifies the denylist category assigned to the DoS vector. The settings for this category determine IP Intelligence actions, logging settings, and denylist publisher settings.
categoryDuration (integer)	14400	[60, 4294967295]	Specifies the time in seconds before the denylist entry is removed
enabled (boolean)	false	true, false	Specifies if automatic denylist management should be used
externalAdvertisementEnabled (boolean)	false	true, false	Specifies that addresses that are identified for denylisting are advertised to BGP routers, as configured per denylist category in Blacklist Publisher

DOS_Bad_Actor_Detection_Settings¶

Bad actor detection allows automatic detection, logging, and rate limiting of specific IP addresses that appear to be the source of an attack, based on criteria you configure.

Properties:

Name (Type)	Default	Values	Description
enabled (boolean)	false	true, false	Specifies that Bad Actor detection is enabled
sourceDetectionThreshold (integer)	4294967295	[0, 4294967295]	Specifies the number of packets per second to identify an IP address as a bad actor
sourceMitigationThreshold (integer)	4294967295	[0, 4294967295]	Specifies the rate limit applied to a source IP that is identified as a bad actor

DOS_DNS_Vector¶

Protocol DNS Denial-of-Service (DoS) vector

Properties:

Name (Type)	Default	Values	Description
autoAttackCeiling (integer)	4294967295	[0, 4294967295]	Specifies the absolute maximum allowable for packets of this type. This setting rate limits packets to the packets per second setting, when specified. To set no hard limit and allow automatic thresholds to manage all rate limiting, set this to 4294967295.
autoAttackFloor (integer)	100	[0, 4294967295]	Specifies packets per second to identify an attack. These settings provide an absolute minimum of packets to allow before the attack is identified. As the automatic detection thresholds adjust to traffic and CPU usage on the system over time, this attack floor becomes less relevant.
autoBlacklistSettings (DOS_Auto_Denylist_Settings)	{}		Deprecated. Replaced with functionally equivalent autoDenylistSettings.
autoDenylistSettings (DOS_Auto_Denylist_Settings)
badActorSettings (DOS_Bad_Actor_Detection_Settings)	{}
rateIncreaseThreshold (integer)	500	[0, 4294967295]	Specify percent of rate increase the system must discover in traffic in order to detect this attack
rateLimit (integer)	4294967295	[0, 4294967295]	Specify the maximum number of this type of packet per second the system allows for a vector. The system drops packets once the traffic level exceeds the rate limit.
rateThreshold (integer)	4294967295	[0, 4294967295]	Specify how many packets per second the system must discover in traffic in order to detect this attack
simulateAutoThresholdEnabled (boolean)	false	true, false	Specifies that results of the current automatic thresholds are logged, though manual thresholds are enforced, and no action is taken on automatic thresholds
state (string)	“mitigate”	“disabled”, “learn-only”, “detect-only”, “mitigate”	Specifies how to enforce protection for that attack type: mitigate (watch, learn, alert, and mitigate), detect-only (watch, learn, and alert), learn-only (collect stats, no mitigation), or Disabled (no stat collection, no mitigation).
thresholdMode (string)	“manual”	“manual”, “stress-based-mitigation”, “fully-automatic”	Specifies how thresholds are set for this vector
type (string)		“a”, “aaaa”, “any”, “axfr”, “cname”, “ixfr”, “mx”, “ns”, “nxdomain”, “other”, “ptr”, “qdcount”, “soa”, “srv”, “txt”, “malformed”	Specifies the name of the DoS attack vector whose thresholds you are configuring

DOS_Network_Vector¶

Network Denial-of-Service (DoS) vector

Properties:

Name (Type)	Default	Values	Description
autoAttackCeiling (integer)	4294967295	[0, 4294967295]	Specifies the absolute maximum allowable for packets of this type. This setting rate limits packets to the packets per second setting, when specified. To set no hard limit and allow automatic thresholds to manage all rate limiting, set this to 4294967295.
autoAttackFloor (integer)	100	[0, 4294967295]	Specifies packets per second to identify an attack. These settings provide an absolute minimum of packets to allow before the attack is identified. As the automatic detection thresholds adjust to traffic and CPU usage on the system over time, this attack floor becomes less relevant.
autoBlacklistSettings (DOS_Auto_Denylist_Settings)	{}		Deprecated. Replaced with functionally equivalent autoDenylistSettings.
autoDenylistSettings (DOS_Auto_Denylist_Settings)
badActorSettings (DOS_Bad_Actor_Detection_Settings)	{}
rateIncreaseThreshold (integer)	500	[0, 4294967295]	Specify percent of rate increase the system must discover in traffic in order to detect this attack
rateLimit (integer)	4294967295	[0, 4294967295]	Specify the maximum number of this type of packet per second the system allows for a vector. The system drops packets once the traffic level exceeds the rate limit.
rateThreshold (integer)	4294967295	[0, 4294967295]	Specify how many packets per second the system must discover in traffic in order to detect this attack
simulateAutoThresholdEnabled (boolean)	false	true, false	Specifies that results of the current automatic thresholds are logged, though manual thresholds are enforced, and no action is taken on automatic thresholds
state (string)	“mitigate”	“disabled”, “learn-only”, “detect-only”, “mitigate”	Specifies how to enforce protection for that attack type: mitigate (watch, learn, alert, and mitigate), detect-only (watch, learn, and alert), learn-only (collect stats, no mitigation), or Disabled (no stat collection, no mitigation).
thresholdMode (string)	“manual”	“manual”, “stress-based-mitigation”, “fully-automatic”	Specifies how thresholds are set for this vector
type (string)		“ext-hdr-too-large”, “hop-cnt-low”, “host-unreachable”, “icmpv4-flood”, “icmpv6-flood”, “icmp-frag”, “ip-frag-flood”, “ip-low-ttl”, “ip-opt-frames”, “ipv6-ext-hdr-frames”, “ipv6-frag-flood”, “non-tcp-connection”, “opt-present-with-illegal-len”, “sweep”, “tcp-half-open”, “tcp-opt-overruns-tcp-hdr”, “tcp-psh-flood”, “tcp-rst-flood”, “tcp-syn-flood”, “tcp-synack-flood”, “tcp-syn-oversize”, “tcp-bad-urg”, “tcp-window-size”, “tidcmp”, “too-many-ext-hdrs”, “udp-flood”, “unk-tcp-opt-type”	Specifies the name of the DoS attack vector whose thresholds you are configuring

DOS_Profile¶

Configures a Denial of Service (DOS) profile

Properties:

Name (Type)	Values	Description
allowlist (Pointer_Address_List)		Specifies the default allowlist address list for the system to use to determine which IP addresses are legitimate. The system does not examine traffic from the IP addresses in the list when performing DoS prevention. This property is available on BIGIP 14.1 and above.
application (reference \| DOS_Profile_Application)		Application security sub-profile
applicationAllowlist (reference \| Pointer_Address_List)		Specifies the IP addresses and subnets allowlist configuration for Application Security (Overrides the global allowlist)
applicationWhitelist (reference \| Pointer_Address_List)		Deprecated. Replaced with functionally equivalent applicationAllowlist. Specifies the IP addresses and subnets allowlist configuration for Application Security (Overrides the global allowlist)
class (string)	“DOS_Profile”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
network (reference \| DOS_Profile_Network)		Network security sub-profile
protocolDNS (reference \| DOS_Profile_Protocol_DNS)		DNS protocol security sub-profile
protocolSIP (reference \| DOS_Profile_Protocol_SIP)		SIP protocol security sub-profile
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
whitelist (Pointer_Address_List)		Deprecated. Replaced with functionally equivalent allowlist. Specifies the default allowlist address list for the system to use to determine which IP addresses are legitimate. The system does not examine traffic from the IP addresses in the list when performing DoS prevention. This property is available on BIGIP 14.1 and above.

DOS_Profile_Application¶

Specifies the conditions for determining that your application is under a DoS attack, and how the system reacts to a suspected attack.

Properties:

Name (Type)	Default	Values	Description
allowlistedGeolocations (array<string>)			Override the DoS profile’s geolocation rate based threshold settings by selecting countries from which to allow traffic during a DoS attack
blacklistedGeolocations (array<string>)			Deprecated. Replaced with functionally equivalent denylistedGeolocations. Override the DoS profile’s geolocation rate based threshold settings by selecting countries from which to block traffic during a DoS attack
botDefense (DOS_Profile_Application_Bot_Defense)	{}		This feature proactively detects bots and scripts, and prevents them from accessing the site. It may be used to prevent DDoS, Web Scraping, and Brute Force attacks. Enabling this feature requires JavaScript support from the browsers.
botSignatures (DOS_Profile_Application_Bot_Signatures)	{}		This feature automatically detects well known bots according to their HTTP characteristics. Malicious bots can be configured to be blocked, while benign bots can be configured to pass through the anti-bot defense mechanisms
captchaResponse (DOS_Profile_Application_Captcha)	{}
denylistedGeolocations (array<string>)			Override the DoS profile’s geolocation rate based threshold settings by selecting countries from which to block traffic during a DoS attack
heavyURLProtection (DOS_Profile_Application_Heavy_URL)	{}		Configure Heavy URL include list, automatic detection, and exclude list
mobileDefense (DOS_Profile_Application_Mobile_Defense)	{}		This feature detects mobile applications built with the Anti-Bot Mobile SDK and defines how requests from these mobile application clients are handled
profileAcceleration (Pointer_L4_Profile)			Select a TCP fastL4 profile to be used as a fast-path for acceleration
rateBasedDetection (DOS_Profile_Application_Rate_Based_Detection)	{}		Configures the detection of DoS attacks based on high volume of incoming traffic
recordTraffic (DOS_Profile_Application_TCP_Dump)	{}		This feature allows automatic recording of traffic during DoS attacks, and storing the recordings as TCP Dump files. The files are placed in the system file path /shared/dosl7/tcpdumps.
remoteTriggeredBlackHoleDuration (integer)		[0, 4294967295]	Specifies the BGP route advertisement duration in seconds for Remote Triggered Black Hole of attacking IPs. This requires configuration of the Blacklist Publisher, and will function even when the Operation Mode is set to Transparent. A value of 0 disables Remote Triggered Black Hole. Requires the AFM module and if this property is unspecified it will be disabled.
scrubbingDuration (integer)		[0, 4294967295]	Specifies the BGP route advertisement duration in seconds for Traffic Scrubbing during attacks. This requires configuration of the Scrubber Profile, and will function even when the Operation Mode is set to Transparent. A value of 0 disables Traffic Scrubbing. Requires the AFM module and if this property is unspecified it will be disabled.
singlePageApplicationEnabled (boolean)	false	true, false	Specifies that your website is a Single Page Application, meaning a web application that loads new content without triggering a full page-reload. This property is available on BIGIP 14.1 and above.
stressBasedDetection (DOS_Profile_Application_Stress_Based_Detection)	{}		Configures the detection of DoS attacks based on server stress. The system automatically detects an increase in server stress and mitigates DoS attacks causing it.
triggerIRule (boolean)	false	true, false	Specifies that the system activates an Application DoS iRule event
whitelistedGeolocations (array<string>)			Deprecated. Replaced with functionally equivalent allowlistedGeolocations. Override the DoS profile’s geolocation rate based threshold settings by selecting countries from which to allow traffic during a DoS attack

DOS_Profile_Application_Bot_Defense¶

BIG-IP AS3 provides defense against bot attacks by detecting and stopping them before the attacks start to grow, by performing the following:

The system sends a client-side JavaScript challenge to the browser.
If the challenge is met, the system adds a cookie to the second request. This cookie is active until the session ends, and the system does not add any more cookies to further requests during that session.
The system drops requests sent by browsers that do not answer the system’s initial JavaScript challenge, assuming they are bots that do not support JavaScript.

Note: This feature requires browsers to allow JavaScript.

Important: The proactive bot defense feature works also in Transparent mode. This means that the system will replace responses with client side JavaScript also in Transparent mode, and if the client cannot run JavaScript, it will not be able to receive the server responses.

Important: If you enable Proactive Bot Defense and your web site uses CORS (Cross-Origin Resource Sharing), we recommend that you add the CORS URLs to the proactive bot URL allowlist.

This method is intended to complement, not replace, the other mitigation methods.

Properties:

Name (Type)	Default	Values	Description
blockSuspiscousBrowsers (boolean)	true	true, false	Detect and block requests from highly suspicious browsers
crossDomainRequests (string)	“allow-all”	“allow-all”, “validate-bulk”, “validate-upon-request”	Specifies how the system responds when receiving a request for non-HTML resources (images, CSS, XML, JavaScript, and Flash) without a valid cookie, and has a Referer header with a different domain than the host domain. This property is available on BIGIP 14.1 and above.
externalDomains (array<string>)			Specifies the external referring domains (that are not part of your website) that are allowed to link to resources in your website. These domains are not protected with proactive bot defense, but the system allows them if they pass the system’s redirect-cookie challenge. This property is available on BIGIP 14.1 and above.
gracePeriod (integer)	300	[0, 4294967295]	The length of time (in seconds) before the system blocks suspected bots. The grace period allows web application pages with both HTML and non-HTML (like images, JS, and CSS) to load completely without being blocked. The grace period starts after client validation, a configuration change, or when proactive bot defense is activated as a result of a detected attack or high latency. This property is available on BIGIP 14.1 and above.
issueCaptchaChallenge (boolean)	true	true, false	Issue CAPTCHA challenges to moderately suspicious browsers
mode (string)	“off”	“off”, “during-attacks”, “always”	Specifies the conditions under which bots are detected and blocked
siteDomains (array<string>)			Specifies how the system responds when receiving a request for non-HTML resources (images, CSS, XML, JavaScript, and Flash) without a valid cookie, and has a Referer header with a different domain than the host domain. This property is available on BIGIP 14.1 and above.
urlAllowlist (array<string>)			Specifies excluded URLs. Requests to these URLs will not be blocked by Proactive Bot Defense, although they may still be blocked by the TPS-based / Stress-based attack mitigation
urlWhitelist (array<string>)			Deprecated. Replaced with functionally equivalent urlAllowlist. Specifies excluded URLs. Requests to these URLs will not be blocked by Proactive Bot Defense, although they may still be blocked by the TPS-based / Stress-based attack mitigation

DOS_Profile_Application_Bot_Signatures¶

This feature automatically detects well known bots according to their HTTP characteristics. Malicious bots can be configured to be blocked, while benign bots can be configured to pass through the anti-bot defense mechanisms.

Properties:

Name (Type)	Default	Values	Description
blockedCategories (array<Pointer_Bot_Signature_Category>)			The system blocks and reports requests that match signatures in this list of categories
checkingEnabled (boolean)	false	true, false	Specifies the system uses signatures to check whether a bot is benign or malicious
disabledSignatures (array<Pointer_Bot_Signature>)			A list of signatures the system ignores when it matches requests with configured bot signatures
reportedCategories (array<Pointer_Bot_Signature_Category>)			The system logs requests that match signatures in this list of categories and counts them in the DoS reports

DOS_Profile_Application_Captcha¶

Specifies the text the system sends, during a suspected DoS event, to users after it challenges users with the first CAPTCHA response, and the text the system sends to users after they fail a CAPTCHA response.

