Deploy F5 Insight services on AWS EC2

This guide walks you through building an Amazon Machine Image (AMI) from the F5 Insight Open Virtual Appliance (OVA) image and deploying it as an Elastic Compute Cloud (EC2) instance on Amazon Web Services (AWS).

Note

KVM and VMware ESXi deployment patterns are documented and tested.

F5 supports AWS deployments where the deployment meets documented F5 Insight requirements.

This approach also applies to KVM-based platforms such as Nutanix that are expected to meet the documented KVM requirements, although platform-specific configurations may not have been independently validated by F5. Where relevant to troubleshooting, F5 may ask whether verification of an issue on a documented Proxmox or OpenStack KVM deployment is possible.

F5 has not formally qualified the AWS deployment pattern.

If an issue appears specific to the underlying cloud platform or hypervisor, F5 may require engagement with the platform vendor and may request additional validation on a documented KVM or VMware ESXi deployment.

Platform-specific qualification, compatibility assurances, and feature guarantees apply only where explicitly documented.

Overview

F5 Insight Services is a comprehensive monitoring and analytics platform designed specifically for F5 BIG-IP devices. It delivers powerful capabilities to help you manage and optimize your infrastructure:

Benefits and key features

  • Real-time device monitoring: Continuously monitors F5 BIG-IP devices at configurable intervals
  • AI-powered insights: Leverages artificial intelligence to analyze metrics and provide intelligent recommendations
  • Advanced data pipeline: Built on OpenTelemetry with Prometheus for metrics collection and ClickHouse for high-performance data storage
  • Modern UI: Features a React-based dashboard with customizable visualizations
  • External Grafana integration: Seamlessly integrates with external Grafana instances for advanced dashboards and analytics

By following this guide, you will build a custom Amazon Machine Image (AMI) from the F5 Insight OVA and launch it as an EC2 instance, giving you immediate access to powerful monitoring and analytics capabilities for your F5 BIG-IP environment.

Prerequisites

Before you begin, ensure you have the following requirements in place:

AWS account and environment specifications

Specification Requirement
AWS account An AWS account with permissions to create S3 objects, EC2 snapshots and AMIs, and EC2 instances
AWS CLI AWS CLI v2 installed and configured (aws configure), or access to AWS CloudShell in the console
jq Required by the helper script used to automate AMI creation
S3 bucket An existing S3 bucket in your target region to stage the OVA during import
VPC and subnet An existing VPC and subnet with connectivity to your BIG-IP devices
vmimport role The vmimport IAM service role configured in the target account (required by ec2:ImportSnapshot)

Required IAM permissions

Your IAM user or role needs permissions for the following actions:

Service Actions required
S3 s3:PutObject, s3:GetObject, s3:DeleteObject, s3:HeadObject
EC2 (import) ec2:ImportSnapshot, ec2:DescribeImportSnapshotTasks, ec2:RegisterImage, ec2:DescribeImages
EC2 (launch) ec2:RunInstances, ec2:DescribeInstances, ec2:CreateSecurityGroup, ec2:AuthorizeSecurityGroupIngress, ec2:AllocateAddress, ec2:AssociateAddress

Note

EC2 image import also requires a service role named vmimport in the target account. See the VM Import/Export prerequisites for details on creating this role.

Minimum hardware requirements (F5 Insight instance)

Resource Minimum specification Sizing / planning notes
CPU 12 vCPUs 8 vCPUs are dedicated to analytics and data processing workloads. An additional 4 vCPUs are allocated for BIG-IP management functions such as upgrades, patching, and maintenance.
CPU scalability +6 vCPUs per additional 50 BIG-IP instances The base 12 vCPU allocation supports approximately 50 BIG-IP instances. Add 6 vCPUs for every additional 50 BIG-IP instances to maintain analytics and management performance.
Memory 16 GB RAM Standard minimum memory requirement for F5 Insight deployment and operation.
Memory scalability +4 GB RAM per additional 50 BIG-IP instances The base 16 GB RAM allocation supports approximately 50 BIG-IP instances. Add 4 GB RAM for every additional 50 BIG-IP instances to accommodate increased analytics workload and data processing requirements.
Disk storage 650 GB total Includes 500 GB for the initial F5 Insight installation and 150 GB for the operating system, upgrades, and updates.
Storage scalability +500 GB per additional 50 BIG-IP instances The initial 500 GB allocation supports approximately 50 BIG-IP instances. Plan for an additional 500 GB of storage capacity for every subsequent group of 50 BIG-IP instances.

Choose an EC2 instance type that provides at least these resources.

