Configure F5 Insight Lite

Overview

This guide provides step-by-step instructions for configuring F5 Insight Lite, from initial VM deployment through AIDF integration, device configuration, and optional upgrade to Full mode.

F5 Insight Lite is a lightweight deployment mode that forwards telemetry data directly to the F5 AI Data Fabric (AIDF) without local storage. You can optionally upgrade it to Full mode with a valid license.

Prerequisites

  • Access to an OpenStack (or equivalent cloud) environment for VM deployment.
  • The F5 Insight VM image (f5insight-<version>) is available in your cloud environment.
  • Network connectivity between the VM and the AIDF endpoint is established.
  • AIDF credentials (Sensor ID and Sensor Key) are available from the AIDF portal.
  • (For device configuration) CA certificate in PEM format and BIG-IP device management credentials are available.

Base URL and credentials

Base URL http://<lite_vm_ip>
Default Username admin
Default Password admin

Boot the VM in Lite mode

Boot the VM with a cloud-init user-data file that sets the deployment mode to lite. You pass this file to the VM at creation time through the cloud platform’s user-data field.

Create the cloud-init file

Create a file named test-lite-mode-cloudinit.yaml with the following content:

#cloud-config
users:
  - name: admin
    lock_passwd: false
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    groups: sudo

chpasswd:
  expire: false
  users:
    - name: admin
      password: admin
      type: text

# F5 Insight deployment configuration
f5_insight:
  deployment_mode: "lite"
Parameter Value Description
f5_insight.deployment_mode "lite" Configures the F5 Insight init system to boot in Lite mode instead of Full mode
users[].name admin Local admin user created on first boot
chpasswd.users[].password admin Initial password (change after first login)

Launch the VM

Base64-encode the cloud-init file and pass it as user_data when booting the VM.

# Base64-encode the cloud-init file
USER_DATA=$(base64 -w 0 test-lite-mode-cloudinit.yaml)

# Boot the VM (OpenStack example)
openstack server create \
  --image f5insight-<version> \
  --flavor F5-BIGIQ-small \
  --network <network-id> \
  --user-data test-lite-mode-cloudinit.yaml \
  f5insight-lite-<pipeline_id>

Once the VM status is ACTIVE, allow 5 to 10 minutes for k3s and all pods to initialize before proceeding to the next step.

After the VM boots, the onboarding welcome screen appears:

F5 Insight Lite onboarding welcome screen

The F5 Insight Lite onboarding welcome screen.

Use the web console

This section walks through the F5 Insight Lite onboarding and configuration using the web console. Follow the screens in order after the VM has booted and the onboarding welcome screen appears.

Select the license type

On the onboarding welcome screen, select Next and then select the license type from the dropdown.

  1. On the license type selection screen, select Insight -Lite.
  2. Select Next to proceed.
F5 Insight Lite license type selection screen

Select Insight -Lite as the license type.

Configure AIDF integration

Use the AIDF integration screen to connect F5 Insight Lite to the F5 AI Data Fabric for telemetry forwarding.

  1. On AIDF configuration screen, enable the AIDF integration with the toggle button.

  2. Enter the AIDF endpoint URL, Sensor ID, and Sensor Token.

  3. Select the telemetry types to forward (see below).

  4. Select Test Connection to verify connectivity.

    F5 Insight Lite enable AIDF configuration screen

  5. Select Next to proceed. The AIDF integration configuration screen appears.

    F5 Insight Lite AIDF onboarding configuration screen
The AIDF integration configuration screen

For detailed AIDF configuration instructions, see Configure F5 AI Data Fabric.

Telemetry types

When configuring AIDF, select the telemetry types you want to forward:

Telemetry type Description
Application Telemetry When enabled, exports BIG-IP metrics, SSL Orchestrator logs, and iRule application telemetry to AIDF.
API Discovery When enabled, exports API discovery logs to AIDF for API visibility and analysis.

Note

Both telemetry types are new in this release. You can enable one or both depending on your monitoring requirements.

Add BIG-IP devices

Use the device onboarding screen to add BIG-IP devices to F5 Insight Lite.

F5 Insight Lite add device onboarding screen

The device onboarding screen for adding BIG-IP devices.

To add a BIG-IP device, follow the instructions in Add BIG-IP devices.

Note

The device addition workflow is the same for both Lite and Full modes.

Verify the Lite mode homepage

After completing the onboarding steps, the F5 Insight Lite homepage appears. This page shows the added devices and their operational health status.