Properties:

Name (Type)	Default	Values	Description
failure (string)			Specifies the content the system displays to a user after the user fails to correctly answer a CAPTCHA
first (string)			Specifies the content that the system displays to a user the first time the user is asked to respond to a CAPTCHA

DOS_Profile_Application_Detection_Device¶

Specifies the criteria that determines when the system treats a device as an attacker

Properties:

Name (Type)	Default	Values	Description
captchaChallengeEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a CAPTCHA challenge to determine whether the client is a legal browser with a human user behind it, or an illegal script. (Legal browsers with human users behind them are able to respond, while illegal scripts cannot.)
clientSideDefenseEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a client-side integrity challenge that will consume computation resources from the client and slow its attack rate. The system issues a client-side integrity challenge to determine whether the client is a legal browser or an illegal script by sending a JavaScript challenge and waiting for a response. (Legal browsers are able to respond, while illegal scripts cannot.)
maximumAutoTps (integer)	5000	[0, 4294967295]	Maximum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
maximumTps (integer)	200	[0, 4294967295]	The maximum number of transactions per second before a source is always considered an attacking entity
minimumAutoTps (integer)	5	[0, 4294967295]	Minimum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumTps (integer)	40	[0, 4294967295]	The minimum number of transactions per second before a source can be considered an attacking entity. This condition and the increase rate condition must be met for a source to be considered an attacking entity.
rateLimitingEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system applies rate limiting to the traffic
rateLimitingMode (string)	“rate-limit”	“rate-limit”, “block-all”	Specifies if rate limiting should block all traffic (‘block-all’) or apply normal rate limiting (‘rate-limit’).
tpsIncreaseRate (integer)	500	[0, 4294967295]	The transactions per second increase (as a percentage) that must occur before a source can be considered an attacking entity. This condition and the minimum TPS condition must be met for a source to be considered an attacking entity.

DOS_Profile_Application_Detection_Geolocation¶

Specifies the criteria that determines when the system treats a geolocation as an attacker

Properties:

Name (Type)	Default	Values	Description
captchaChallengeEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a CAPTCHA challenge to determine whether the client is a legal browser with a human user behind it, or an illegal script. (Legal browsers with human users behind them are able to respond, while illegal scripts cannot.)
clientSideDefenseEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a client-side integrity challenge that will consume computation resources from the client and slow its attack rate. The system issues a client-side integrity challenge to determine whether the client is a legal browser or an illegal script by sending a JavaScript challenge and waiting for a response. (Legal browsers are able to respond, while illegal scripts cannot.)
maximumAutoTps (integer)	20000	[0, 4294967295]	Maximum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumAutoTps (integer)	50	[0, 4294967295]	Minimum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumShare (integer)	10	[0, 4294967295]	The minimum share of traffic (as a percentage) before a source can be considered an attacking entity. This condition and the share increase rate condition must be met for a source to be considered an attacking entity.
rateLimitingEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system applies rate limiting to the traffic
rateLimitingMode (string)	“rate-limit”	“rate-limit”, “block-all”	Specifies if rate limiting should block all traffic (‘block-all’) or apply normal rate limiting (‘rate-limit’).
shareIncreaseRate (integer)	500	[0, 4294967295]	The share increase (as a percentage) that must occur before a source can be considered an attacking entity. This condition and the minimum share condition must be met for a source to be considered an attacking entity.

DOS_Profile_Application_Detection_IP¶

Specifies the criteria that determines when the system treats a source IP address as an attacker

Properties:

Name (Type)	Default	Values	Description
captchaChallengeEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a CAPTCHA challenge to determine whether the client is a legal browser with a human user behind it, or an illegal script. (Legal browsers with human users behind them are able to respond, while illegal scripts cannot.)
clientSideDefenseEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a client-side integrity challenge that will consume computation resources from the client and slow its attack rate. The system issues a client-side integrity challenge to determine whether the client is a legal browser or an illegal script by sending a JavaScript challenge and waiting for a response. (Legal browsers are able to respond, while illegal scripts cannot.)
maximumAutoTps (integer)	5000	[0, 4294967295]	Maximum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
maximumTps (integer)	200	[0, 4294967295]	The maximum number of transactions per second before a source is always considered an attacking entity
minimumAutoTps (integer)	5	[0, 4294967295]	Minimum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumTps (integer)	40	[0, 4294967295]	The minimum number of transactions per second before a source can be considered an attacking entity. This condition and the increase rate condition must be met for a source to be considered an attacking entity.
rateLimitingEnabled (boolean)	true	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system applies rate limiting to the traffic
rateLimitingMode (string)	“rate-limit”	“rate-limit”, “block-all”	Specifies if rate limiting should block all traffic (‘block-all’) or apply normal rate limiting (‘rate-limit’).
tpsIncreaseRate (integer)	500	[0, 4294967295]	The transactions per second increase (as a percentage) that must occur before a source can be considered an attacking entity. This condition and the minimum TPS condition must be met for a source to be considered an attacking entity.

DOS_Profile_Application_Detection_Site¶

Specifies the criteria that determines when the system treats a site as an attacker

Properties:

Name (Type)	Default	Values	Description
captchaChallengeEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a CAPTCHA challenge to determine whether the client is a legal browser with a human user behind it, or an illegal script. (Legal browsers with human users behind them are able to respond, while illegal scripts cannot.)
clientSideDefenseEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a client-side integrity challenge that will consume computation resources from the client and slow its attack rate. The system issues a client-side integrity challenge to determine whether the client is a legal browser or an illegal script by sending a JavaScript challenge and waiting for a response. (Legal browsers are able to respond, while illegal scripts cannot.)
maximumAutoTps (integer)	20000	[0, 4294967295]	Maximum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
maximumTps (integer)	10000	[0, 4294967295]	The maximum number of transactions per second before a source is always considered an attacking entity
minimumAutoTps (integer)	5	[0, 4294967295]	Minimum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumTps (integer)	2000	[0, 4294967295]	The minimum number of transactions per second before a source can be considered an attacking entity. This condition and the increase rate condition must be met for a source to be considered an attacking entity.
rateLimitingEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system applies rate limiting to the traffic
tpsIncreaseRate (integer)	500	[0, 4294967295]	The transactions per second increase (as a percentage) that must occur before a source can be considered an attacking entity. This condition and the minimum TPS condition must be met for a source to be considered an attacking entity.

DOS_Profile_Application_Detection_URL¶

Specifies the criteria that determines when the system treats a URL as an attacker

Properties:

Name (Type)	Default	Values	Description
captchaChallengeEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a CAPTCHA challenge to determine whether the client is a legal browser with a human user behind it, or an illegal script. (Legal browsers with human users behind them are able to respond, while illegal scripts cannot.)
clientSideDefenseEnabled (boolean)	false	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system issues a client-side integrity challenge that will consume computation resources from the client and slow its attack rate. The system issues a client-side integrity challenge to determine whether the client is a legal browser or an illegal script by sending a JavaScript challenge and waiting for a response. (Legal browsers are able to respond, while illegal scripts cannot.)
heavyURLProtectionEnabled (boolean)	true	true, false	Specifies, when enabled, that heavy URL protection should be enabled
maximumAutoTps (integer)	5000	[0, 4294967295]	Maximum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
maximumTps (integer)	1000	[0, 4294967295]	The maximum number of transactions per second before a source is always considered an attacking entity
minimumAutoTps (integer)	5	[0, 4294967295]	Minimum number of transactions per second of an auto-calculated threshold before a source is considered an attacking entity
minimumTps (integer)	200	[0, 4294967295]	The minimum number of transactions per second before a source can be considered an attacking entity. This condition and the increase rate condition must be met for a source to be considered an attacking entity.
rateLimitingEnabled (boolean)	true	true, false	Specifies, when enabled, that if traffic meets the detection conditions, the system applies rate limiting to the traffic
tpsIncreaseRate (integer)	500	[0, 4294967295]	The transactions per second increase (as a percentage) that must occur before a source can be considered an attacking entity. This condition and the minimum TPS condition must be met for a source to be considered an attacking entity.

DOS_Profile_Application_Heavy_URL¶

Heavy URLs are a small number of site URLs that might consume considerable server resources per request. Heavy URLs respond with low latency most of the time, but may easily reach high latency under specific conditions. Heavy URLs are not necessarily heavy all the time, but are potentially heavy, especially during DoS attacks. It only takes a low rate of requests to heavy URLs in order to cause DoS attacks. When an attack is suspected, the system protects the heavy URLs using the by URL methods that you enabled in TPS-based Detection and Behavioral & Stress-based Detection. If no URL-based methods are enabled there, the system only reports attacks.

Properties:

Name (Type)	Default	Values	Description
automaticDetectionEnabled (boolean)	true	true, false	Mark a URL as heavy if its portion of transactions with latency above the specified threshold is higher than usual for this site
detectionThreshold (integer)	1000	[16, 4294967295]	Specifies the latency threshold for automatic heavy URL detection (in milliseconds)
excludeList (array<string>)			URLs the system should not consider heavy even if the system automatically detects them as being heavy. This list may contain prefix wildcards.
protectList (array<DOS_Profile_Application_Heavy_URL_protectList>)			URLs you expect to be heavy even if the system does not automatically detect them as being heavy

DOS_Profile_Application_Heavy_URL_protectList¶

DOS_Profile_Application_Heavy_URL protectList possible properties when object type

Properties:

Name (Type)	Default	Values	Description
threshold (integer)		[0, 4294967295]	Threshold for detection in requests per second
url (string)			URL to protect

DOS_Profile_Application_Mobile_Defense¶

When enabled, requests from mobile applications built with the Anti-Bot Mobile SDK will be detected and handled according to the setting configured here. When disabled, these requests will be handled like any other request, meaning that they may let attacks in or cause false positives. Mobile application traffic will be treated differently than other clients, e.g. browsers, in security policies. For this reason, even when DoS protection is not required in a security policy, you still must set a DoS profile with mobile application protection enabled.

Properties:

Name (Type)	Default	Values	Description
allowAndroidPublishers (array<Pointer_SSL_Certificate>)			Publisher certificates to allow. All others are blocked. An empty list allows all publishers.
allowAndroidRootedDevice (boolean)	false	true, false	Select to allow traffic from rooted Android devices
allowEmulators (boolean)	false	true, false	Select to allow traffic from applications run on emulators
allowIosPackageNames (array<string>)			Package names to allow. All others are blocked. An empty list allows all package names.
allowJailbrokenDevices (boolean)	false	true, false	Select to allow traffic from jailbroken iOS devices
clientSideChallengeMode (string)	“pass”	“pass”, “challenge”	Specifies the action to take when a CAPTCHA or Client Side Integrity challenge needs to be presented
enabled (boolean)	false	true, false	When enabled, requests from mobile applications built with Anti-Bot Mobile SDK will be detected and handled according to the settings below. When disabled, these requests will be handled like any other request which may let attacks in, or cause false positives.

DOS_Profile_Application_Rate_Based_Detection¶

Configure the system to prevent DoS attacks based on the client side transactions per second (TPS-based detection mode). The system considers traffic to be a DoS attack based on the following calculations:

Transaction rate detection interval: The average number of requests per second sent. This is the TPS value that triggered the attack. This number is calculated by the system, by default, every ten seconds.
Transaction rate history interval: The average number of requests per second sent. This number is the average number of transactions for the past hour, and it is updated every 10 seconds.

In TPS-based detection mode, if the ratio of the transaction rate detection interval to the transaction rate history interval is greater than the specific percentage configured, the system detects the URL/site to be under attack, or the IP address/geolocation to be attacking. In order to stop the attack, the system blocks some, or all, requests from the detected IP address/geolocation and/to the attacked URL/site, depending on the configuration of the DoS profile.

Properties:

Name (Type)	Default	Values	Description
deEscalationPeriod (integer)	7200	[0, 86400]	When preventing a DoS attack, specifies the time spent since the mitigation started until retrying the steps from the beginning of the enabled methods. If the value is 0, no de-escalation occurs.
deviceID (DOS_Profile_Application_Detection_Device)	{}
escalationPeriod (integer)	120	[1, 3600]	Specifies the minimum time spent in each mitigation step before the system moves to the next mitigation step when preventing a DoS attack. After the system detects a DoS attack, it performs attack prevention for the amount of time specified here for every method that is enabled. If after this period the attack has not been fully stopped, the system escalates to the next enabled prevention step.
geolocation (DOS_Profile_Application_Detection_Geolocation)	{}
operationMode (string)	“off”	“off”, “transparent”, “blocking”	Specifies how the system reacts when it detects an attack
site (DOS_Profile_Application_Detection_Site)	{}
sourceIP (DOS_Profile_Application_Detection_IP)	{}
thresholdsMode (string)	“manual”	“manual”, “automatic”	Specifies what type of thresholds to use
url (DOS_Profile_Application_Detection_URL)	{}

DOS_Profile_Application_Stress_Based_Detection¶

Configure the system to prevent DoS attacks based on the server’s health condition. An attack is detected if the system finds the server to be under stress and either of the TPS thresholds are crossed.

Properties:

Name (Type)	Default	Values	Description
badActor (DOS_Profile_Application_Stress_Based_Detection_Bad_Actor)	{}
deEscalationPeriod (integer)	7200	[0, 86400]	When preventing a DoS attack, specifies the time spent since the mitigation started until retrying the steps from the beginning of the enabled methods. If the value is 0, no de-escalation occurs.
deviceID (DOS_Profile_Application_Detection_Device)	{}
escalationPeriod (integer)	120	[1, 3600]	Specifies the minimum time spent in each mitigation step before the system moves to the next mitigation step when preventing a DoS attack. After the system detects a DoS attack, it performs attack prevention for the amount of time specified here for every method that is enabled. If after this period the attack has not been fully stopped, the system escalates to the next enabled prevention step.
geolocation (DOS_Profile_Application_Detection_Geolocation)	{}
operationMode (string)	“off”	“off”, “transparent”, “blocking”	Specifies how the system reacts when it detects an attack
site (DOS_Profile_Application_Detection_Site)	{}
sourceIP (DOS_Profile_Application_Detection_IP)	{}
thresholdsMode (string)	“manual”	“manual”, “automatic”	Specifies what type of thresholds to use
url (DOS_Profile_Application_Detection_URL)	{}

DOS_Profile_Application_Stress_Based_Detection_Bad_Actor¶

Specifies properties of Behavioral Detection in Stress-based anomaly.

The following mitigation options are available:

Conservative protection: If detectionEnabled is true, slows down and rate limits requests from anomalous IP addresses based on its anomaly detection confidence and the server’s health. If signatureDetectionEnabled is true, blocks requests that match the attack signatures.
Standard protection: If detectionEnabled is true, slows down requests from anomalous IP addresses based on its anomaly detection confidence and the server’s health. Rate limits requests from anomalous IP addresses and, if necessary, rate limits all requests based on the server’s health. Limits the number of concurrent connections from anomalous IP addresses and, if necessary, limits the number of all concurrent connections based on the server’s health. If signatureDetectionEnabled is true, blocks requests that match the attack signatures.
Aggressive protection: If detectionEnabled is true, slows down requests from anomalous IP addresses based on its anomaly detection confidence and the server’s health. Rate limits requests from anomalous IP addresses and, if necessary, rate limits all requests based on the server’s health. Limits the number of concurrent connections from anomalous IP addresses and, if necessary, limits the number of all concurrent connections based on the server’s health. Proactively performs all protection actions (even before an attack). Increases the impact of the protection techniques. If signatureDetectionEnabled is true, blocks requests that match the attack signatures. Increases the impact of blocked requests.

Properties:

Name (Type)	Default	Values	Description
acceleratedSignaturesEnabled (boolean)	false	true, false	Enables signature detection before the connection establishment
detectionEnabled (boolean)	false	true, false	Enables traffic behavior, server’s capacity learning, and anomaly detection
mitigationMode (string)	“none”	“none”, “conservative”, “standard”, “aggressive”	Specifies mitigation impact on suspicious bad actors/requests
signatureDetectionEnabled (boolean)	false	true, false	Enables request signature detection
tlsSignaturesEnabled (boolean)	false	true, false	Enables tls signature detection before the connection establishment. This property is available on BIGIP 14.1 and above.
useApprovedSignaturesOnly (boolean)	false	true, false	Limits request signature detection to approved signatures only

DOS_Profile_Application_TCP_Dump¶

Configure settings to record traffic (perform a TCP dump) when a DoS attack is underway, in order to diagnose the attack vectors and attackers, observe whether and how it was mitigated, and draw conclusions for changing the DoS profile configuration.