Network requirements

Confirm the following network connectivity:

Category Requirement / Rule Direction
External access Connectivity from F5 Insight to product.apis.f5.com:443 for “connected” license activation and updates (optional if using disconnected mode licensing). See Licensing and entitlement for disconnected mode licensing for environments that do not allow outbound internet access. Outbound
External access Connectivity from F5 Insight to us.edge.df.f5.com:443 and use1.connector.df.f5.com:443 for F5 AI Data Fabric (AIDF) (optional). Outbound
External access Connectivity from F5 Insight to an OpenAI-compatible or Anthropic server for large language model (LLM) insights (optional). Outbound
Internal access Connectivity from F5 Insight to BIG-IP devices. Outbound
Internal access Connectivity from F5 Insight to an OpenAI-compatible server for LLM insights (optional). Outbound
Security group (SSH) Port 22 Inbound to F5 Insight
Security group (HTTPS) Port 443 Inbound to F5 Insight
Security group (management) Port 443 Outbound to BIG-IP management port

Access requirements

  • Valid my.f5.com credentials
  • AWS console or CLI credentials with the IAM permissions listed above
  • Admin credentials for your BIG-IP device

Architecture overview

F5 Insight operates as a collection of containerized microservices orchestrated by K3s, a lightweight Kubernetes distribution running on Ubuntu.

Key components

Kubernetes platform:

  • K3s — Lightweight Kubernetes distribution (automatically installed).
  • Helm — Package manager for Kubernetes (pre-installed).

Application services:

  • Container images — All service images are pre-loaded during image build.
  • Persistent storage — F5 Insight stores data in persistent storage.

Download the F5 Insight OVA image

AWS does not have a published F5 Insight AMI. You build your own AMI by importing the F5 Insight OVA.

Steps to obtain the OVA:

  1. Navigate to my.f5.com and enter your credentials
  2. Scroll down to the bottom of the page and choose f5insight-<version>.ova
  3. Save the file to a location accessible from your workstation

Import the OVA into AWS as an AMI

Building an AMI from the OVA is a three-stage pipeline: upload the OVA to an S3 staging bucket, import it as an EBS snapshot, and register the snapshot as an AMI with UEFI boot mode.

Important

Use the ImportSnapshot workflow in this guide. Do not use ImportImage to import the OVA. AWS modifies the file system and adds drivers when ImportImage processes a VM. The ImportSnapshot workflow avoids these programmatic modifications.

Note

ec2:ImportSnapshot and ec2:RegisterImage have no dedicated page in the AWS Management Console. If you don’t have the AWS CLI installed locally, open AWS CloudShell from the top navigation bar of the AWS Console and run the same commands there. You can still use the S3 console to upload the OVA if you prefer a UI for that step.

Using the AWS CLI

  1. Upload the OVA to your S3 staging bucket:

    aws s3 cp f5insight-<VERSION>.ova s3://<BUCKET_NAME>/f5insight-<VERSION>.ova --region <REGION>

  2. Import the uploaded OVA as an EBS snapshot:

    aws ec2 import-snapshot \
  --region <REGION> \
  --description "f5insight-<VERSION>.ova" \
  --disk-container '{
    "Description": "f5insight-<VERSION>.ova",
    "Format": "OVA",
    "UserBucket": {
      "S3Bucket": "<BUCKET_NAME>",
      "S3Key": "f5insight-<VERSION>.ova"
    }
  }'

    Note the ImportTaskId returned in the response.

  3. Poll the import task until it completes:

    aws ec2 describe-import-snapshot-tasks \
  --region <REGION> \
  --import-task-ids <IMPORT_TASK_ID>

    Repeat until Status shows completed, then note the resulting SnapshotId. The import can take several minutes depending on the size of the OVA.

  4. Register the snapshot as an AMI with UEFI boot mode:

    aws ec2 register-image \
  --region <REGION> \
  --name "f5-insight" \
  --description "f5insight-<VERSION>.ova" \
  --root-device-name "/dev/sda1" \
  --block-device-mappings '[{
    "DeviceName": "/dev/sda1",
    "Ebs": {
      "DeleteOnTermination": true,
      "SnapshotId": "<SNAPSHOT_ID>",
      "VolumeType": "gp3",
      "Iops": 3000,
      "Throughput": 125
    }
  }]' \
  --ena-support \
  --sriov-net-support "simple" \
  --virtualization-type "hvm" \
  --imds-support "v2.0" \
  --boot-mode "uefi"

    Note the resulting ImageId; you use this AMI ID to launch the EC2 instance.