F5 Insight Lite homepage

The F5 Insight Lite homepage showing added devices and operational status.

Upgrade to Full mode (optional)

If you want to switch from Lite mode to Full mode, you must license the appliance with a Full mode license.

Note

This step is optional. Skip this section if you want to remain in Lite mode.

  1. In the left sidebar, select License.

  2. The current license information appears.

    F5 Insight Lite license information screen

    The license information screen showing current Lite mode license details.

  3. Select Edit License.

  4. On the license setup screen, change the license type to F5 Insight (Full mode).

    F5 Insight Lite upgrade license setup screen

    The license setup screen. Select the Full mode license type and enter your license JWT.

  5. Paste your Full mode license JWT token.

  6. Select Upgrade.

    F5 Insight Lite edit license upgrade screen

    The edit license screen for completing the upgrade to Full mode.

  7. A resource requirements warning appears. Make sure the appliance meets the minimum requirements of 12 vCPU and 16 GB RAM before proceeding. For more information, see Host platform requirements.

    Note

    The warning might display a minimum requirement of 4 vCPU and 8 GB RAM. This is a known issue. The correct minimum requirements are 12 vCPU and 16 GB RAM.

    F5 Insight Lite resources warning during upgrade

    The resources warning appears during the upgrade to Full mode.

  8. Confirm the upgrade to proceed.

  9. Wait for the mode switch to complete. The appliance restarts services during this process.

  10. After the upgrade completes, the F5 Insight Full mode homepage appears.

Important

Make sure the appliance meets the minimum hardware requirements (4 vCPU, 8 GB RAM) before upgrading to Full mode. The upgrade will fail if resources are insufficient.

Use the REST API

This section covers the same configuration steps using the F5 Insight REST API. Use this approach for automation or when the web console is not accessible.

Important

All API calls require the following header:

Authorization: Bearer <access_token>

Obtain an access token by logging in first (see Log in).

Log in

Authenticate as the admin user to obtain a JWT access token.

Request

POST /api/auth/login
Content-Type: application/json

{
  "username": "admin",
  "password": "admin"
}

Response (200 OK)

{
  "access_token": "eyJhbGci...",
  "token_type": "Bearer",
  "expires_in": 900
}

Save the access_token. The token is valid for 900 seconds (15 minutes). The refresh token is set as an httpOnly cookie automatically.

Tip

To verify that invalid credentials are rejected, attempt login with an incorrect password. The API should return a non-200 error response.

Verify Lite mode

Confirm the system is running in Lite mode before proceeding with configuration.

Request

GET /api/system/mode/capabilities
Authorization: Bearer <access_token>

Response (200 OK)

{
  "current_mode": "lite",
  "message": "System is running in lite mode"
}

Verify that current_mode is "lite".

Warning

If current_mode returns "full", the cloud-init configuration was not applied successfully. Re-deploy the VM with the correct cloud-init file before proceeding.

Enable telemetry types

Enable the telemetry data types that F5 Insight Lite will forward to AIDF. You can enable any combination of the supported types.

Supported telemetry types

Type Description
API_Discovery API discovery telemetry from iRule
Application_Telemetry Application performance telemetry

Request

PUT /api/telemetry/types
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "enabled_types": [
    "Application_Telemetry",
    "API_Discovery"
  ]
}

Response (200 OK)

{
  "status": "update_successful"
}

This triggers an OTEL configuration reload. The OTEL pod restarts briefly during this process.

Note

To disable all telemetry types, pass an empty array: "enabled_types": [].

Verify telemetry types

Confirm each telemetry type was saved correctly by querying individual configurations.

Request

GET /api/telemetry/types/API_Discovery
Authorization: Bearer <access_token>

GET /api/telemetry/types/Application_Telemetry
Authorization: Bearer <access_token>

Response (200 OK) - example for API_Discovery

{
  "name": "API_Discovery",
  "enabled": true,
  "description": "API discovery telemetry from iRule",
  "updated_at": "2026-07-08T10:00:00Z"
}

Verify that enabled is true for each configured type.

Configure AIDF integration

Connect F5 Insight Lite to the AI Data Fabric (AIDF) endpoint to enable telemetry forwarding.

Request

POST /api/ai-integrations/aidf
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "endpoint": "https://<aidf-endpoint>:443",
  "tenant_id": "<sensor-id>",
  "tenant_token": "<sensor-key>",
  "data_types": ["logs", "metrics"]
}

Parameters

Parameter Required Description
endpoint Yes AIDF endpoint URL
tenant_id Yes Tenant / Sensor ID obtained from the AIDF portal
tenant_token Yes Sensor authentication token (write-only; never returned on GET)
data_types No Data to forward: logs, metrics, or both. Defaults to both if omitted.