Properties:

Name (Type)	Default	Values	Description
maximumDuration (integer)	30	[0, 4294967295]	Configures the maximum time for each TCP dump recording cycle
maximumSize (integer)	10	[0, 4294967295]	Configures the maximum size (in MB) for each TCP dump recording cycle
recordTrafficEnabled (boolean)	false	true, false	Enables the recording of traffic during attacks
repetitionInterval (string \| integer)	120		Allow multiple TCP dumps to be recorded during a single DoS attack

DOS_Profile_Network¶

No description provided

Properties:

Name (Type)	Default	Values	Description
dynamicSignatures (DOS_Profile_Network_Dynamic_Signatures)	{}
vectors (array<DOS_Network_Vector>)			A list of configured network DoS vectors

DOS_Profile_Network_Dynamic_Signatures¶

No description provided

Properties:

Name (Type)	Default	Values	Description
detectionMode (string)	“disabled”	“disabled”, “learn-only”, “enabled”	Select the enforcement state for dynamic signatures. To enable enforcement of dynamic DoS vectors, select enabled. When enforcement is enabled, all thresholds and threshold actions are applied. Select disabled to apply no action or thresholds to dynamic Vectors. Select learn-only to track dynamic vector statistics, without enforcing any thresholds or limits.
mitigationMode (string)	“none”	“none”, “low”, “medium”, “high”	Specify the mitigation sensitivity for dynamic signatures
scrubbingCategory (Pointer_Denylist_Category)			Specifies the IP intelligence denylist category to which scrubbed IPs are sent
scrubbingDuration (integer)	500	[60, 4294967295]	Specify the duration in seconds for which an IP address is added to the denylist category
scrubbingEnabled (boolean)	false	true, false	Specify whether to enable redirection and scrubbing of IP addresses identified by dynamic vectors. This enables handling of the dynamic vector hits by an IP intelligence category.

DOS_Profile_Protocol_DNS¶

No description provided

Properties:

Name (Type)	Default	Values	Description
vectors (array<DOS_DNS_Vector>)			A list of configured DNS DoS vectors

DOS_Profile_Protocol_SIP¶

No description provided

Properties:

Name (Type)	Default	Values	Description
vectors (array<DOS_SIP_Vector>)			A list of configured SIP DoS vectors

DOS_SIP_Vector¶

Protocol SIP Denial-of-Service (DoS) vector

Properties:

Name (Type)	Default	Values	Description
autoAttackCeiling (integer)	4294967295	[0, 4294967295]	Specifies the absolute maximum allowable for packets of this type. This setting rate limits packets to the packets per second setting, when specified. To set no hard limit and allow automatic thresholds to manage all rate limiting, set this to 4294967295.
autoAttackFloor (integer)	100	[0, 4294967295]	Specifies packets per second to identify an attack. These settings provide an absolute minimum of packets to allow before the attack is identified. As the automatic detection thresholds adjust to traffic and CPU usage on the system over time, this attack floor becomes less relevant.
autoBlacklistSettings (DOS_Auto_Denylist_Settings)	{}		Deprecated. Replaced with functionally equivalent autoDenylistSettings.
autoDenylistSettings (DOS_Auto_Denylist_Settings)
badActorSettings (DOS_Bad_Actor_Detection_Settings)	{}
rateIncreaseThreshold (integer)	500	[0, 4294967295]	Specify percent of rate increase the system must discover in traffic in order to detect this attack
rateLimit (integer)	4294967295	[0, 4294967295]	Specify the maximum number of this type of packet per second the system allows for a vector. The system drops packets once the traffic level exceeds the rate limit.
rateThreshold (integer)	4294967295	[0, 4294967295]	Specify how many packets per second the system must discover in traffic in order to detect this attack
simulateAutoThresholdEnabled (boolean)	false	true, false	Specifies that results of the current automatic thresholds are logged, though manual thresholds are enforced, and no action is taken on automatic thresholds
state (string)	“mitigate”	“disabled”, “learn-only”, “detect-only”, “mitigate”	Specifies how to enforce protection for that attack type: mitigate (watch, learn, alert, and mitigate), detect-only (watch, learn, and alert), learn-only (collect stats, no mitigation), or Disabled (no stat collection, no mitigation).
thresholdMode (string)	“manual”	“manual”, “stress-based-mitigation”, “fully-automatic”	Specifies how thresholds are set for this vector
type (string)		“ack”, “cancel”, “message”, “options”, “prack”, “register”, “bye”, “invite”, “notify”, “other”, “publish”, “subscribe”, “uri-limit”, “malformed”	Specifies the name of the DoS attack vector whose thresholds you are configuring

Endpoint_Policy¶

Policy to manage connections based on metadata and content

Properties:

Name (Type)	Default	Values	Description
class (string)		“Endpoint_Policy”
customStrategy (string \| Endpoint_Policy_customStrategy)		-, -	BIG-IP AS3 pointer to custom strategy declaration
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
rules (array<Endpoint_Policy_Rule>)			List of policy rules, order is significant
strategy (string)	“best-match”	“all-match”, “best-match”, “first-match”, “custom”	Rule-matching strategy; value ‘custom’ means BIG-IP AS3 requires a custom strategy (default is best-match)

Endpoint_Policy_customStrategy¶

Endpoint_Policy customStrategy possible properties

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP LTM strategy

Endpoint_Policy_Rule¶

A rule for an Endpoint policy that describes actions to perform on traffic matching given conditions

Properties:

Name (Type)	Values	Description
actions (array<Policy_Action>)		Specifies the actions for the rule to execute
conditions (array<Policy_Condition>)		Specifies the conditions for the rule to apply
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
name (string)	regex: ^[a-zA-Z0-9_-.:%]+$	Name of the endpoint policy rule
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Endpoint_Strategy¶

Strategy for evaluation of an Endpoint policy

Properties:

Name (Type)	Values	Description
class (string)	“Endpoint_Strategy”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
matchMethod (string)	“all-match”, “best-match”, “first-match”	Specifies the match method
operands (array<string>)		Specifies the attribute for the rule to match. Sometimes this represents a specific value (for example, http-method or http-status), but frequently the operand needs a specific Selector to identify an instance (for example, http-header needs a Selectorname parameter).
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Enforcement_Diameter_Endpoint_Profile¶

Create a listener to specify how to handle traffic for policy enforcement

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_Diameter_Endpoint_Profile”
destinationHost (string)			Specifies the destination host name of the PCRF or external policy server, for example, pcrfdest.net.com
destinationRealm (string)			Specifies the realm name or network of the PCRF, for example, net.com
fatalGraceTime (integer)	500	[0, infinity]	Specifies the time period in seconds that a diameter (PCRF) connection can be disconnected before the system clears all subscriber session information associated with that diameter endpoint. If the connection is re-established within the fatal grace time period, session information is not cleared. A value of 0 means if the PCRF is disconnected, session information is cleared immediately.
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
messageMaxRetransmits (integer)	2	[0, infinity]	Specifies the maximum number of times that messages can be retransmitted from the BIG-IP system to the PCRF
messageRetransmitDelay (integer)	1500	[0, infinity]	Specifies the number of milliseconds to wait before retransmitting unanswered messages in case of failure from the BIG-IP system to the PCRF over the Gx interface
originHost (string)			Specifies the host name of the PCRF or external policy server, for example, pcrf.xnet.com
originRealm (string)			Specifies the realm name or network in which the PCRF resides, for example, xnet.com
parentProfile (Pointer_Enforcement_Diameter_Endpoint_Profile)	{“bigip”:”/Common/diameter-endpoint”}		Specifies the name of the object to inherit the settings from
productName (string)	“BIG-IP”		Specifies the value of the string used in the product name attribute value pair (AVP), in capabilities exchange message in the diameter when communicating with the PCRF
protocolProfileGx (Pointer_Enforcement_Profile_Gx)			Specifies the protocol profile to be used when you enable subscriber discovery. The PEM protocol profile defines mapping of Diameter Gx AVPs to subscriber ID and other PEM subscriber session attributes. The default BIG-IP reference values vary between versions. BIGIP versions 14.1 and above begin with ‘sys_diam’ (e.g. _sys_diam_proto_default).
supportedApps (array<string>)		“Gx”, “Gy”, “Sd”	Specifies the diameter endpoint you would like to provision. You can select Gx, Gy or SD. Gx and SD are mutually exclusive.

Enforcement_Format_Script¶

Specifies a script using TCL syntax that defines a custom format for HSL reporting applied in an enforcement policy rule. The format and fields available differ depending on whether you are using session-based or flow-based reporting in the rule.

Properties:

Name (Type)	Values	Description
class (string)	“Enforcement_Format_Script”
definition (string)		TCL script text
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Enforcement_Forwarding_Endpoint¶

Configures an forwarding endpoint to specify PEM policy forwarding actions

Properties:

Name (Type)	Default	Values	Description
addressTranslationEnabled (boolean)	false	true, false	Specifies, when enabled, the system translates the original destination address of the virtual server. When disabled, specifies the system uses the address without translation.
class (string)		“Enforcement_Forwarding_Endpoint”
defaultPersistenceType (string)	“disabled”	“destination-ip”, “disabled”, “hash”, “source-ip”	Specifies a persistence method for the pool member selection. If you have multiple pool members and want specific traffic to go to the same pool member, select the appropriate IP address type.
fallbackPersistenceType (string)	“disabled”	“destination-ip”, “disabled”, “source-ip”	Specifies the fallback persistence method that is applied when default persistence fails. If you have multiple pool members and want specific traffic to go to the same pool member, select the appropriate IP address type.
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
persistenceHashSettings (Enforcement_Forwarding_Endpoint_Hash_Settings)	{}
pool (Pointer_Pool)
portTranslationEnabled (boolean)	false	true, false	Specifies, when enabled, the system translates the original destination port. When disabled, specifies the system uses the original destination port without translation.
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
SNATPool (Pointer_SNAT_Pool)
sourcePortAction (string)	“preserve”	“change”, “preserve”, “preserve-strict”	Specifies whether the system preserves the source port of the connection

Enforcement_Forwarding_Endpoint_Hash_Settings¶

Specifies the settings for the hash persistence method

Properties:

Name (Type)	Default	Values	Description
length (integer)	1024	[0, 4294967295]	Specifies the length of the source string used to calculate the hash value
offset (integer)	0	[0, 4294967295]	Specifies the offset, in bytes, from start of the source string to calculate the hash value
tclScript (string)			The results from this TCL script are used to calculate the hash value. If no script is specified, the URI is used instead.

Enforcement_Interception_Endpoint¶

Configures an interception endpoint to clone all traffic

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_Interception_Endpoint”
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
persistence (string)	“disabled”	“destination-ip”, “source-ip”, “disabled”	Specifies the persistence that is based on either the source or destination IP addresses only
pool (Pointer_Pool)

Enforcement_iRule¶

Specifies or configures an iRule for use in Enforcement Policies

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_iRule”
expand (boolean)	true	true, false	If true (default), expand backquoted variables in iRule
iRule (IRule_Core)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Enforcement_Listener¶

Configures an enforcement data plane listener

Properties:

Name (Type)	Values	Description
class (string)	“Enforcement_Listener”
enforcementProfile (Pointer_Enforcement_Profile)
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
services (array<Pointer_Service>)		A set of virtual servers
subscriberManagementProfile (Pointer_Enforcement_Subscriber_Management_Profile)

Enforcement_Policy¶

Configures policies for the Policy Enforcement Manager (PEM)

Properties:

Name (Type)	Default	Values	Description
allTransactions (boolean)	false	true, false	Specifies, when set to true, that the system enables policy enforcement for each http transaction. When set to false, the system allows only policy enforcement of the first http transaction.
class (string)		“Enforcement_Policy”
enable (boolean)	true	true, false	Specifies the current status of the policy
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
rules (array<Enforcement_Rule>)			Enforcement policy rules

Enforcement_Profile¶

Configures a subscriber policy manager profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_Profile”
connectionOptimizationEnabled (boolean)	true	true, false	Specifies whether connection optimization is enabled or not
connectionOptimizationService (Pointer_Service)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
parentProfile (Pointer_Enforcement_Profile)	{“bigip”:”/Common/spm”}		Specifies the name of the object to inherit the settings from
policiesGlobalHighPrecedence (array<Pointer_Enforcement_Policy>)			Adds, deletes, or replaces a set of the policies
policiesGlobalLowPrecedence (array<Pointer_Enforcement_Policy>)			Adds, deletes, or replaces a set of the policies
policiesUnknownSubscribers (array<Pointer_Enforcement_Policy>)			Adds, deletes, or replaces a set of the policies
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Enforcement_Radius_AAA_Profile¶

Configures a radius AAA profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_Radius_AAA_Profile”
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
parentProfile (Pointer_Enforcement_Radius_AAA_Profile)	{“bigip”:”/Common/radiusaaa”}		Specifies the name of the object to inherit the settings from
password (Enforcement_Radius_AAA_Profile_password)			The password of the RADIUS AAA profile for RADIUS server authentication
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
retransmissionTimeout (integer)	5	[0, 60]	The number of seconds to wait before resending authentication or accounting transaction messages to the RADIUS server
sharedSecret (Enforcement_Radius_AAA_Profile_sharedSecret)			Specifies the shared secret of the RADIUS server used for authentication or accounting
transactionTimeout (integer)	30	[5, 300]	The number of seconds to wait before resending authentication or accounting transaction messages to the RADIUS server

Enforcement_Radius_AAA_Profile_password¶

Enforcement_Radius_AAA_Profile password possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

Enforcement_Radius_AAA_Profile_sharedSecret¶

Enforcement_Radius_AAA_Profile sharedSecret possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

Enforcement_Rule¶

A rule to match traffic flows and apply actions

Properties:

Name (Type)	Default	Values	Description
classificationFilters (array<Enforcement_Rule_Classification_Filter>)			Classification filters to apply to the traffic
dscpMarkingDownlink (string \| integer)	“pass-through”	“pass-through”, [0, 63]	Specifies whether to set DSCP bits in the IP header of outgoing traffic to the subscriber
dscpMarkingUplink (string \| integer)	“pass-through”	“pass-through”, [0, 63]	Specifies whether to set DSCP bits in the IP header of outgoing traffic to the network
DTOSTethering (Enforcement_Rule_DTOS_Tethering)	{}
flowInfoFilters (array<Enforcement_Rule_Flow_Filter>)			Flow information filters to apply to the traffic
forwarding (Enforcement_Rule_Forwarding)
gateStatusEnabled (boolean)	true	true, false	Specifies, when set to true, that the traffic can pass through the system without being changed. Select false to drop traffic that this rule applies to.
insertContent (Enforcement_Rule_Insert_Content)
interceptionEndpoint (Pointer_Enforcement_Interception_Endpoint)
iRule (Pointer_Enforcement_iRule)
l2MarkingDownlink (string \| integer)	“pass-through”	“pass-through”, [0, 7]	Set Layer-2 Quality of Service Marking in downlink traffic that matches a rule. Setting a L2 QoS Marking affects the packet delivery priority. The range is 0 to 7, or pass-through. The default value is pass-through, indicating the L2 QoS Marking of the packet will not be changed when the packet matches the rule.
l2MarkingUplink (string \| integer)	“pass-through”	“pass-through”, [0, 7]	Set Layer-2 Quality of Service Marking in uplink traffic that matches a rule. Setting a L2 QoS marking affects the packet delivery priority. The range is 0 to 7, or pass-through. The default value is pass-through, indicating the L2 QoS Marking of the packet will not be changed when the packet matches the rule.
modifyHttpHeader (Enforcement_Rule_Modify_HTTP_Header)
name (string)			The name of the policy rule.
precedence (integer)		[1, 4294967295]	Specifies an integer that indicates the precedence for the rule in relation to the other rules. Number 1 has the highest precedence. Rules with higher precedence (lower numbers) are evaluated before other rules with lower precedence (higher numbers).
qoeReporting (Enforcement_Rule_Report_Destination_HSL)
qosBandwidthControllerDownlink (Enforcement_Rule_QOS)
qosBandwidthControllerUplink (Enforcement_Rule_QOS)
quota (Enforcement_Rule_Quota)
ranCongestion (Enforcement_Rule_Ran_Congestion)
serviceChain (Pointer_Enforcement_Service_Chain_Endpoint)
tclFilter (string)			Specifies the tcl expression which uses iRule commands to filter the packet. It is a match if tclFilter returns TRUE/1 or nomatch if FALSE/0.
tcpAnalyticsEnabled (boolean)	false	true, false	Specifies the action to enable tcp analytics when the traffic flow matches the rule matching criteria
tcpOptimizationDownlink (Pointer_TCP_Profile)
tcpOptimizationUplink (Pointer_TCP_Profile)
urlCategorizationFilters (array<Enforcement_Rule_URL_Categorization_Filter>)			URL categorization filters to apply to the traffic
usageReporting (Enforcement_Rule_Usage_Reporting)

Enforcement_Rule_Classification_Filter¶

Defines the category or application (Layer 7) conditions that the traffic must meet (or not meet) for this enforcement policy rule to apply

Properties:

Name (Type)	Default	Values	Description
application (Pointer_Classification_Application)
category (Pointer_Classification_Category)
invertMatch (boolean)	false	true, false	Specifies that a traffic flow should not match the condition
name (string)			The name of the classification filter.