Using the helper script

The steps above are automated by a helper script that performs the S3 upload, snapshot import, and AMI registration in a single command:

Download the create-ami.sh helper script

chmod +x create-ami.sh
./create-ami.sh --disk-image f5insight-<VERSION>.ova --bucket-name <BUCKET_NAME> --region <REGION>

The script requires the AWS CLI v2 and jq, and always registers the AMI with UEFI boot mode.

Set up networking

Create a security group that allows inbound SSH and HTTPS traffic to the F5 Insight instance.

Using the AWS Management Console

  1. Open the EC2 console and select Security Groups, then select Create security group
  2. Enter a Security group name (for example, f5-insight-sg) and select your VPC
  3. Add inbound rules:
    1. Type SSH, port 22, source restricted to your management network
    2. Type HTTPS, port 443, source restricted to your management network
  4. Select Create security group

Using the AWS CLI

aws ec2 create-security-group \
  --region <REGION> \
  --group-name f5-insight-sg \
  --description "F5 Insight security group" \
  --vpc-id <VPC_ID>

aws ec2 authorize-security-group-ingress \
  --region <REGION> \
  --group-id <SECURITY_GROUP_ID> \
  --protocol tcp --port 22 --cidr <MANAGEMENT_CIDR>

aws ec2 authorize-security-group-ingress \
  --region <REGION> \
  --group-id <SECURITY_GROUP_ID> \
  --protocol tcp --port 443 --cidr <MANAGEMENT_CIDR>

Configure cloud-init user data

F5 Insight uses cloud-init for initial provisioning. Create a local cloud-config.yml file with the initial admin password:

#cloud-config
chpasswd:
  expire: true
  users:
    - name: admin
      # in this example the user would be required to change password after first login
      # password requirements: https://clouddocs.f5.com/products/insight/latest/get_started/get_started.html#password-requirements
      password: "F5ChangeM3"
      type: text

Important

Do not remove #cloud-config from the top of the file. This line is required for cloud-init to recognize the payload.

Note

Unlike VMware guestinfo, EC2 user data accepts the plain-text #cloud-config payload directly — no Base64 encoding is required.

Launch the EC2 instance from the AMI

Using the AWS Management Console

  1. Open the EC2 console and select Launch instance
  2. Under Application and OS Images, select the My AMIs tab and choose the AMI you registered
  3. Choose an Instance type that meets the minimum hardware requirements
  4. Under Key pair, select an existing key pair or create a new one
  5. Under Network settings, select your VPC, subnet, and the security group you created, and enable Auto-assign public IP if you need direct internet access
  6. Under Configure storage, set the root volume size to at least 650 GiB
  7. Expand Advanced details and paste the contents of cloud-config.yml into User data
  8. Select Launch instance

Using the AWS CLI

aws ec2 run-instances \
  --region <REGION> \
  --image-id <AMI_ID> \
  --instance-type <INSTANCE_TYPE> \
  --key-name <KEY_PAIR_NAME> \
  --security-group-ids <SECURITY_GROUP_ID> \
  --subnet-id <SUBNET_ID> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":650,"VolumeType":"gp3"}}]' \
  --user-data file://cloud-config.yml \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=f5-insight-01}]'

Allocate and associate an Elastic IP

If the instance doesn’t have a public IP, allocate and associate an Elastic IP to reach it from outside the VPC.

Using the AWS Management Console

  1. Open the EC2 console and select Elastic IPs, then select Allocate Elastic IP address
  2. Select Allocate
  3. Select the new address, choose Actions > Associate Elastic IP address, and select the F5 Insight instance
  4. Select Associate

Using the AWS CLI

ALLOCATION_ID=$(aws ec2 allocate-address --region <REGION> --query AllocationId --output text)

aws ec2 associate-address \
  --region <REGION> \
  --instance-id <INSTANCE_ID> \
  --allocation-id "$ALLOCATION_ID"

Initial instance configuration

  1. Wait for first boot to complete.

    The F5 Insight instance runs an automated first-boot setup script that:

    1. Initializes the K3s cluster.
    2. Deploys all services through Helm.
    3. Configures persistent storage.
    4. Sets up secrets and certificates.

    This process takes approximately five to 10 minutes.

    Monitor the first boot progress:

    # SSH into the instance (use the public IP or Elastic IP)
ssh -i <KEY_PAIR>.pem admin@<INSTANCE_IP>

# Watch the first boot logs
sudo tail -f /opt/f5insight/logs/f5insight-startup.log

# Check systemd service status
sudo systemctl status f5insight-first-boot.service

# When complete, you should see:
# f5insight-first-boot.service - F5 Insight First Boot Setup
# Loaded: loaded (/etc/systemd/system/f5insight-first-boot.service; enabled)
# Active: inactive (dead) since ...

