Composing a declaration for licensing BIG-IP with a BIG-IQ¶

If you have an existing BIG-IQ device with a pool of F5 licenses (BIG-IQ License Manager), you can reference it from your BIG-IP Declarative Onboarding declaration in order to license your BIG-IP device.

To use this feature:

You must have an existing BIG-IQ device with a pool of BIG-IP VE licenses.
The license pool can only be a Registration Key pool, Purchased Pool, or a Utility (subscription/ELA) pool. See the BIG-IQ documentation for more detailed information on License pool types.
In the BIG-IQ UI, you must include a targetUsername and targetPassphrase. BIG-IQ is able to pass a target token through the API, but the BIG-IQ must also have the target username and passphrase in the body so the BIG-IQ can discover and import the BIG-IP device after the onboarding process.

Additionally, see JSON Pointers for information on using JSON/BIG-IP Declarative Onboarding pointers in your declaration.

See BIG-IQ examples for additional example declarations.

Note

See K54909607 for information on BIG-IQ and BIG-IP Declarative Onboarding compatibility.

Declaration class licensing with BIG-IQ¶

In this declaration snippet, we only include the License class, which is specific to using the BIG-IQ to license your BIG-IP system. For a complete declaration, you could add the License class to the example in Composing a BIG-IP Declarative Onboarding declaration for a standalone BIG-IP to configure DNS, NTP, VLANs, Routes and more. For the full BIG-IQ Licensing example declaration, see Licensing with BIG-IQ: Regkey Pool - Route to BIG-IP and Licensing with BIG-IQ: Utility Pool - Route to BIG-IP.

In the following snippet, we set reachable to true (reachable means the BIG-IQ has a route to the BIG-IP), therefore we include a BIG-IP username and password. We are also using a utility pool behind the scenes on BIG-IQ, so use SKU keywords and unit of measure. If reachable is false, you only specify the hypervisor (see the BIG-IQ examples for example declarations). And for a RegKey pool, you do not need the SKU keywords or the unit of measure (see the table and Licensing with BIG-IQ: Utility Pool - Route to BIG-IP for usage).

Tip

There may be additional properties available. Be sure to see the Appendix A: Schema Reference and Example Declarations for detailed information on each class and their associated properties.

 "myLicense": {
     "class": "License",
     "licenseType": "licensePool",
     "bigIqHost": "10.0.1.200",
     "bigIqUsername": "admin",
     "bigIqPassword": "myPassword1",
     "licensePool": "myPool",
     "skuKeyword1": "key1",
     "skuKeyword2": "key2",
     "unitOfMeasure": "hourly",
     "reachable": true,
     "bigIpUsername": "admin",
     "bigIpPassword": "asdfjkl"
 },

License class¶

The License class contains information about your BIG-IQ device. For BIG-IQ, the licenseType parameter must be licensePool.

Parameter	Options	Required?	Description/Notes
class	License	Yes	Indicates that this property contains licensing information
licenseType	licensePool	Yes	For BIG-IQ, you must specify licensePool. (For BIG-IP, you can use regKey for licenseType, see License class).
bigIqHost	string (IPv4/IPv6 address or hostname)	Yes	The IP address or hostname of the BIG-IQ device with the license pool.
bigIqUsername	string	Yes	An admin user on the BIG-IQ you specified in bigIqHost.
bigIqPassword	string	No	The password for your BIG-IQ device. If you do not want to include your BIG-IQ password in your declaration, use bigIqPasswordUri instead. NOTE Either bigIqPassword or bigIqPasswordUri is required.
bigIqPasswordUri	string (URI)	No	While not shown in the example above, you can use this property instead of bigIqPassword to specify the URI that will return the password for the username if you do not want to include the password in your declaration.
licensePool	string	Yes	Name of the BIG-IQ license pool on the target BIG-IQ from which to obtain a license.
skuKeyword1	string	No	The skuKeyword1 parameter for utility licensing (not necessary if using a registration key pool). See the BIG-IQ and utility licensing documentation for your BIG-IQ version to find information on SKU keywords.
skuKeyword2	string	No	The skuKeyword2 parameter for utility licensing (not necessary if using a registration key pool). See the BIG-IQ and utility licensing documentation for your BIG-IQ version to find information on SKU keywords.
unitOfMeasure	yearly, monthly, daily, hourly	No	The unit of measure used in utility licensing (not necessary if using a registration key pool). See the BIG-IQ and utility licensing documentation for your BIG-IQ version to find information on the units of measure.
reachable	true, false	No	Reachable specifies whether or not the BIG-IQ has a route to the BIG-IP device. If it does have a route (true), you must specify the BIG-IP username and password. If it does not (false) you must specify the hypervisor.
bigIpUsername	string	Yes*	If reachable = true, specify an admin user on the BIG-IP
bigIpPassword	string	Yes*	If reachable = true, specify the password for the BIG-IP username
hypervisor	aws, azure, gce, vmware, hyperv, kvm, xen	Yes**	If reachable = false, specify the hypervisor in which the BIG-IP is running

* Required if reachable = true only
** Required by BIG-IQ if reachable = false only

Again, for the full BIG-IQ Licensing example declaration, see Licensing with BIG-IQ: Regkey Pool - Route to BIG-IP and Licensing with BIG-IQ: Utility Pool - Route to BIG-IP.

See BIG-IQ examples for additional example declarations.

The ability to revoke a license using BIG-IP Declarative Onboarding is available in version 1.3.0 and later.

Revoking a license from a BIG-IP with BIG-IQ¶

If you are using BIG-IP Declarative Onboarding 1.3.0 or later, you can use a declaration to revoke a license from a BIG-IP VE that was issued from a BIG-IQ license pool, and optionally relicense the BIG-IP VE with a new license.