Enforcement_Rule_DTOS_Tethering¶

Specifies options for device type, operating system, and tethering detection

Properties:

Name (Type)	Default	Values	Description
detectDtos (boolean)	false	true, false	Specifies the detection of the subscriber’s device and the operating system
detectTethering (boolean)	false	true, false	Specifies if you want to enable detection of tethering
reportDestinationHsl (Enforcement_Rule_Report_Destination_HSL)

Enforcement_Rule_Flow_Filter¶

Defines the flow conditions (Layer 4) that the traffic must meet (or not meet) for this enforcement policy rule to apply

Properties:

Name (Type)	Default	Values	Description
destinationAddress (string)	“0.0.0.0/0”		Matches traffic going to a destination address or network
destinationPort (integer)	0	[0, 65535]	Matches traffic headed to a destination port
dscpMarking (integer \| string)	“disabled”		Matches incoming traffic based on a value in the DSCP field in the IP header
invertMatch (boolean)	false	true, false	Specifies that a traffic flow should not match the condition
ipAddressType (string)	“any”	“any”, “ipv4”, “ipv6”	Specifies the IP address type that this rule applies to
name (string)			The name of the flow filter.
protocol (string)	“any”	“any”, “tcp”, “udp”	Specifies the protocol of the traffic to which the rule applies
sourceAddress (string)	“0.0.0.0/32”		Matches traffic coming from a source address or network
sourcePort (integer)	0	[0, 65535]	Matches traffic coming from a source port
sourceVlan (Pointer_VLAN)			Matches incoming traffic from a VLAN

Enforcement_Rule_Forwarding¶

Manages the forwarding action and its attributes

Properties:

Name (Type)	Default	Values	Description
endpoint (Pointer_Enforcement_Forwarding_Endpoint)
fallbackAction (string)	“drop”	“continue”, “drop”	Specifies if the connection can remain unchanged or should be dropped if the forwarding action fails for any reason
icapService (Pointer_Service)			ICAP service to route to
icapType (string)		“request”, “response”, “both”	Specifies the ICAP adaptation type
redirectUrl (string)			Specifies that traffic affected by this rule should be redirected to the specified URL
type (string)		“icap”, “endpoint”, “route-to-network”, “http”	Specifies the type of forwarding action

Enforcement_Rule_Forwarding_Endpoint¶

Specifies that the flow steers to a different destination

Properties:

Name (Type)	Default	Values	Description
endpoint (Pointer_Enforcement_Forwarding_Endpoint)

Enforcement_Rule_Forwarding_HTTP¶

Specifies that traffic affected by this rule should be redirected to the specified URL

Properties:

Name (Type)	Default	Values	Description
redirectUrl (string)			Specifies that traffic affected by this rule should be redirected to the specified URL

Enforcement_Rule_Forwarding_ICAP¶

Specifies that the flow forwards to the ICAP virtual server

Properties:

Name (Type)	Default	Values	Description
icapService (Pointer_Service)			ICAP service to route to
icapType (string)		“request”, “response”, “both”	Specifies the ICAP adaptation type

Enforcement_Rule_Forwarding_Route_To_Network¶

Specifies that the system forwards the flow to the default destination

No properties

Enforcement_Rule_Insert_Content¶

Specifies the action to insert content into the webpage

Properties:

Name (Type)	Default	Values	Description
duration (integer)		[1, 4294967295]	Specifies the periodicity of the insert action in seconds
frequency (string)	“always”	“always”, “once”, “once-every”	Specifies the number of content insertion actions per transaction
position (string)	“append”	“append”, “prepend”	Specifies position with respect to the configured tagName
tagName (string)			Specifies the tag name to which the content is either appended or prepended
valueContent (string)			Specifies the value content to be inserted into the webpage
valueType (string)	“string”	“string”, “tcl-snippet”	Specifies the type of content format used in the valueContent option

Enforcement_Rule_Modify_HTTP_Header¶

Specifies the action to modify the HTTP header when the traffic flow matches the rule matching criteria

Properties:

Name (Type)	Default	Values	Description
headerName (string)			Specifies the HTTP header name used by the operation option to modify the HTTP header
operation (string)		“insert”, “remove”	Specifies the operation used to modify the HTTP header
valueContent (string)			Specifies the HTTP header value content used by the insert operation to modify the HTTP header
valueType (string)	“string”	“string”, “tcl-snippet”	Specifies the type of content format used in the valueContent option

Enforcement_Rule_QOS¶

Specifies a previously configured bandwidth control policy to apply to traffic that matches this rule

Properties:

Name (Type)	Default	Values	Description
category (string)			Specifies a category of traffic within the bandwidth control policy to which to apply the rule. This option provides more specific rate control to a certain type of traffic. The category must be defined in the selected bandwidth control policy.
policy (Pointer_Bandwidth_Control_Policy)

Enforcement_Rule_Quota¶

Specify quota management options

Properties:

Name (Type)	Default	Values	Description
ratingGroup (Pointer_Enforcement_Rating_Group)
reportingLevel (string)	“rating-group”	“rating-group”, “service-id”	Specifies the quota reporting level

Enforcement_Rule_Ran_Congestion¶

Detect congestion in the Radio Access Network

Properties:

Name (Type)	Default	Values	Description
reportDestinationHsl (Enforcement_Rule_Report_Destination_HSL)
threshold (integer)	1000	[0, 2147483647]	Specifies lower threshold bandwidth (in kbps) for a session to be marked as congested

Enforcement_Rule_Report_Destination_HSL¶

Specifies report destination and format

Properties:

Name (Type)	Default	Values	Description
formatScript (Pointer_Enforcement_Format_Script)
highSpeedLogPublisher (Pointer_Log_Publisher)

Enforcement_Rule_URL_Categorization_Filter¶

Defines the category of URL, which provides information about the content type requested by the subscriber

Properties:

Name (Type)	Default	Values	Description
category (Pointer_Classification_Category)			Specifies which type of URL category you want the rule to affect
invertMatch (boolean)	false	true, false	Specifies that a traffic flow should not match the condition
name (string)			The name of the URL categorization filter.

Enforcement_Rule_Usage_Gx¶

Sends usage monitoring data to a PCRF over a Gx interface

Properties:

Name (Type)	Default	Values	Description
applicationReportingEnabled (boolean)	false	true, false	Report APPLICATION_START and APPLICATION_END Event-Triggers when the application start/stop is detected
monitoringKey (string)			Specifies a string to use for usage monitoring indicating the portion of traffic that is accounted for in this dynamic policy and charging control (PCC) rule

Enforcement_Rule_Usage_Hsl¶

Sends reporting data to remote HSL servers

Properties:

Name (Type)	Values	Description
flowReportingFields (array<string>)	“application-id”, “destination-ip”, “destination-transport-port”, “downlink-volume”, “flow-end-milli-seconds”, “flow-end-seconds”, “flow-start-milli-seconds”, “flow-start-seconds”, “observation-time-seconds”, “protocol-identifier”, “record-type”, “report-id”, “report-version”, “route-domain”, “source-ip”, “source-transport-port”, “subscriber-id”, “subscriber-id-type”, “timestamp-msec”, “total-transactions”, “uplink-volume”, “url-category-id”, “vlan-id”	Specifies the flow fields and their order based on which messages should be published
formatScript (Pointer_Enforcement_Format_Script)
publisher (Pointer_Log_Publisher)
sessionReportingFields (array<string>)	“3gpp-parameters”, “application-id”, “called-station-id”, “calling-station-id”, “concurrent-flows”, “downlink-volume”, “duration-seconds”, “last-record-sent”, “new-flows”, “observation-time-seconds”, “record-reason”, “record-type”, “report-id”, “report-version”, “subscriber-id”, “subscriber-id-type”, “successful-transactions”, “terminated-flows”, “timestamp-msec”, “total-transactions”, “uplink-volume”	Specifies the session fields and their order based on which messages should be published
transactionReportingFields (array<string>)	“application-id”, “destination-ip”, “destination-transport-port”, “downlink-volume”, “http-hostname”, “http-hostname-truncated”, “http-response-code”, “http-url”, “http-url-truncated”, “http-user-agent”, “http-user-agent-truncated”, “protocol-identifier”, “record-type”, “report-id”, “report-version”, “route-domain”, “skipped-transactions”, “source-ip”, “source-transport-port”, “subscriber-id”, “subscriber-id-type”, “transaction-classification-result”, “transaction-end-milli-seconds”, “transaction-end-seconds”, “transaction-number”, “transaction-start-milli-seconds”, “transaction-start-seconds”, “uplink-volume”, “url-category-id”, “vlan-id”	Specifies the transaction fields and their order based on which messages should be published

Enforcement_Rule_Usage_Radius¶

Specifies a RADIUS internal virtual server as a reporting destination

Properties:

Name (Type)	Default	Values	Description
radiusAAAService (Pointer_Service)

Enforcement_Rule_Usage_Reporting¶

Send reporting data concerning traffic affected by this rule to either an external analytics system or to a PCRF over a Gx interface

Properties:

Name (Type)	Default	Values	Description
applicationReportingEnabled (boolean)	false	true, false	Report APPLICATION_START and APPLICATION_END Event-Triggers when the application start/stop is detected
destination (string)		“gx”, “sd”, “hsl”, “radius-accounting”	Specifies where to send the usage monitoring data
flowReportingFields (array<string>)		“application-id”, “destination-ip”, “destination-transport-port”, “downlink-volume”, “flow-end-milli-seconds”, “flow-end-seconds”, “flow-start-milli-seconds”, “flow-start-seconds”, “observation-time-seconds”, “protocol-identifier”, “record-type”, “report-id”, “report-version”, “route-domain”, “source-ip”, “source-transport-port”, “subscriber-id”, “subscriber-id-type”, “timestamp-msec”, “total-transactions”, “uplink-volume”, “url-category-id”, “vlan-id”	Specifies the flow fields and their order based on which messages should be published
formatScript (Pointer_Enforcement_Format_Script)
granularity (string)	“session”	“flow”, “session”, “transaction”	Specifies the type of reporting that will be generated when the policy applies
interval (integer)	0	[0, infinity]	Specifies the time interval when the report will be generated, in seconds. A value of 0 indicates this feature is disabled.
monitoringKey (string)			Specifies a string to use for usage monitoring indicating the portion of traffic that is accounted for in this dynamic policy and charging control (PCC) rule
publisher (Pointer_Log_Publisher)
radiusAAAService (Pointer_Service)
sessionReportingFields (array<string>)		“3gpp-parameters”, “application-id”, “called-station-id”, “calling-station-id”, “concurrent-flows”, “downlink-volume”, “duration-seconds”, “last-record-sent”, “new-flows”, “observation-time-seconds”, “record-reason”, “record-type”, “report-id”, “report-version”, “subscriber-id”, “subscriber-id-type”, “successful-transactions”, “terminated-flows”, “timestamp-msec”, “total-transactions”, “uplink-volume”	Specifies the session fields and their order based on which messages should be published
transaction (Enforcement_Rule_Usage_Reporting_Transaction)
transactionReportingFields (array<string>)		“application-id”, “destination-ip”, “destination-transport-port”, “downlink-volume”, “http-hostname”, “http-hostname-truncated”, “http-response-code”, “http-url”, “http-url-truncated”, “http-user-agent”, “http-user-agent-truncated”, “protocol-identifier”, “record-type”, “report-id”, “report-version”, “route-domain”, “skipped-transactions”, “source-ip”, “source-transport-port”, “subscriber-id”, “subscriber-id-type”, “transaction-classification-result”, “transaction-end-milli-seconds”, “transaction-end-seconds”, “transaction-number”, “transaction-start-milli-seconds”, “transaction-start-seconds”, “uplink-volume”, “url-category-id”, “vlan-id”	Specifies the transaction fields and their order based on which messages should be published
volume (Enforcement_Rule_Usage_Reporting_Volume)

Enforcement_Rule_Usage_Reporting_Transaction¶

Specifies policy enforcement configuration on transaction report for each HTTP transaction

Properties:

Name (Type)	Default	Values	Description
hostname (integer)	0	[0, 65535]	Specifies the maximum HTTP hostname string length option to include in the HTTP transaction report
uri (integer)	256	[0, 65535]	Specifies the maximum HTTP URI string length option to include in the HTTP transaction report
userAgent (integer)	0	[0, 65535]	Specifies the maximum HTTP user agent string length to include in the HTTP transaction report

Enforcement_Rule_Usage_Reporting_Volume¶

Configures volume threshold settings

Properties:

Name (Type)	Values	Description
downlink (integer)	[0, infinity]	Send reporting data if the number of octets to the client exceeds the threshold. A value of 0 indicates this feature is disabled.
total (integer)	[0, infinity]	Send reporting data if the total number of octets both to and from the client exceeds the threshold. A value of 0 indicates this feature is disabled.
uplink (integer)	[0, infinity]	Send reporting data if the number of octets from the client exceeds the threshold. A value of 0 indicates this feature is disabled.

Enforcement_Rule_Usage_Sd¶

Sends usage monitoring data to a PCRF over a Sd interface

Properties:

Name (Type)	Default	Values	Description
applicationReportingEnabled (boolean)	false	true, false	Report APPLICATION_START and APPLICATION_END Event-Triggers when the application start/stop is detected
monitoringKey (string)			Specifies a string to use for usage monitoring indicating the portion of traffic that is accounted for in this dynamic policy and charging control (PCC) rule

Enforcement_Service_Chain_Endpoint¶

Configures service chain endpoint definitions for the Policy Enforcement Manager (PEM)

Properties:

Name (Type)	Values	Description
class (string)	“Enforcement_Service_Chain_Endpoint”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
serviceEndpoints (array<Enforcement_Service_Chain_Endpoint_Service_Endpoint>)		Specifies a list of forwarding endpoints that define where to send traffic on the way to its final destination. This way, the system can route traffic to other servers that can provide value-added services. Traffic goes to the endpoints in the order in which they are listed.