Response (200 OK)

{
  "status": "success"
}

Verify AIDF configuration

Read back the saved AIDF configuration to confirm it was stored correctly.

Request

GET /api/ai-integrations/aidf
Authorization: Bearer <access_token>

Response (200 OK)

{
  "endpoint": "https://<aidf-endpoint>:443",
  "tenant_id": "<sensor-id>",
  "data_types": ["logs", "metrics"]
}

Note

  • The tenant_token is omitted from the GET response as it is a write-only secret.
  • A 204 No Content response indicates no AIDF configuration has been saved yet.

Verify AIDF reachability (optional)

GET /api/health/aidf
Authorization: Bearer <access_token>

Returns 200 OK if AIDF is reachable and healthy.

Upload CA certificate to trust store

Upload a Certificate Authority (CA) certificate to the F5 Insight trust store. This certificate is used to establish trusted TLS connections with BIG-IP devices.

Prerequisites

  • The CA certificate file must be in PEM format.
  • The certificate must be the CA that signed the BIG-IP device certificates, or a root/intermediate CA in the trust chain.

Request

POST /api/device-management/trust-store
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "name": "corporate-ca",
  "certificate": "-----BEGIN CERTIFICATE-----\nMIIDxTCCAq2gAwIBAgIU...\n-----END CERTIFICATE-----",
  "description": "Corporate root CA certificate for BIG-IP device trust"
}

Parameters

Parameter Required Description
name Yes A descriptive name for the certificate entry in the trust store.
certificate Yes The CA certificate content in PEM format. Include the full certificate including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers.
description No Optional description for the certificate entry.

Response (201 Created)

{
  "id": "cert-a1b2c3d4",
  "name": "corporate-ca",
  "status": "active",
  "created_at": "2026-07-08T10:10:00Z"
}

Verify trust store

GET /api/device-management/trust-store
Authorization: Bearer <access_token>

{
  "certificates": [
    {
      "id": "cert-a1b2c3d4",
      "name": "corporate-ca",
      "status": "active",
      "subject": "CN=Corporate Root CA",
      "issuer": "CN=Corporate Root CA",
      "valid_from": "2024-01-01T00:00:00Z",
      "valid_to": "2034-01-01T00:00:00Z",
      "created_at": "2026-07-08T10:10:00Z"
    }
  ]
}

Important

Make sure the uploaded CA certificate is valid and not expired. BIG-IP device connections will fail if the trust chain cannot be verified.

Add data center

Define data centers to logically group and organize BIG-IP devices by location or environment.

Request

POST /api/device-management/data-centers
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "name": "us-east-dc1",
  "location": "US East - Virginia",
  "description": "Primary data center for US East region"
}

Parameters

Parameter Required Description
name Yes A unique name for the data center.
location No Physical or logical location of the data center.
description No Optional description for the data center.

Response (201 Created)

{
  "id": "dc-e5f6g7h8",
  "name": "us-east-dc1",
  "location": "US East - Virginia",
  "description": "Primary data center for US East region",
  "device_count": 0,
  "created_at": "2026-07-08T10:15:00Z"
}

Verify data centers

GET /api/device-management/data-centers
Authorization: Bearer <access_token>

{
  "data_centers": [
    {
      "id": "dc-e5f6g7h8",
      "name": "us-east-dc1",
      "location": "US East - Virginia",
      "description": "Primary data center for US East region",
      "device_count": 0,
      "created_at": "2026-07-08T10:15:00Z"
    }
  ]
}

Validate BIG-IP device connectivity

Before onboarding a BIG-IP device, validate that F5 Insight can establish a connection to the device using the provided credentials.

Request

POST /api/device-management/devices/connection/validate
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "host": "10.1.1.100",
  "port": 443,
  "username": "admin",
  "password": "<bigip-password>",
  "data_center_id": "dc-e5f6g7h8"
}

Parameters

Parameter Required Description
host Yes BIG-IP management IP address or hostname.
port No Management port. Default: 443.
username Yes BIG-IP administrator username.
password Yes BIG-IP administrator password.
data_center_id No ID of the data center to associate the device with.