Important

If the BIG-IP is not reachable from the BIG-IQ (“reachable”: false), you must use overwrite if you want to relicense a BIG-IP VE (as the BIG-IP will not know the license was revoked).

To revoke a license, use the revokeFrom property in the License class as described in this section.

Revoking a license without relicensing¶

If you want to revoke a license from a BIG-IP and not supply a new license, you simply add the revokeFrom property with name of the license pool to the license class. For example "revokeFrom": "myPool".

So the entire license class might look like the following, which revokes the license from the BIG-IP VE, and leaves it in an unlicensed state.

"myLicense": {
         "class": "License",
         "licenseType": "licensePool",
         "bigIqHost": "10.0.1.200",
         "bigIqUsername": "admin",
         "bigIqPassword": "foofoo",
         "revokeFrom": "myPool",
         "reachable": false
     },

Revoking a license and relicensing a BIG-IP from a different license pool¶

If you want to revoke a license from a BIG-IP and give the BIG-IP a new license from a different license pool, you add the revokeFrom property with some additional information, depending on whether your BIG-IP VEs are reachable or not. There is one additional example if you are relicensing a BIG-IP VE using a new BIG-IQ device.

Relicensing a BIG-IP (with route)¶

If you want to relicense a BIG-IP VE that is reachable from the BIG-IQ device, in your reachable declaration you simply add the revokeFrom property with name of the license pool you want to revoke the license from (for example "revokeFrom": "myPool"). In the licensePool property, use the new license pool from which you want to give the BIG-IP a license.

So the entire license class might look like the following, which revokes the license from the BIG-IP VE from the myPool license pool and relicenses it using the myOtherPool license pool:

"myLicense": {
     "class": "License",
     "licenseType": "licensePool",
     "bigIqHost": "10.0.1.200",
     "bigIqUsername": "admin",
     "bigIqPassword": "foofoo",
     "licensePool": "myOtherPool",
     "revokeFrom": "myPool",
     "skuKeyword1": "key1",
     "skuKeyword2": "key2",
     "unitOfMeasure": "hourly",
     "reachable": true,
     "bigIpUsername": "admin",
     "bigIpPassword": "asdfjkl"
 },

Relicensing a BIG-IP (no route)¶

If you want to relicense a BIG-IP VE that is unreachable from the BIG-IQ device, in your unreachable declaration you must also use the overwrite property ("overwrite": true) in addition to the revokeFrom property with name of the license pool you want to revoke the license from (for example "revokeFrom": "myPool"). In the licensePool property, use the new license pool from which you want to give the BIG-IP a license.

New in BIG-IP DO 1.15
BIG-IP DO 1.15 adds the tenant property to the License class. This property allows you to specify an optional description for the license. This feature is useful in autoscale solutions managed by a BIG-IQ. The BIG-IP DO tenant property is prepended to the BIG-IQ tenant property. The BIG-IQ tenant property is management address,hostname by default, so when using the BIG-IP DO property, it becomes BIG-IP DO-tenant-property,management-address,hostname. This feature is only supported when reachable is false.

Important

The following declaration snippet has been updated to include the new Tenant property introduced in BIG-IP DO 1.15. If you attempt to use it on a version prior to 1.15, it will fail. To use the example on a previous version, delete the tenant property at the bottom.

So the entire license class might look like the following, which revokes the license from the BIG-IP VE from the myPool license pool and relicenses it using the myOtherPool license pool (while telling the BIG-IP VE to overwrite the existing license).

 "myLicense": {
         "class": "License",
         "licenseType": "licensePool",
         "bigIqHost": "10.0.1.200",
         "bigIqUsername": "admin",
         "bigIqPassword": "foofoo",
         "licensePool": "myOtherPool",
         "revokeFrom": "myPool",
         "skuKeyword1": "key1",
         "skuKeyword2": "key2",
         "unitOfMeasure": "hourly",
         "reachable": false,
         "hypervisor": "vmware",
         "overwrite": true,
         "tenant": "Optional custom descriptor"
     },

Relicensing a BIG-IP (no route) using a different BIG-IQ device¶

This section shows how to relicense a BIG-IP VE that is unreachable, AND you are using a different BIG-IQ device than the one you used to initially license the BIG-IP device. In this case, you also use the revokeFrom property, but you supply information about the BIG-IQ device you used to license the BIG-IP. You must also use the overwrite property ("overwrite": true) in addition to the revokeFrom property.

Important

For example, to revoke a license issued from the BIG-IQ at 10.0.2.200 and re-license with a license from the BIG-IQ at 10.0.1.200, the entire license class might look like the following:

 "myLicense": {
         "class": "License",
         "licenseType": "licensePool",
         "bigIqHost": "10.0.1.200",
         "bigIqUsername": "admin",
         "bigIqPassword": "foofoo",
         "licensePool": "myPool",
         "revokeFrom": {
             "bigIqHost": "10.0.2.200",
             "bigIqUsername": "admin",
             "bigIqPassword": "asdfjkl",
             "licensePool": "myPool",
             "reachable": false
         },
         "skuKeyword1": "key1",
         "skuKeyword2": "key2",
         "unitOfMeasure": "hourly",
         "reachable": false,
         "hypervisor": "vmware",
         "overwrite": true,
         "tenant": "Optional custom descriptor"
     },

This revokes the license from the BIG-IP VE from the myPool license pool from the initial BIG-IQ device, and relicenses it using the myPool license pool on the new BIG-IQ device on which you are composing this declaration (while telling the BIG-IP VE to overwrite the existing license).

Previous Next