Enforcement_Service_Chain_Endpoint_Service_Endpoint¶

Configures an individual service chain endpoint

Properties:

Name (Type)	Default	Values	Description
forwardingEndpoint (Pointer_Enforcement_Forwarding_Endpoint)
internalService (Pointer_Service)			Specifies the internal ICAP virtual server
internalServiceICAPType (string)		“request”, “response”, “both”, “none”	Specifies the ICAP adaptation type. Select “request” to send only HTTP requests to ICAP server. Select “response” to send only HTTP responses to ICAP server. Select “both” to have both requests and responses.
name (string)			Specify the name of the service endpoint where the traffic is going to
serviceOption (string)	“mandatory”	“mandatory”, “optional”	Specifies the service option in case the service endpoint is not accessible through the network, for forwarding endpoint. For ICAP service endpoint, the service endpoint works as a fallback action for non-HTTP traffic. Select “optional” if you want to skip the service endpoint. Select “mandatory” if you want all traffic flows dropped.
sourceVLAN (Pointer_VLAN)
steeringPolicy (Pointer_Enforcement_Policy)

Enforcement_Subscriber_Management_Profile¶

Configures a subscriber management profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“Enforcement_Subscriber_Management_Profile”
dhcpLeaseQuery (Enforcement_Subscriber_Management_Profile_DHCP)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
parentProfile (Pointer_Enforcement_Subscriber_Management_Profile)	{“bigip”:”/Common/subscriber-mgmt”}		Specifies the name of the object to inherit the settings from
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
serverSideSessionsEnabled (boolean)	true	true, false	Specifies the session is created based on server side IP when the server side traffic comes and is enabled

Enforcement_Subscriber_Management_Profile_DHCP¶

Configures DHCP lease query settings for a subscriber management profile

Properties:

Name (Type)	Default	Values	Description
enabled (boolean)	true	true, false	Specifies the subscriber management settings use DHCP lease query to communicate with DHCP servers to obtain DHCP lease information for the unknown IP address and creates a new policy enforcement session using the lease information received
service (Pointer_Service)

Enum_Continent_Code_Alpha_2¶

Enum values for Alpha-2 continent codes based on ISO 3166. Use two dashes (–) if Unknown

Type string with possible values: “–”, “AF”, “AN”, “AS”, “EU”, “NA”, “OC”, “SA”

Enum_Country_Analytics¶

Enum values for Analytics_Profile

Type string with possible values: “Afghanistan”, “Aland Islands”, “Albania”, “Algeria”, “American Samoa”, “Andorra”, “Angola”, “Anguilla”, “Anonymous Proxy”, “Antarctica”, “Antigua and Barbuda”, “Argentina”, “Armenia”, “Aruba”, “Asia/Pacific Region”, “Australia”, “Austria”, “Azerbaijan”, “Bahamas”, “Bahrain”, “Bangladesh”, “Barbados”, “Belarus”, “Belgium”, “Belize”, “Benin”, “Bermuda”, “Bhutan”, “Bolivia”, “Bonaire, Saint Eustatius and Saba”, “Bosnia and Herzegovina”, “Botswana”, “Bouvet Island”, “Brazil”, “British Indian Ocean Territory”, “Brunei Darussalam”, “Bulgaria”, “Burkina Faso”, “Burundi”, “Cambodia”, “Cameroon”, “Canada”, “Cape Verde”, “Cayman Islands”, “Central African Republic”, “Chad”, “Chile”, “China”, “Christmas Island”, “Cocos (Keeling) Islands”, “Colombia”, “Comoros”, “Congo”, “Congo, The Democratic Republic of the”, “Cook Islands”, “Costa Rica”, “Cote D’Ivoire”, “Croatia”, “Cuba”, “Cyprus”, “Czech Republic”, “Denmark”, “Djibouti”, “Dominica”, “Dominican Republic”, “Ecuador”, “Egypt”, “El Salvador”, “Equatorial Guinea”, “Eritrea”, “Estonia”, “Ethiopia”, “Europe”, “Falkland Islands (Malvinas)”, “Faroe Islands”, “Fiji”, “Finland”, “France”, “France, Metropolitan”, “French Guiana”, “French Polynesia”, “French Southern Territories”, “Gabon”, “Gambia”, “Georgia”, “Germany”, “Ghana”, “Gibraltar”, “Greece”, “Greenland”, “Grenada”, “Guadeloupe”, “Guam”, “Guatemala”, “Guernsey”, “Guinea”, “Guinea-Bissau”, “Guyana”, “Haiti”, “Heard Island and McDonald Islands”, “Holy See (Vatican City State)”, “Honduras”, “Hong Kong”, “Hungary”, “Iceland”, “India”, “Indonesia”, “Iran, Islamic Republic of”, “Iraq”, “Ireland”, “Isle of Man”, “Israel”, “Italy”, “Jamaica”, “Japan”, “Jersey”, “Jordan”, “Kazakhstan”, “Kenya”, “Kiribati”, “Korea, Democratic People’s Republic of”, “Korea, Republic of”, “Kuwait”, “Kyrgyzstan”, “Lao People’s Democratic Republic”, “Latvia”, “Lebanon”, “Lesotho”, “Liberia”, “Libyan Arab Jamahiriya”, “Liechtenstein”, “Lithuania”, “Luxembourg”, “Macau”, “Macedonia”, “Madagascar”, “Malawi”, “Malaysia”, “Maldives”, “Mali”, “Malta”, “Marshall Islands”, “Martinique”, “Mauritania”, “Mauritius”, “Mayotte”, “Mexico”, “Micronesia, Federated States of”, “Moldova, Republic of”, “Monaco”, “Mongolia”, “Montenegro”, “Montserrat”, “Morocco”, “Mozambique”, “Myanmar”, “Namibia”, “Nauru”, “Nepal”, “Netherlands”, “Netherlands Antilles”, “New Caledonia”, “New Zealand”, “Nicaragua”, “Niger”, “Nigeria”, “Niue”, “Norfolk Island”, “Northern Mariana Islands”, “Norway”, “Oman”, “Other”, “Pakistan”, “Palau”, “Palestinian Territory”, “Panama”, “Papua New Guinea”, “Paraguay”, “Peru”, “Philippines”, “Pitcairn Islands”, “Poland”, “Portugal”, “Puerto Rico”, “Qatar”, “Reunion”, “Romania”, “Russian Federation”, “Rwanda”, “Saint Barthelemy”, “Saint Helena”, “Saint Kitts and Nevis”, “Saint Lucia”, “Saint Martin”, “Saint Pierre and Miquelon”, “Saint Vincent and the Grenadines”, “Samoa”, “San Marino”, “Sao Tome and Principe”, “Satellite Provider”, “Saudi Arabia”, “Senegal”, “Serbia”, “Seychelles”, “Sierra Leone”, “Singapore”, “Slovakia”, “Slovenia”, “Solomon Islands”, “Somalia”, “South Africa”, “South Georgia and the South Sandwich Islands”, “Spain”, “Sri Lanka”, “Sudan”, “Suriname”, “Svalbard and Jan Mayen”, “Swaziland”, “Sweden”, “Switzerland”, “Syrian Arab Republic”, “Taiwan”, “Tajikistan”, “Tanzania, United Republic of”, “Thailand”, “Timor-Leste”, “Togo”, “Tokelau”, “Tonga”, “Trinidad and Tobago”, “Tunisia”, “Turkey”, “Turkmenistan”, “Turks and Caicos Islands”, “Tuvalu”, “Uganda”, “Ukraine”, “United Arab Emirates”, “United Kingdom”, “United States”, “United States Minor Outlying Islands”, “Unknown”, “Uruguay”, “Uzbekistan”, “Vanuatu”, “Venezuela”, “Vietnam”, “Virgin Islands, British”, “Virgin Islands, U.S.”, “Wallis and Futuna”, “Western Sahara”, “Yemen”, “Zambia”, “Zimbabwe”

Enum_Country_Code_Alpha_2¶

Enum values for Alpha-2 country codes based on ISO 3166. Use two dashes (–) if Unknown

Type string with possible values: “–”, “A1”, “A2”, “AD”, “AE”, “AF”, “AG”, “AI”, “AL”, “AM”, “AN”, “AO”, “AP”, “AQ”, “AR”, “AS”, “AT”, “AU”, “AW”, “AX”, “AZ”, “BA”, “BB”, “BD”, “BE”, “BF”, “BG”, “BH”, “BI”, “BJ”, “BL”, “BM”, “BN”, “BO”, “BQ”, “BR”, “BS”, “BT”, “BV”, “BW”, “BY”, “BZ”, “CA”, “CC”, “CD”, “CF”, “CG”, “CH”, “CI”, “CK”, “CL”, “CM”, “CN”, “CO”, “CR”, “CU”, “CV”, “CX”, “CY”, “CZ”, “DE”, “DJ”, “DK”, “DM”, “DO”, “DZ”, “EC”, “EE”, “EG”, “EH”, “ER”, “ES”, “ET”, “EU”, “FI”, “FJ”, “FK”, “FM”, “FO”, “FR”, “FX”, “GA”, “GB”, “GD”, “GE”, “GF”, “GG”, “GH”, “GI”, “GL”, “GM”, “GN”, “GP”, “GQ”, “GR”, “GS”, “GT”, “GU”, “GW”, “GY”, “HK”, “HM”, “HN”, “HR”, “HT”, “HU”, “ID”, “IE”, “IL”, “IM”, “IN”, “IO”, “IQ”, “IR”, “IS”, “IT”, “JE”, “JM”, “JO”, “JP”, “KE”, “KG”, “KH”, “KI”, “KM”, “KN”, “KP”, “KR”, “KW”, “KY”, “KZ”, “LA”, “LB”, “LC”, “LI”, “LK”, “LR”, “LS”, “LT”, “LU”, “LV”, “LY”, “MA”, “MC”, “MD”, “ME”, “MF”, “MG”, “MH”, “MK”, “ML”, “MM”, “MN”, “MO”, “MP”, “MQ”, “MR”, “MS”, “MT”, “MU”, “MV”, “MW”, “MX”, “MY”, “MZ”, “NA”, “NC”, “NE”, “NF”, “NG”, “NI”, “NL”, “NO”, “NP”, “NR”, “NU”, “NZ”, “O1”, “OM”, “PA”, “PE”, “PF”, “PG”, “PH”, “PK”, “PL”, “PM”, “PN”, “PR”, “PS”, “PT”, “PW”, “PY”, “QA”, “RE”, “RO”, “RS”, “RU”, “RW”, “SA”, “SB”, “SC”, “SD”, “SE”, “SG”, “SH”, “SI”, “SJ”, “SK”, “SL”, “SM”, “SN”, “SO”, “SR”, “ST”, “SV”, “SY”, “SZ”, “TC”, “TD”, “TF”, “TG”, “TH”, “TJ”, “TK”, “TL”, “TM”, “TN”, “TO”, “TR”, “TT”, “TV”, “TW”, “TZ”, “UA”, “UG”, “UM”, “US”, “UY”, “UZ”, “VA”, “VC”, “VE”, “VG”, “VI”, “VN”, “VU”, “WF”, “WS”, “YE”, “YT”, “ZA”, “ZM”, “ZW”

Enum_ISP¶

Enum values for Internet Service Providers (ISP)

Type string with possible values: “AOL”, “BeijingCNC”, “ChinaEducationNetwork”, “ChinaMobilNetwork”, “ChinaRailwayTelcom”, “ChinaTelecom”, “ChinaUnicom”, “CNC”, “Comcast”, “Earthlink”, “ShanghaiCNC”, “ShanghaiTelecom”

Enum_Protocols_Idle_Timeout_Policy¶

Enum values for Idle_Timeout_Policy protocols

Type string with possible values: “3pc”, “a/n”, “ah”, “all-other”, “argus”, “aris”, “ax.25”, “bbn-rcc”, “bna”, “br-sat-mon”, “cbt”, “cftp”, “chaos”, “compaq-peer”, “cphb”, “cpnx”, “crdup”, “crtp”, “dccp”, “dcn”, “ddp”, “ddx”, “dgp”, “dsr”, “egp”, “eigrp”, “emcon”, “encap”, “esp”, “etherip”, “fc”, “fire”, “ggp”, “gmtp”, “gre”, “hip”, “hmp”, “hopopt”, “i-nlsp”, “iatp”, “icmp”, “idpr”, “idpr-cmtp”, “idrp”, “ifmp”, “igmp”, “igp”, “il”, “ip”, “ipcomp”, “ipcv”, “ipencap”, “ipip”, “iplt”, “ippc”, “ipv4”, “ipv6”, “ipv6-auth”, “ipv6-crypt”, “ipv6-frag”, “ipv6-icmp”, “ipv6-nonxt”, “ipv6-opts”, “ipv6-route”, “ipx-in-ip”, “irtp”, “isis”, “iso-ip”, “iso-tp4”, “kryptolan”, “l2tp”, “larp”, “leaf-1”, “leaf-2”, “manet”, “merit-inp”, “mfe-nsp”, “micp”, “mobile”, “mobility-header”, “mpls-in-ip”, “mtp”, “mux”, “narp”, “netblt”, “nsfnet-igp”, “nvp”, “ospf”, “pgm”, “pim”, “pipe”, “pnni”, “prm”, “ptp”, “pup”, “pvp”, “qnx”, “rdp”, “rohc”, “rsvp”, “rspv-e2e-ignore”, “rvd”, “sat-expak”, “sat-mon”, “scc-sp”, “scps”, “sctp”, “sdrp”, “secure-vmtp”, “shim6”, “skip”, “sm”, “smp”, “snp”, “sprite-rpc”, “sps”, “srp”, “sscopmce”, “st”, “stp”, “sun-nd”, “swipe”, “tcf”, “tcp”, “tlsp”, “tp++”, “trunk-1”, “trunk-2”, “ttp”, “udp”, “udplite”, “uti”, “vines”, “visa”, “vmtp”, “vrrp”, “wb-expak”, “wb-mon”, “wesp”, “wsn”, “xnet”, “xns-idp”, “xtp”

F5_String¶

The value can be either a string, text property, base64 property, url property, etc.