Response (200 OK)

{
  "status": "success",
  "message": "Connection to BIG-IP validated successfully",
  "device_info": {
    "hostname": "bigip-east-01.example.com",
    "version": "17.1.1",
    "platform": "BIG-IP",
    "serial_number": "f5-XXXX-XXXX"
  }
}

Response (400 Bad Request)

{
  "status": "failed",
  "message": "Unable to connect to BIG-IP device",
  "error": "Connection timed out after 30 seconds"
}

Troubleshooting connection failures

Issue Resolution
Connection timed out Verify network connectivity between F5 Insight and the BIG-IP management IP. Make sure port 443 is open.
Authentication failed Verify the BIG-IP username and password are correct. Make sure the account has administrator privileges.
TLS certificate error Make sure the BIG-IP device certificate is signed by a CA uploaded to the F5 Insight trust store (see Upload CA certificate to trust store).
Device not reachable Verify the BIG-IP management IP is correct and the device is powered on and accessible.

Tip

After validating device connectivity, you can onboard BIG-IP devices by sending a POST request to /api/device-management/devices with the device details. Refer to the F5 Insight API Documentation for the full device onboarding workflow.

Upgrade to Full mode (optional)

Note

This step is optional. Skip this section if you want to remain in Lite mode.

To upgrade F5 Insight from Lite to Full mode, complete the following sub-steps:

  1. Activate a Full mode license.
  2. Submit a mode switch request.
  3. Poll the mode switch task status.
  4. Confirm Full mode is active.

Activate license

Request

POST /api/license/activate
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "jwt": "<full-mode-license-jwt>",
  "modeOfOperation": "connected",
  "digitalAssetName": "nms",
  "digitalAssetVersion": "1.0.0"
}

Parameters

Parameter Required Description
jwt Yes License JWT (must be a Full mode license)
modeOfOperation Yes connected or disconnected
digitalAssetName No Asset name, for example, nms
digitalAssetVersion No Asset version, for example, 1.0.0

Response (200 OK)

{
  "status": "success",
  "message": "License activated successfully"
}

Important

License activation triggers an automatic backend pod restart. Wait for the backend to become available before proceeding. Poll POST /api/auth/login until it returns 200 OK (allow up to 8 minutes).

Submit mode switch request

Request

POST /api/system/mode
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "target_mode": "full"
}

Response (202 Accepted)

{
  "task_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "submitted",
  "target_mode": "full"
}

Save the task_id for the next step.

Poll mode switch task status

Poll every 10 seconds until the task completes. Maximum wait time: 10 minutes.

Request

GET /api/system/mode/status/<task_id>
Authorization: Bearer <access_token>

Response - In progress

{
  "task_id": "a1b2c3d4-...",
  "state": "RUNNING",
  "status": "Deploying full-mode services",
  "progress": 45,
  "target_mode": "full"
}

Response - Complete

{
  "task_id": "a1b2c3d4-...",
  "state": "COMPLETE",
  "status": "Mode switch completed successfully",
  "progress": 100,
  "target_mode": "full"
}

Task state reference

State Description
RUNNING In progress; continue polling
COMPLETE Finished successfully
FAILED Failed; check the error_message field for details

Confirm Full mode

Request

GET /api/system/mode/capabilities
Authorization: Bearer <access_token>

Expected response (200 OK)

{
  "current_mode": "full",
  "message": "System is running in full mode"
}

Verify that current_mode is "full".

Log out

Request

POST /api/auth/logout
Authorization: Bearer <access_token>

Response (200 OK)

{
  "message": "Logged out successfully"
}

Note

  • The access token remains valid until it expires (900 seconds).
  • The refresh token stored in the httpOnly cookie is revoked immediately upon logout.

Configuration summary

Step Description Method Endpoint / Resource
1 Boot VM with Lite cloud-init
test-lite-mode-cloudinit.yaml + OpenStack
2 Log in POST /api/auth/login
3 Verify Lite mode GET /api/system/mode/capabilities
4 Enable telemetry types PUT /api/telemetry/types
5 Verify telemetry types GET /api/telemetry/types/{type}
6 Configure AIDF integration POST /api/ai-integrations/aidf
7 Verify AIDF configuration GET /api/ai-integrations/aidf
8a Upload CA certificate to trust store POST /api/device-management/trust-store
8b Add data center POST /api/device-management/data-centers
8c Validate BIG-IP device connectivity POST /api/device-management/devices/connection/validate
9a Activate Full mode license POST /api/license/activate
9b Submit mode switch to Full POST /api/system/mode
9c Poll mode switch task status GET /api/system/mode/status/{task_id}
9d Confirm Full mode GET /api/system/mode/capabilities
10 Log out POST /api/auth/logout