BIG-IP integration

API Security Local Edition is integrated with BIG-IP through a logging configuration that exports HTTP metadata to the product’s Collector. Optionally, the product can be granted management connectivity to BIG-IP to enable enforcement actions.

Prerequisites

Before configuring the integration, verify the following:

  • An existing API Virtual Server is configured on BIG-IP and is the target for discovery.

  • Network connectivity exists from BIG-IP to the API Security Collector on TCP 6514.

  • A serverssl profile is available for the Internal Logging Virtual Server (recommended for encrypted logging).

  • Management connectivity from API Security to BIG-IP on TCP 443 is permitted (required only if enforcement actions are intended).

Configure using automated BIG-IP integration

This is the primary method for configuring the integration.

  1. Navigate to Manage > BIG-IPs.

F5 Distributed Cloud Console

Figure 4. The BIG-IPs page lists registered devices with their discovery and management connectivity status.

  1. Click Add BIG-IP. Enter the BIG-IP connection details: * IP address * Port (default 443) * Username and Password. The Name is read automatically from the device hostname.

Connection Details

Figure 5. The Add BIG-IP dialog. The device name is resolved automatically from the connection details.

  1. Click Add BIG-IP. The product connects to the device and pulls its configuration.

  2. For a registered device, click Connect to open the configuration wizard. The wizard shows device settings status (internal log TLS VS, log profile, iRules, pools) and the auto-selected internal log TLS IP.

  3. Set the API Security Collector host and port (default 6514).

  4. Click Apply device settings. Under Virtual servers, the wizard lists the scanned virtual servers.

  5. For each virtual server, select the API Security mode: * None — no discovery on this virtual server * API Security — standard passive API discovery * Advanced API Security — enriched discovery using BIG-IP Advanced WAF/ASM (the optional enrichment layer)

Connect Configuration to BIG-IP

Figure 6. The configuration wizard shows device settings status and per-virtual-server mode selection.

  1. Click Done to apply.

Important

Manual BIG-IP configuration is required in some cases. For example, when Advanced API Security conflicts with an existing WAF policy already applied to a virtual server, the automated configuration may not apply and a notification is shown. For manual configuration steps, see References > Manual BIG-IP Integration Guide.

Validate the integration

After completing the configuration steps:

  1. Generate or wait for traffic to the API Virtual Server on BIG-IP.

  2. In the API Security user interface, go to the dashboard and confirm that ingestion counters increase.

  3. Confirm that endpoints begin to appear after the first analysis cycle completes.

If ingestion does not occur, see Troubleshooting.

Enforcement and known limitations

When a user triggers a block from the user interface, the product calls the BIG-IP iControl REST API to update the relevant WAF policy. BIG-IP then enforces the block.

For enforcement to function correctly, ensure that the Web Application Firewall (WAF) policy on BIG-IP is configured to differentiate between HTTP and HTTPS schemes. If scheme differentiation is not configured, the policy update will fail to apply. For full details, see Known issues in the API Security Local Edition Release Notes.