Properties:

Name (Type)	Default	Values	Description
base64 (Property_Base64)
copyFrom (Pointer_Copy_From)
text (Property_Text)
url (Resource_URL)

F5base64¶

Slightly over-matches both base64-orig and base64-url data

No properties

Firewall_Address_List¶

Declares an address-list for use by firewall rules. An address list is a list of IP-address prefixes to compare against the source-IP address and/or destination-IP address in an IP packet

Properties:

Name (Type)	Values	Description
addresses (array<string \| Firewall_Address_List_addresses>)		A list of IPv4 and IPv6 addresses and address ranges. You can specify a network with CIDR slash notation.
addressLists (array<Pointer_Firewall_Address_List>)		A list of other address lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
class (string)	“Firewall_Address_List”
fqdns (array<string>)		A list of fully qualified domain names.
geo (array<string>)		A list of geographic locations (for example, US:Washington).
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Firewall_Address_List_addresses¶

Firewall_Address_List addresses possible properties when object type

Properties:

Name (Type)	Default	Values	Description
accessKeyId (string)			Information for discovering AWS nodes that are not in the same region as your BIG-IP (also requires the secretAccessKey field
addressDiscovery (string)		“event”, “aws”, “gce”, “azure”, “consul”	Selects how server (node) addresses are discovered
addressRealm (string)	“private”	“public”, “private”	Specifies whether to look for public or private IP addresses
apiAccessKey (string \| Secret)			Azure registered application API access key (AKA service principal secret). Will be stored in the declaration in an encrypted format.
applicationId (string)			Azure registered application ID (AKA client ID)
credentialUpdate (boolean)	false	true, false	Specifies whether you are updating your credentials
directoryId (string)			Azure Active Directory ID (AKA tenant ID)
encodedCredentials (string \| Secret)			Base 64 encoded service account credentials JSON
encodedToken (string \| Secret)			Base 64 encoded bearer token to make requests to the Consul API. Will be stored in the declaration in an encrypted format.
environment (string)	“Azure”		Azure environment name. Required if environment should not be determined by instance metadata.
externalId (string)			External Id
jmesPathQuery (string)			Custom JMESPath Query
minimumMonitors (integer)	1	[-infinity, infinity]
projectId (string)			For Google Cloud Engine (GCE) only: The ID of the project in which the members are located
region (string)	“”		Empty string (default) means region in which ADC is running
rejectUnauthorized (boolean)	true	true, false	If true, the server certificate is verified against the list of supplied/default CAs when making requests to the Consul API.
resourceGroup (string)			Azure Resource Group name
resourceId (string)			ID of resource to find nodes by.
resourceType (string)		“tag”, “scaleSet”	Type of resource identified by resourceId. This can be used in place of tagKey/tagValue.
roleARN (string)			Assume a role (also requires the externalId field)
secretAccessKey (string \| Secret)			Will be stored in the declaration as an encrypted string
subscriptionId (string)			Azure subscription ID
tagKey (string)			The tag key associated with the node to add to this pool
tagValue (string)			The tag value associated with the node to add to this pool
trustCA (Pointer_CA_Bundle)			CA Bundle to validate server certificates
undetectableAction (string)	“remove”	“disable”, “remove”	Action to take when node cannot be detected
updateInterval (integer)	60	[1, 3600]	Server-discovery update interval (seconds)
uri (string)			The location of the node data
useManagedIdentity (boolean)	false	true, false	Use Azure managed identity rather than directoryId, applicationId, and apiAccessKey

Firewall_Policy¶

Configures firewall policy

Properties:

Name (Type)	Values	Description
class (string)	“Firewall_Policy”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
routeDomainEnforcement (array<Pointer_Route_Domain>)		Specifies Route Domains to enforce this policy on. Rules of this policy will be enforced on the Route Domains. If setting this property, the Firewall_Policy must be defined in /Common/Shared.
rules (array<Pointer_Firewall_Rule_List \| Firewall_Rule>)	-, -	A list of firewall policy rules

Firewall_Port_List¶

Declares a port-list for use by firewall rules. A firewall rule can match a packet’s source port or destination port against one of the ports in a port list, and can take some action (such as ACCEPT or DROP) for a matching packet.

Properties:

Name (Type)	Values	Description
class (string)	“Firewall_Port_List”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
portLists (array<Firewall_Port_List_portLists>)		A list of other port lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
ports (array<integer \| string>)	[-infinity, infinity]	A list of ports and port ranges (for example, 80, “8080-8090”).
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

Firewall_Port_List_portLists¶

Firewall_Port_List portLists possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP firewall port list
use (string)			BIG-IP AS3 pointer to firewall port list declaration

Firewall_Rule¶

Declares a network firewall rule.

Properties:

Name (Type)	Default	Values	Description
action (string)		“accept”, “drop”, “accept-decisively”, “reject”	Specifies the action that the firewall rule will take on matching packets.
destination (Firewall_Rule_Destination)
iRule (Firewall_Rule_iRule)			Specifies the name of the iRule (by BIG-IP AS3 pointer or BIG-IP pathname) that the system will trigger when a packet matches the firewall rule.
iRuleSampleRate (integer)		[-infinity, infinity]	Specifies the rate at which the system will trigger the specified iRule when a packet matches this firewall rule. The default value is 1 and causes the system to trigger the iRule for every packet that matches. A value of 0 disables iRule triggering.
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
loggingEnabled (boolean)	false	true, false	Specifies whether the system enables or disables logging for the firewall rule.
name (string)			The name of the firewall rule.
protocol (string)	“any”	“3pc”, “a/n”, “ah”, “any”, “argus”, “aris”, “ax.25”, “bbn-rcc”, “bna”, “br-sat-mon”, “cbt”, “cftp”, “chaos”, “compaq-peer”, “cphb”, “cpnx”, “crdup”, “crtp”, “dccp”, “dcn”, “ddp”, “ddx”, “dgp”, “dsr”, “egp”, “eigrp”, “emcon”, “encap”, “esp”, “etherip”, “fc”, “fire”, “ggp”, “gmtp”, “gre”, “hip”, “hmp”, “hopopt”, “i-nlsp”, “iatp”, “icmp”, “idpr”, “idpr-cmtp”, “idrp”, “ifmp”, “igmp”, “igp”, “il”, “ip”, “ipcomp”, “ipcv”, “ipip”, “iplt”, “ippc”, “ipv4”, “ipv6”, “ipv6-auth”, “ipv6-crypt”, “ipv6-frag”, “ipv6-icmp”, “ipv6-nonxt”, “ipv6-opts”, “ipv6-route”, “ipx-in-ip”, “irtp”, “isis”, “iso-ip”, “iso-tp4”, “kryptolan”, “l2tp”, “larp”, “leaf-1”, “leaf-2”, “manet”, “merit-inp”, “mfe-nsp”, “micp”, “mobile”, “mobility-header”, “mpls-in-ip”, “mtp”, “mux”, “narp”, “netblt”, “nsfnet-igp”, “nvp”, “ospf”, “pgm”, “pim”, “pipe”, “pnni”, “prm”, “ptp”, “pup”, “pvp”, “qnx”, “rdp”, “rohc”, “rsvp”, “rsvp-e2e-ignore”, “rvd”, “sat-expak”, “sat-mon”, “scc-sp”, “scps”, “sctp”, “sdrp”, “secure-vmtp”, “shim6”, “skip”, “sm”, “smp”, “snp”, “sprite-rpc”, “sps”, “srp”, “sscopmce”, “st”, “stp”, “sun-nd”, “swipe”, “tcf”, “tcp”, “tlsp”, “tp++”, “trunk-1”, “trunk-2”, “ttp”, “udp”, “udplite”, “uti”, “vines”, “visa”, “vmtp”, “vrrp”, “wb-expak”, “wb-mon”, “wesp”, “wsn”, “xnet”, “xns-idp”, “xtp”	Specifies the protocol to which the firewall rule applies
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
source (Firewall_Rule_Source)

Firewall_Rule_iRule¶

Firewall_Rule iRule possible properties

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP iRule
use (string)			BIG-IP AS3 pointer to iRule declaration

Firewall_Rule_Destination¶

Declares the packet destinations to which the network firewall rule applies.

Properties:

Name (Type)	Default	Values	Description
addresses (array<string>)			A list of IPv4 and IPv6 addresses and address ranges. You can specify a network with CIDR slash notation.
addressLists (array<Pointer_Firewall_Address_List>)			A list of address lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
portLists (array<Firewall_Rule_Destination_portLists>)			A list of port lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
ports (array<string>)			A list of ports and port ranges.

Firewall_Rule_Destination_portLists¶

Firewall_Rule_Destination portLists possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP firewall port list
use (string)			BIG-IP AS3 pointer to firewall port list declaration

Firewall_Rule_List¶

Declares a list of network firewall rules. You can reuse a rule list in multiple firewalls, such as the firewalls for self IPs, routing domains, and the global firewall.

Properties:

Name (Type)	Values	Description
class (string)	“Firewall_Rule_List”
label (string)	regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)	regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
rules (array<Firewall_Rule>)		A list of network firewall rules.

Firewall_Rule_Source¶

Declares the packet sources to which the network firewall rule applies.

Properties:

Name (Type)	Default	Values	Description
addresses (array<string>)			A list of IPv4 and IPv6 addresses and address ranges. You can specify a network with CIDR slash notation.
addressLists (array<Pointer_Firewall_Address_List>)			A list of address lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
portLists (array<Firewall_Rule_Source_portLists>)			A list of port lists (each by BIG-IP AS3 pointer or BIG-IP pathname).
ports (array<string>)			A list of ports and port ranges.
vlans (array<reference>)			A list of VLANs by BIG-IP pathname

Firewall_Rule_Source_portLists¶

Firewall_Rule_Source portLists possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP firewall port list
use (string)			BIG-IP AS3 pointer to firewall port list declaration

FIX_Profile¶

Configures a Financial Information eXchange Protocol (FIX) profile

Properties:

Name (Type)	Default	Values	Description
class (string)		“FIX_Profile”
errorAction (string)	“dont-forward”	“dont-forward”, “drop-connection”	Specifies the error handling method
fullLogonParsingEnabled (boolean)	true	true, false	Enables or disables logon message as always fully parsed. Other messages are parsed according to the configuration of Quick Parsing
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
messageLogPublisher (Pointer_Log_Publisher)			Specifies the publisher for message logging
parentProfile (Pointer_FIX_Profile)	{“bigip”:”/Common/fix”}		Specifies the name of the profile object to inherit the settings from
quickParsingEnabled (boolean)	false	true, false	Enables or disables quick parsing which parses the basic standard fields and validates message length and checksum
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
reportLogPublisher (Pointer_Log_Publisher)			Specifies the publisher for error messages and status reports
responseParsingEnabled (boolean)	false	true, false	Enables or disables response parsing which parses the messages from the FIX server. Applies the same parser configuration and error handling at server side as at client side. If not enabled, server side messages are directly passed through
senderTagMappingList (array<Sender_Tag_Mapping>)			Specifies the mappings between sender ID and tag substitution data group.
statisticsSampleInterval (integer)	20	[10, 4294967295]	Specifies the sample interval of the message rate in seconds

FTP_Profile¶

File Transfer Protocol (FTP) profile

Properties:

Name (Type)	Default	Values	Description
activeModeEnabled (boolean)	true	true, false	Specifies if the profile should allow FTP active transfer mode
algLogProfile (reference \| Pointer_ALG_Log_Profile)			ALG log profile pointer
class (string)		“FTP_Profile”
enforceTlsSessionReuseEnabled (boolean)	false	true, false	Enforce data connection to reuse TLS session
ftpsMode (string)	“disallow”	“disallow”, “allow”, “require”	Specifies the policy for explicit FTPS negotiation on FTP command channel
inheritParentProfileEnabled (boolean)	false	true, false	Specifies if the FTP data channel should inherit the TCP profile used by the control channel
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
logPublisher (reference \| Pointer_Log_Publisher)			Log publisher pointer
port (integer)	20	[0, 65535]	Specifies a service for the data channel port used for this profile
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
securityEnabled (boolean)	false	true, false	Specifies whether to enable or disable secure FTP traffic for the BIG-IP Application Security Manager
translateExtendedEnabled (boolean)	true	true, false	Specifies if the profile should automatically translate RFC2428 extended requests EPSV and EPRT to PASV and PORT when communicating with IPv4servers

GSLB_Data_Center¶

Declares a GSLB Data Center configuration

Properties:

Name (Type)	Default	Values	Description
class (string)		“GSLB_Data_Center”
contact (string)			Specifies the name of the administrator or the name of the department that manages the data center
enabled (boolean)	true	true, false	Specifies whether the data center is enabled or disabled
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
location (string)			Specifies the location of the data center
proberFallback (string)	“any-available”	“any-available”, “inside-datacenter”, “none”, “outside-datacenter”, “pool”	Specifies the type of prober to use to monitor servers defined in this data center when the preferred type is not available. The default value is any-available
proberPool (Pointer_GSLB_Prober_Pool)
proberPreferred (string)	“inside-datacenter”	“inside-datacenter”, “outside-datacenter”, “pool”	Specifies the type of prober to use to monitor servers defined in this data center. The default value is inside-data-center. Note: Prober pools are not used by the bigip monitor
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

GSLB_Domain¶

Configures GSLB (Global Server Load Balancing) settings for a domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_iRules¶

GSLB_Domain iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_pools¶

GSLB_Domain pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_Domain_A¶

Configures GSLB (Global Server Load Balancing) settings for A domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_A_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_A_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_A_iRules¶

GSLB_Domain_A iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_A_pools¶

GSLB_Domain_A pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_Domain_AAAA¶

Configures GSLB (Global Server Load Balancing) settings for AAAA domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_AAAA_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_AAAA_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_AAAA_iRules¶

GSLB_Domain_AAAA iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_AAAA_pools¶

GSLB_Domain_AAAA pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_Domain_CNAME¶

Configures GSLB (Global Server Load Balancing) settings for CNAME domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_CNAME_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_CNAME_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_CNAME_iRules¶

GSLB_Domain_CNAME iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_CNAME_pools¶

GSLB_Domain_CNAME pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_Domain_MX¶

Configures GSLB (Global Server Load Balancing) settings for MX domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_MX_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_MX_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_MX_iRules¶

GSLB_Domain_MX iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_MX_pools¶

GSLB_Domain_MX pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_Domain_NAPTR¶

Configures GSLB (Global Server Load Balancing) settings for NAPTR domain.

Properties:

Name (Type)	Default	Values	Description
aliases (array<string>)			List of alternate domain names. Each may include wildcard characters.
class (string)		“GSLB_Domain”
clientSubnetPreferred (boolean)	false	true, false	Specifies that this domain should use the edns0 client subnet option when using topology load balancing. If the query does not contain a client subnet option, the system will fall back to the default option of using the source address.
domainName (string)			The name of the domain for the site content you are load balancing. If you have many domains, you can use two different wildcard characters, * and ?, to represent one or more characters in the domain alias, which reduces the number of aliases you have to add to the configuration
enabled (boolean)	true	true, false	When true (default), the system can use the domain and its resources for load balancing requests
failureRcode (string)	“noerror”	“formerr”, “noerror”, “notimpl”, “nxdomain”, “refused”, “servfail”	Specifies the DNS RCODE used when failure-rcode-response is enabled
failureRcodeResponse (boolean)	false	true, false	Specifies whether RCODE responses are enabled
failureRcodeTtl (integer)	0	[0, infinity]	Specifies the negative caching TTL of the SOA for the RCODE response
iRules (array<string \| GSLB_Domain_NAPTR_iRules>)		-, -	List of GSLB iRules for this GSLB Domain (order is significant)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lastResortPool (Pointer_GSLB_Pool)			Specifies the pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
lastResortPoolType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	This is used to specify the type of pool being used for the lastResortPool
loadBalancingDecisionLogVerbosity (array<string>)		“pool-selection”, “pool-traversal”, “pool-member-selection”, “pool-member-traversal”	Specifies the amount of detail logged when making load balancing decisions. This is used for debugging purposes only. Performance will be affected if any value is set. Please reset after debugging is finished.
persistCidrIpv4 (integer)	32	[0, 32]	Specifies a mask used to group IPv4 LDNS addresses.
persistCidrIpv6 (integer)	128	[0, 128]	Specifies a mask used to group IPv6 LDNS addresses.
persistenceEnabled (boolean)	false	true, false	Specifies that when a local DNS server makes repetitive requests on behalf of a client, the system reconnects the client to the same resource as previous requests. Set to true to enable.
poolLbMode (string)	“round-robin”	“global-availability”, “ratio”, “round-robin”, “topology”	Specifies the load balancing method used to select a pool in this domain
pools (array<GSLB_Domain_NAPTR_pools>)			Specifies the pools that this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
poolsCname (array<Pointer_GSLB_Pool>)			Specifies the cname pools this domain uses for load balancing. The system evaluates the pools in the order in which they are listed, until it finds a matching pool
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttlPersistence (integer)	3600	[0, 4294967295]	Specifies, in seconds, the length of time for which a persistence entry is valid.

