Configure an outbound forward proxy¶

Use f5insight-forward-proxy to configure an outbound forward proxy for supported F5 Insight services.

Overview¶

The utility supports proxy configuration for these services:

openai
anthropic
insight-licensing (Insight JWT licensing)
bigip-licensing (BIG-IP reg-key activation in fleet-manager)

By default, set configures all four services. You can use --services to select specific services or all to select every known service.

Before you start¶

Run the commands from the F5 Insight host console or over Secure Shell (SSH).
Obtain the proxy URL, any required proxy certificate authority (CA) certificate, and the services that must use the proxy from your network team.
Confirm that the proxy allows connections from your F5 Insight host.

Show the current proxy configuration¶

Run show to display the current Helm release proxy values:

sudo /usr/local/bin/f5insight-forward-proxy show

Configure a proxy¶

Use set to configure the HTTPS proxy. The example below also configures the HTTP proxy to the same URL by default:

sudo /usr/local/bin/f5insight-forward-proxy set \
  --https-proxy http://192.0.2.1:3128

To use a different URL for HTTP traffic, specify --http-proxy:

sudo /usr/local/bin/f5insight-forward-proxy set \
  --https-proxy http://192.0.2.1:3128 \
  --http-proxy http://192.0.2.2:3128

To configure only selected services, provide a comma-separated list:

sudo /usr/local/bin/f5insight-forward-proxy set \
  --https-proxy http://192.0.2.1:3128 \
  --services insight-licensing,bigip-licensing

For a proxy that requires a CA certificate, provide the PEM content with --proxy-ca-pem or specify a file containing the PEM content with --proxy-ca-pem-file:

sudo /usr/local/bin/f5insight-forward-proxy set \
  --https-proxy http://192.0.2.1:3128 \
  --proxy-ca-pem-file /path/to/proxy-ca.pem

The utility prompts for confirmation before applying changes. Use --dry-run to run the Helm upgrade in dry-run mode. Use --yes to skip the confirmation prompt.

Important

Changes require workloads restart before they take effect.

Clear proxy settings¶

Run clear to clear global proxy values and disable the BIG-IP proxy:

sudo /usr/local/bin/f5insight-forward-proxy clear

Troubleshooting¶

If a service cannot connect after configuration, verify the proxy URL and confirm that the proxy permits connections from the F5 Insight host.
Test connectivity to the Insight licensing endpoint through the proxy with curl. Replace 192.0.2.1 with your proxy host or IP address:
```
curl -x http://192.0.2.1:3128 https://product.apis.f5.com/ee/v1/keys/jwks
```
If a service should bypass the proxy, include its host or address in --no-proxy.
If the proxy uses a certificate that the service does not trust, provide the proxy CA certificate with --proxy-ca-pem-file.
If you need to confirm the available options for your installed version, run:
```
sudo /usr/local/bin/f5insight-forward-proxy
```

Previous Next