GSLB_Domain_NAPTR_iRules¶

GSLB_Domain_NAPTR iRules possible properties when object type

Properties:

Name (Type)	Default	Values	Description
bigip (string)		format: f5bigip	Pathname of existing BIG-IP GTM iRule
use (string)			BIG-IP AS3 pointer to GSLB_iRule (declared separately)

GSLB_Domain_NAPTR_pools¶

GSLB_Domain_NAPTR pools possible properties when object type

Properties:

Name (Type)	Default	Values	Description
ratio (integer)	1	[-infinity, infinity]	Ratio weight assigned to GSLB pool
use (string)			BIG-IP AS3 pointer to GSLB Pool declaration

GSLB_iRule¶

Specifies or configures an iRule for use in GSLB Domains

Properties:

Name (Type)	Default	Values	Description
class (string)		“GSLB_iRule”
expand (boolean)	true	true, false	If true (default), expand backquoted variables in iRule
iRule (IRule_Core)
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks

GSLB_Monitor¶

Declares a monitor that verifies the availability and/or performance status of a particular protocol, service, or application

Properties:

Name (Type)	Default	Values	Description
aggregateDynamicRatios (string)	“none”	“average-members”, “average-nodes”, “none”, “sum-members”, “sum-nodes”	Specifies how the system combines the module values to create the proportion (score) for the load balancing operation.
arguments (string)	“”		Arguments to specified external monitor (will be backquote-expanded)
base (string)			Specifies the location in the LDAP tree from which the monitor starts the health check
chaseReferrals (boolean)	true	true, false	Specifies, whether, upon receipt of an LDAP referral entry, the referral is followed
ciphers (string)	“DEFAULT”		Ciphersuite selection string
class (string)		“GSLB_Monitor”
clientCertificate (string)			BIG-IP AS3 pointer to client Certificate declaration, for TLS authentication (optional)
codesDown (array<integer>)		[0, infinity]	List of status codes meaning service is down (0 matches any code)
codesUp (array<integer>)		[0, infinity]	List of additional (to all 1/2/3xx) status codes meaning service is up (0 matches any code)
count (integer)	0	[0, 2147483647]	Number of monitor probes after which the connection to the database will be terminated. Count value of zero indicates that the connection will never be terminated.
database (string)			The name of the database with which the monitor attempts to communicate.
debugEnabled (boolean)	false	true, false	When enabled, the monitor sends error messages and additional information to a log file created and labeled specifically for this monitor. The default is false (disabled)
domain (string)	“”	format: hostname	Mail domain to check, if any (backquote-expanded)
environmentVariables (GSLB_Monitor_environmentVariables)	{}		Specifies user defined command line parameters that the external program requires.
expand (boolean)	true	true, false	If true (default), expand backquoted variables in script
filter (string)			Specifies an LDAP key which the monitor searches
headers (string)	“”		SIP headers to send in probes (if any)–separate by newlines (backquote-expanded)
ignoreDownResponseEnabled (boolean)	false	true, false	Specifies whether the monitor immediately marks an object down when it receives a down response. If enabled, the monitor ignores the down response for the duration of timeout. The default is false (disabled)
interval (integer)	30	[0, 86399]	Specifies, in seconds, the frequency at which the system issues the monitor check when either the resource is down or the status of the resource is unknown
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
mandatoryAttributes (boolean)	false	true, false	Specifies whether the target must include attributes in its response to be considered up
monitorType (string)		“http”, “https”, “gateway-icmp”, “tcp-half-open”, “mysql”, “sip”, “ldap”, “smtp”, “tcp”, “udp”, “bigip”, “external”	Specifies the type of monitor
passphrase (GSLB_Monitor_passphrase)			Passphrase if any for query authentication
pathname (string)			Tmsh object path name of an imported existing external monitor (e.g. /Common/arg_example)
probeAttempts (integer)	3	[0, infinity]	Specifies the number of times the BIG-IP system attempts to probe the host server, after which the BIG-IP system considers the host server down or unavailable
probeInterval (integer)	1	[0, infinity]	Specifies the frequency at which the BIG-IP system probes the host server
probeTimeout (integer)	5	[0, infinity]	Specifies the number of seconds after which the system times out the probe request to the system
protocol (string)	“udp”	“sips”, “tcp”, “tls”, “udp”	SIP transport protocol
receive (string)	“HTTP/1.”		Specifies the text string that the monitor looks for in the returned resource. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
receiveColumn (integer)		[1, 4096]	Specifies the column in the database where the system expects the specified Receive String to be located. Specify this property only if you configure the Send and Receive properties.
receiveRow (integer)		[1, 65535]	Specifies the row in the database where the system expects the specified Receive String to be located. Specify this property only if you configure the Send and Recieve properties.
receiveStatusCodes (array<integer>)		[-infinity, infinity]	Specifies the status codes that the monitor looks for in the returned resource
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
request (string)	“”		SIP request to send in probes (default empty)
reverseEnabled (boolean)	false	true, false	When enabled, a successful check marks the monitored object down instead of up. You can use the Reverse mode only if you configure both the send and receive options
script (F5string \| reference \| reference)			Bash(1) script which implements external monitor
security (string)	“none”	“none”, “ssl”, “tls”	Specifies the secure protocol type for communications with the target
send (string)	“HEAD / HTTP/1.0rnrn”		Specifies the text string that the monitor sends to the target object. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
sniServerName (string)			Server Name Indication (SNI) property for HTTPS monitor
target (string)	“:”		Specifies the IP address and service port of the resource that is the destination of this monitor. Format is ip:port
targetAddress (string)	“”	format: f5ip	IP address monitor should probe; if empty (default) then pool member address
targetPort (integer)	0	[0, 65535]	L4 port (if any) monitor should probe; if 0 (default) then pool member port
timeout (integer)	120	[0, 86400]	Specifies the number of seconds the target has in which to respond to the monitor request
timeUntilUp (integer)	0	[0, 1800]	Delay between successful probe and sending traffic to node (seconds)
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)
upInterval (integer)	0	[0, 3600]	Poll interval when service is already up (seconds)
username (string)			Username if any for query authentication

GSLB_Monitor_passphrase¶

GSLB_Monitor passphrase possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

GSLB_Monitor_BIGIP¶

Additional Monitor class properties available when monitorType = bigip

Properties:

Name (Type)	Default	Values	Description
aggregateDynamicRatios (string)	“none”	“average-members”, “average-nodes”, “none”, “sum-members”, “sum-nodes”	Specifies how the system combines the module values to create the proportion (score) for the load balancing operation.

GSLB_Monitor_External¶

Additional Monitor class properties available when monitorType = external

Properties:

Name (Type)	Default	Values	Description
arguments (string)	“”		Arguments to specified external monitor (will be backquote-expanded)
environmentVariables (GSLB_Monitor_External_environmentVariables)	{}		Specifies user defined command line parameters that the external program requires.
expand (boolean)	true	true, false	If true (default), expand backquoted variables in script
pathname (string)			Tmsh object path name of an imported existing external monitor (e.g. /Common/arg_example)
script (F5string \| reference \| reference)			Bash(1) script which implements external monitor

GSLB_Monitor_HTTP¶

Additional Monitor class properties available when monitorType = http

Properties:

Name (Type)	Default	Values	Description
receive (string)	“HTTP/1.”		Specifies the text string that the monitor looks for in the returned resource. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
receiveStatusCodes (array<integer>)		[-infinity, infinity]	Specifies the status codes that the monitor looks for in the returned resource
reverseEnabled (boolean)	false	true, false	When enabled, a successful check marks the monitored object down instead of up. You can use the Reverse mode only if you configure both the send and receive options
send (string)	“HEAD / HTTP/1.0rnrn”		Specifies the text string that the monitor sends to the target object. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Monitor_HTTPS¶

Additional Monitor class properties available when monitorType = https

Properties:

Name (Type)	Default	Values	Description
ciphers (string)	“DEFAULT”		Ciphersuite selection string
clientCertificate (string)			BIG-IP AS3 pointer to client Certificate declaration, for TLS authentication (optional)
receive (string)	“HTTP/1.”		Specifies the text string that the monitor looks for in the returned resource. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
receiveStatusCodes (array<integer>)		[-infinity, infinity]	Specifies the status codes that the monitor looks for in the returned resource
reverseEnabled (boolean)	false	true, false	When enabled, a successful check marks the monitored object down instead of up. You can use the Reverse mode only if you configure both the send and receive options
send (string)	“HEAD / HTTP/1.0rnrn”		Specifies the text string that the monitor sends to the target object. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
sniServerName (string)			Server Name Indication (SNI) property for HTTPS monitor
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Monitor_ICMP¶

Additional Monitor class properties available when monitorType = gateway-icmp

Properties:

Name (Type)	Default	Values	Description
probeAttempts (integer)	3	[0, infinity]	Specifies the number of times the BIG-IP system attempts to probe the host server, after which the BIG-IP system considers the host server down or unavailable
probeInterval (integer)	1	[0, infinity]	Specifies the frequency at which the BIG-IP system probes the host server
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Monitor_LDAP¶

GSLB Monitor LDAP definition

Properties:

Name (Type)	Default	Values	Description
base (string)			Specifies the location in the LDAP tree from which the monitor starts the health check
chaseReferrals (boolean)	true	true, false	Specifies, whether, upon receipt of an LDAP referral entry, the referral is followed
filter (string)			Specifies an LDAP key which the monitor searches
mandatoryAttributes (boolean)	false	true, false	Specifies whether the target must include attributes in its response to be considered up
monitorType (string)			Specifies the type of monitor
passphrase (GSLB_Monitor_LDAP_passphrase)			Passphrase if any for query authentication
security (string)	“none”	“none”, “ssl”, “tls”	Specifies the secure protocol type for communications with the target
targetAddress (string)	“”	format: f5ip	IP address monitor should probe; if empty (default) then pool member address
targetPort (integer)	0	[0, 65535]	L4 port (if any) monitor should probe; if 0 (default) then pool member port
timeUntilUp (integer)	0	[0, 1800]	Delay between successful probe and sending traffic to node (seconds)
upInterval (integer)	0	[0, 3600]	Poll interval when service is already up (seconds)
username (string)			Username if any for query authentication

GSLB_Monitor_LDAP_passphrase¶

GSLB_Monitor_LDAP passphrase possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

GSLB_Monitor_MySQL¶

GSLB Monitor MySQL definition

Properties:

Name (Type)	Default	Values	Description
count (integer)	0	[0, 2147483647]	Number of monitor probes after which the connection to the database will be terminated. Count value of zero indicates that the connection will never be terminated.
database (string)			The name of the database with which the monitor attempts to communicate.
monitorType (string)			Specifies the type of monitor
passphrase (GSLB_Monitor_MySQL_passphrase)			Passphrase if any for query authentication
receive (string)			Mark node up upon receipt of this (backquote-expanded) string
receiveColumn (integer)		[1, 4096]	Specifies the column in the database where the system expects the specified Receive String to be located. Specify this property only if you configure the Send and Receive properties.
receiveRow (integer)		[1, 65535]	Specifies the row in the database where the system expects the specified Receive String to be located. Specify this property only if you configure the Send and Recieve properties.
send (string)			Send this (backquote-expanded) string to query node
targetAddress (string)	“”	format: f5ip	IP address monitor should probe; if empty (default) then pool member address
targetPort (integer)	0	[0, 65535]	L4 port (if any) monitor should probe; if 0 (default) then pool member port
timeUntilUp (integer)	0	[0, 1800]	Delay between successful probe and sending traffic to node (seconds)
upInterval (integer)	0	[0, 3600]	Poll interval when service is already up (seconds)
username (string)			Username if any for query authentication

GSLB_Monitor_MySQL_passphrase¶

GSLB_Monitor_MySQL passphrase possible properties

Properties:

Name (Type)	Default	Values	Description
allowReuse (boolean)	false	true, false	If true, other declaration objects may reuse this value
ciphertext (string)			Put base64url(data_value) here
ignoreChanges (boolean)	false	true, false	If false (default), the system updates the ciphertext in every BIG-IP AS3 declaration deployment. If true, BIG-IP AS3 creates the ciphertext on first deployment, and leaves it untouched afterwards
miniJWE (boolean)	true	true, false	If true (default), object is an f5 mini-JWE
protected (string)	“eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0”		NOTE: F5 recommends you leave the property protected empty or not modify the default value. This property protected is a marker. Changing this value from the default indicates that your secrets have been encrypted with SecureVault. E.g. default value eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0 becomes `eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0. If you see ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJmNXN2In0’, ‘ciphertext’ contains base64url-encoded SecureVault cryptogram. JOSE header: alg=dir, enc=(none\|f5sv); default enc=none (encoded default is ‘protected’=’eyJhbGciOiJkaXIiLCJlbmMiOiJub25lIn0’, use with secret simply base64 url-encoded into ‘ciphertext’).
reuseFrom (string)			BIG-IP AS3 pointer to another JWE cryptogram in this declaration to copy
url (Secret_Resource_URL)			URL from which secret should be fetched

GSLB_Monitor_SIP¶

GSLB Monitor SIP definition

Properties:

Name (Type)	Default	Values	Description
ciphers (string)	“DEFAULT”		Ciphersuite selection string
clientCertificate (string)			BIG-IP AS3 pointer to client Certificate declaration, for TLS authentication (optional)
codesDown (array<integer>)		[0, infinity]	List of status codes meaning service is down (0 matches any code)
codesUp (array<integer>)		[0, infinity]	List of additional (to all 1/2/3xx) status codes meaning service is up (0 matches any code)
headers (string)	“”		SIP headers to send in probes (if any)–separate by newlines (backquote-expanded)
monitorType (string)			Specifies the type of monitor
protocol (string)	“udp”	“sips”, “tcp”, “tls”, “udp”	SIP transport protocol
request (string)	“”		SIP request to send in probes (default empty)
targetAddress (string)	“”	format: f5ip	IP address monitor should probe; if empty (default) then pool member address
targetPort (integer)	0	[0, 65535]	L4 port (if any) monitor should probe; if 0 (default) then pool member port
timeUntilUp (integer)	0	[0, 1800]	Delay between successful probe and sending traffic to node (seconds)
upInterval (integer)	0	[0, 3600]	Poll interval when service is already up (seconds)

GSLB_Monitor_SMTP¶

GSLB Monitor SMTP definition

Properties:

Name (Type)	Default	Values	Description
domain (string)	“”	format: hostname	Mail domain to check, if any (backquote-expanded)
monitorType (string)			Specifies the type of monitor
targetAddress (string)	“”	format: f5ip	IP address monitor should probe; if empty (default) then pool member address
targetPort (integer)	0	[0, 65535]	L4 port (if any) monitor should probe; if 0 (default) then pool member port
timeUntilUp (integer)	0	[0, 1800]	Delay between successful probe and sending traffic to node (seconds)
upInterval (integer)	0	[0, 3600]	Poll interval when service is already up (seconds)

GSLB_Monitor_TCP¶

Additional Monitor class properties available when monitorType = tcp

Properties:

Name (Type)	Default	Values	Description
receive (string)	“”		Specifies the text string that the monitor looks for in the returned resource. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
reverseEnabled (boolean)	false	true, false	When enabled, a successful check marks the monitored object down instead of up. You can use the Reverse mode only if you configure both the send and receive options
send (string)	“”		Specifies the text string that the monitor sends to the target object. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Monitor_TCP_Half_Open¶

Additional Monitor class properties available when monitorType = tcp-half-open

Properties:

Name (Type)	Default	Values	Description
probeAttempts (integer)	3	[0, infinity]	Specifies the number of times the BIG-IP system attempts to probe the host server, after which the BIG-IP system considers the host server down or unavailable
probeInterval (integer)	1	[0, infinity]	Specifies the frequency at which the BIG-IP system probes the host server
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Monitor_UDP¶

Additional Monitor class properties available when monitorType = udp

Properties:

Name (Type)	Default	Values	Description
debugEnabled (boolean)	false	true, false	When enabled, the monitor sends error messages and additional information to a log file created and labeled specifically for this monitor. The default is false (disabled)
probeAttempts (integer)	3	[0, infinity]	Specifies the number of times the BIG-IP system attempts to probe the host server, after which the BIG-IP system considers the host server down or unavailable
probeInterval (integer)	1	[0, infinity]	Specifies the frequency at which the BIG-IP system probes the host server
receive (string)	“”		Specifies the text string that the monitor looks for in the returned resource. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
reverseEnabled (boolean)	false	true, false	When enabled, a successful check marks the monitored object down instead of up. You can use the Reverse mode only if you configure both the send and receive options
send (string)	“default send string”		Specifies the text string that the monitor sends to the target object. If you do not specify a value for both the send and receive options, the monitor performs a simple service check and connect only
transparent (boolean)	false	true, false	Enables monitoring of pool members through firewalls. The default value is false (disabled)

GSLB_Pool¶

Declares a pool to use for load balancing

Properties:

Name (Type)	Default	Values	Description
bpsLimit (integer)	0	[0, infinity]	The maximum allowable data throughput rate, in bits per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
bpsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Bits Per Second (BPS) option for this pool. The default value is false (disabled)
class (string)		“GSLB_Pool”
connectionsLimit (integer)	0	[0, infinity]	The number of current connections allowed for the virtual servers in the pool. If the current connections exceed this value, the system marks the pool as unavailable
connectionsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum current connections option for this pool. The default value is false (disabled)
dynamicRatioEnabled (boolean)	false	true, false	Specifies whether the system applies a dynamic ratio to the load balancing algorithms for this pool. When enabled, the system treats QOS scores as ratios, and it uses each server or virtual server in proportion to the ratio determined by the QOS calculation.
enabled (boolean)	true	true, false	Specifies whether the pool and its resources are available for load balancing
fallbackIP (string)		format: f5ip	Specifies the IP address of the server to which the system directs requests when it cannot use one of its pools to do so. Note that the system uses the fallback IP only if you select a fallback load balancing method
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lbModeAlternate (string)	“round-robin”	“drop-packet”, “fallback-ip”, “global-availability”, “packet-rate”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Alternate Load Balancing mode
lbModeFallback (string)	“return-to-dns”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Fallback Load Balancing mode
lbModePreferred (string)	“round-robin”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”	Preferred Load Balancing mode
manualResumeEnabled (boolean)	false	true, false	Specifies whether you must manually restart a pool member that goes down
maxAnswersReturned (integer)	1	[1, 500]	Specifies the maximum number of available virtual servers that the system lists in a response
members (array<GSLB_Pool_Member_MX>)			Specifies the members of this pool
monitors (array<Pointer_GSLB_Monitor>)			Specifies the health monitors the system uses to determine whether it can use this pool for load balancing
ppsLimit (integer)	0	[0, infinity]	The maximum allowable data transfer rate, in packets per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
ppsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Packets Per Second (PPS) option for this pool. The default value is false (disabled)
qosHitRatio (integer)	5	[0, infinity]	Assigns a weight to the Hit Ratio performance factor for the Quality of Service dynamic load balancing mode
qosHops (integer)	0	[0, infinity]	Assigns a weight to the Hops performance factor for the Quality of Service dynamic load balancing mode
qosKbps (integer)	3	[0, infinity]	Assigns a weight to the Kilobytes per Second performance factor for the Quality of Service dynamic load balancing mode
qosLinkCapacity (integer)	30	[0, infinity]	Assigns a weight to the Link Capacity performance factor for the Quality of Service dynamic load balancing mode
qosPacketRate (integer)	1	[0, infinity]	Assigns a weight to the Packet Rate performance factor for the Quality of Service dynamic load balancing mode
qosRoundTripTime (integer)	50	[0, infinity]	Assigns a weight to the Round Trip Time performance factor for the Quality of Service dynamic load balancing mode
qosTopology (integer)	0	[0, infinity]	Assigns a weight to the Topology performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerCapacity (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerScore (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server Score performance factor for the Quality of Service dynamic load balancing mode
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttl (integer)	30	[0, 4294967295]	Specifies the number of seconds the IP address, once found, is valid. Once the time-to-live (TTL) expires, the client has to request the IP address resolution again
verifyMemberEnabled (boolean)	true	true, false	Specifies the system verifies the availability of the pool members before sending a connection to those resources

GSLB_Pool_A¶

Pointer to a Pool A object

Properties:

Name (Type)	Default	Values	Description
bpsLimit (integer)	0	[0, infinity]	The maximum allowable data throughput rate, in bits per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
bpsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Bits Per Second (BPS) option for this pool. The default value is false (disabled)
class (string)		“GSLB_Pool”
connectionsLimit (integer)	0	[0, infinity]	The number of current connections allowed for the virtual servers in the pool. If the current connections exceed this value, the system marks the pool as unavailable
connectionsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum current connections option for this pool. The default value is false (disabled)
dynamicRatioEnabled (boolean)	false	true, false	Specifies whether the system applies a dynamic ratio to the load balancing algorithms for this pool. When enabled, the system treats QOS scores as ratios, and it uses each server or virtual server in proportion to the ratio determined by the QOS calculation.
enabled (boolean)	true	true, false	Specifies whether the pool and its resources are available for load balancing
fallbackIP (string)		format: f5ip	Specifies the IP address of the server to which the system directs requests when it cannot use one of its pools to do so. Note that the system uses the fallback IP only if you select a fallback load balancing method
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lbModeAlternate (string)	“round-robin”	“drop-packet”, “fallback-ip”, “global-availability”, “packet-rate”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Alternate Load Balancing mode
lbModeFallback (string)	“return-to-dns”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Fallback Load Balancing mode
lbModePreferred (string)	“round-robin”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”	Preferred Load Balancing mode
manualResumeEnabled (boolean)	false	true, false	Specifies whether you must manually restart a pool member that goes down
maxAnswersReturned (integer)	1	[1, 500]	Specifies the maximum number of available virtual servers that the system lists in a response
members (array<GSLB_Pool_Member_MX>)			Specifies the members of this pool
monitors (array<Pointer_GSLB_Monitor>)			Specifies the health monitors the system uses to determine whether it can use this pool for load balancing
ppsLimit (integer)	0	[0, infinity]	The maximum allowable data transfer rate, in packets per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
ppsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Packets Per Second (PPS) option for this pool. The default value is false (disabled)
qosHitRatio (integer)	5	[0, infinity]	Assigns a weight to the Hit Ratio performance factor for the Quality of Service dynamic load balancing mode
qosHops (integer)	0	[0, infinity]	Assigns a weight to the Hops performance factor for the Quality of Service dynamic load balancing mode
qosKbps (integer)	3	[0, infinity]	Assigns a weight to the Kilobytes per Second performance factor for the Quality of Service dynamic load balancing mode
qosLinkCapacity (integer)	30	[0, infinity]	Assigns a weight to the Link Capacity performance factor for the Quality of Service dynamic load balancing mode
qosPacketRate (integer)	1	[0, infinity]	Assigns a weight to the Packet Rate performance factor for the Quality of Service dynamic load balancing mode
qosRoundTripTime (integer)	50	[0, infinity]	Assigns a weight to the Round Trip Time performance factor for the Quality of Service dynamic load balancing mode
qosTopology (integer)	0	[0, infinity]	Assigns a weight to the Topology performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerCapacity (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerScore (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server Score performance factor for the Quality of Service dynamic load balancing mode
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttl (integer)	30	[0, 4294967295]	Specifies the number of seconds the IP address, once found, is valid. Once the time-to-live (TTL) expires, the client has to request the IP address resolution again
verifyMemberEnabled (boolean)	true	true, false	Specifies the system verifies the availability of the pool members before sending a connection to those resources

GSLB_Pool_AAAA¶

Pointer to a Pool AAAA object

Properties:

Name (Type)	Default	Values	Description
bpsLimit (integer)	0	[0, infinity]	The maximum allowable data throughput rate, in bits per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
bpsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Bits Per Second (BPS) option for this pool. The default value is false (disabled)
class (string)		“GSLB_Pool”
connectionsLimit (integer)	0	[0, infinity]	The number of current connections allowed for the virtual servers in the pool. If the current connections exceed this value, the system marks the pool as unavailable
connectionsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum current connections option for this pool. The default value is false (disabled)
dynamicRatioEnabled (boolean)	false	true, false	Specifies whether the system applies a dynamic ratio to the load balancing algorithms for this pool. When enabled, the system treats QOS scores as ratios, and it uses each server or virtual server in proportion to the ratio determined by the QOS calculation.
enabled (boolean)	true	true, false	Specifies whether the pool and its resources are available for load balancing
fallbackIP (string)		format: f5ip	Specifies the IP address of the server to which the system directs requests when it cannot use one of its pools to do so. Note that the system uses the fallback IP only if you select a fallback load balancing method
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lbModeAlternate (string)	“round-robin”	“drop-packet”, “fallback-ip”, “global-availability”, “packet-rate”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Alternate Load Balancing mode
lbModeFallback (string)	“return-to-dns”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Fallback Load Balancing mode
lbModePreferred (string)	“round-robin”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”	Preferred Load Balancing mode
manualResumeEnabled (boolean)	false	true, false	Specifies whether you must manually restart a pool member that goes down
maxAnswersReturned (integer)	1	[1, 500]	Specifies the maximum number of available virtual servers that the system lists in a response
members (array<GSLB_Pool_Member_MX>)			Specifies the members of this pool
monitors (array<Pointer_GSLB_Monitor>)			Specifies the health monitors the system uses to determine whether it can use this pool for load balancing
ppsLimit (integer)	0	[0, infinity]	The maximum allowable data transfer rate, in packets per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
ppsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Packets Per Second (PPS) option for this pool. The default value is false (disabled)
qosHitRatio (integer)	5	[0, infinity]	Assigns a weight to the Hit Ratio performance factor for the Quality of Service dynamic load balancing mode
qosHops (integer)	0	[0, infinity]	Assigns a weight to the Hops performance factor for the Quality of Service dynamic load balancing mode
qosKbps (integer)	3	[0, infinity]	Assigns a weight to the Kilobytes per Second performance factor for the Quality of Service dynamic load balancing mode
qosLinkCapacity (integer)	30	[0, infinity]	Assigns a weight to the Link Capacity performance factor for the Quality of Service dynamic load balancing mode
qosPacketRate (integer)	1	[0, infinity]	Assigns a weight to the Packet Rate performance factor for the Quality of Service dynamic load balancing mode
qosRoundTripTime (integer)	50	[0, infinity]	Assigns a weight to the Round Trip Time performance factor for the Quality of Service dynamic load balancing mode
qosTopology (integer)	0	[0, infinity]	Assigns a weight to the Topology performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerCapacity (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerScore (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server Score performance factor for the Quality of Service dynamic load balancing mode
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttl (integer)	30	[0, 4294967295]	Specifies the number of seconds the IP address, once found, is valid. Once the time-to-live (TTL) expires, the client has to request the IP address resolution again
verifyMemberEnabled (boolean)	true	true, false	Specifies the system verifies the availability of the pool members before sending a connection to those resources

GSLB_Pool_CNAME¶

Pointer to a Pool CNAME object

Properties:

Name (Type)	Default	Values	Description
bpsLimit (integer)	0	[0, infinity]	The maximum allowable data throughput rate, in bits per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
bpsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Bits Per Second (BPS) option for this pool. The default value is false (disabled)
class (string)		“GSLB_Pool”
connectionsLimit (integer)	0	[0, infinity]	The number of current connections allowed for the virtual servers in the pool. If the current connections exceed this value, the system marks the pool as unavailable
connectionsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum current connections option for this pool. The default value is false (disabled)
dynamicRatioEnabled (boolean)	false	true, false	Specifies whether the system applies a dynamic ratio to the load balancing algorithms for this pool. When enabled, the system treats QOS scores as ratios, and it uses each server or virtual server in proportion to the ratio determined by the QOS calculation.
enabled (boolean)	true	true, false	Specifies whether the pool and its resources are available for load balancing
fallbackIP (string)		format: f5ip	Specifies the IP address of the server to which the system directs requests when it cannot use one of its pools to do so. Note that the system uses the fallback IP only if you select a fallback load balancing method
label (string)		regex: ^[^x00-x1fx22#&<>?x5b-x5d`x7f]$	Optional friendly name for this object. Allows 0-64 chars, excluding a few likely to cause trouble with string searching, JS, TCL, or HTML
lbModeAlternate (string)	“round-robin”	“drop-packet”, “fallback-ip”, “global-availability”, “packet-rate”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Alternate Load Balancing mode
lbModeFallback (string)	“return-to-dns”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”, “none”	Fallback Load Balancing mode
lbModePreferred (string)	“round-robin”	“completion-rate”, “cpu”, “drop-packet”, “fallback-ip”, “fewest-hops”, “global-availability”, “kilobytes-per-second”, “least-connections”, “lowest-round-trip-time”, “packet-rate”, “quality-of-service”, “ratio”, “return-to-dns”, “round-robin”, “static-persistence”, “topology”, “virtual-server-capacity”, “virtual-server-score”	Preferred Load Balancing mode
manualResumeEnabled (boolean)	false	true, false	Specifies whether you must manually restart a pool member that goes down
maxAnswersReturned (integer)	1	[1, 500]	Specifies the maximum number of available virtual servers that the system lists in a response
members (array<GSLB_Pool_Member_MX>)			Specifies the members of this pool
monitors (array<Pointer_GSLB_Monitor>)			Specifies the health monitors the system uses to determine whether it can use this pool for load balancing
ppsLimit (integer)	0	[0, infinity]	The maximum allowable data transfer rate, in packets per second, for the virtual servers in the pool. If the network traffic volume exceeds this value, the system marks the pool as unavailable
ppsLimitEnabled (boolean)	false	true, false	Enables or disables the maximum Packets Per Second (PPS) option for this pool. The default value is false (disabled)
qosHitRatio (integer)	5	[0, infinity]	Assigns a weight to the Hit Ratio performance factor for the Quality of Service dynamic load balancing mode
qosHops (integer)	0	[0, infinity]	Assigns a weight to the Hops performance factor for the Quality of Service dynamic load balancing mode
qosKbps (integer)	3	[0, infinity]	Assigns a weight to the Kilobytes per Second performance factor for the Quality of Service dynamic load balancing mode
qosLinkCapacity (integer)	30	[0, infinity]	Assigns a weight to the Link Capacity performance factor for the Quality of Service dynamic load balancing mode
qosPacketRate (integer)	1	[0, infinity]	Assigns a weight to the Packet Rate performance factor for the Quality of Service dynamic load balancing mode
qosRoundTripTime (integer)	50	[0, infinity]	Assigns a weight to the Round Trip Time performance factor for the Quality of Service dynamic load balancing mode
qosTopology (integer)	0	[0, infinity]	Assigns a weight to the Topology performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerCapacity (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server performance factor for the Quality of Service dynamic load balancing mode
qosVirtualServerScore (integer)	0	[0, infinity]	Assigns a weight to the Virtual Server Score performance factor for the Quality of Service dynamic load balancing mode
remark (string)		regex: ^[^x00-x1fx22x5cx7f]*$	Arbitrary (brief) text pertaining to this object. Allows 0-64 chars, excluding only control characters, double-quote, and backslash. This is permissive enough that you should worry about XSS attacks
resourceRecordType (string)		“A”, “AAAA”, “CNAME”, “MX”, “NAPTR”	Specifies the type of resource records for this domain
ttl (integer)	30	[0, 4294967295]	Specifies the number of seconds the IP address, once found, is valid. Once the time-to-live (TTL) expires, the client has to request the IP address resolution again
verifyMemberEnabled (boolean)	true	true, false	Specifies the system verifies the availability of the pool members before sending a connection to those resources