  2. Verify services are running.

    # Check K3s status
sudo systemctl status k3s

# Check all pods in f5-insight namespace
sudo kubectl get pods -n f5-insight

# Expected output (all pods should be Running or Completed):
# NAME                              READY   STATUS      RESTARTS   AGE
# backend-xxxx                      2/2     Running     0          45s
# cacher-xxxx                       2/2     Running     0          45s
# clickhouse-0                      2/2     Running     0          44s
# f5-insight-node-exporter-xxxx     2/2     Running     0          45s
# f5-insight-postgres-0             2/2     Running     0          44s
# f5-insight-postgres-init-xxxx     0/1     Completed   0          44s
# f5-insight-vault-0                3/3     Running     0          44s
# frontend-xxxx                     2/2     Running     0          45s
# otel-collector-xxxx               2/2     Running     0          45s
# system-manager-xxxx               2/2     Running     0          45s
# victoriametrics-0                 2/2     Running     0          44s
# vmagent-xxxx                      2/2     Running     0          45s
# vmalert-xxxx                      2/2     Running     0          45s

# Check services
sudo kubectl get svc -n f5-insight

  3. Verify network connectivity.

    # Test external connectivity
curl -I https://www.google.com

# Check if the instance can reach your BIG-IP devices
ping <BIGIP_IP_ADDRESS>
telnet <BIGIP_IP_ADDRESS> 443

Access F5 Insight Services

Once the instance is fully initialized, you can access the following services.

Web interface:

Service URL Default credentials
F5 Insight UI https://<INSTANCE_IP> Credentials provisioned through cloud-init

First-time access:

  1. Open the F5 Insight UI: https://<INSTANCE_IP>:443
  2. Log in with the credentials you configured in cloud-init.

Post-installation configuration and licensing

  1. Log in to F5 Insight at https://<INSTANCE_IP>:443.
  2. Select Get Started.
  3. Enter your JSON Web Token (JWT) and select Validate & Activate License.

Configure AI provider API keys (optional)

  1. Select your LLM provider and fill in the corresponding credentials, then select “Save & Continue”
  2. Insert your AIDF credentials. You can get the credentials from your account team. However, for now during beta, please select “Skip for Now”

Add BIG-IP devices to F5 Insight

Once you press “Skip for Now” you will be greeted with a page to “Start Fresh” or “Import configuration from Existing Application Study Tool Instance.”

If you choose to “Start Fresh” you will have the option to add a CA, add devices via YAML, or add individual devices manually. In addition, you must choose which module or data you would like to see populated.

Note

We recommend using a CA when adding devices, but that configuration is optional.

Note

In addition, we’re going to ask that you sort your BIG-IP devices by datacenter. Tagging of devices to a specific datacenter is crucial in providing timely alerts, cross comparison of performance, and much more.

If you choose the YAML route, paste your configuration files when prompted.

Once complete, you are redirected to the homepage.

Configure BIG-IP for additional application logs/telemetry

F5 Insight’s OTEL Syslog receiver will be listening on port 30514 for SSLO logs and iRule telemetry.

Refer to Application telemetry and F5 AI Data Fabric guide for detailed setup instructions.

Appendix: Quick reference — CLI-only deployment

For administrators who prefer the command line, here is the complete process using the AWS CLI. Run all commands from a workstation with the AWS CLI configured, or from AWS CloudShell.

# Variables — customize these values
REGION="<REGION>"
BUCKET_NAME="<BUCKET_NAME>"
OVA="f5insight-<VERSION>.ova"
VPC_ID="<VPC_ID>"
SUBNET_ID="<SUBNET_ID>"
MANAGEMENT_CIDR="<MANAGEMENT_CIDR>"
INSTANCE_TYPE="<INSTANCE_TYPE>"
KEY_PAIR_NAME="<KEY_PAIR_NAME>"

# Step 1: Upload the OVA to S3
aws s3 cp "$OVA" "s3://$BUCKET_NAME/$OVA" --region "$REGION"

# Step 2: Import the OVA as an EBS snapshot
IMPORT_TASK_ID=$(aws ec2 import-snapshot \
  --region "$REGION" \
  --description "$OVA" \
  --disk-container "{\"Description\":\"$OVA\",\"Format\":\"OVA\",\"UserBucket\":{\"S3Bucket\":\"$BUCKET_NAME\",\"S3Key\":\"$OVA\"}}" \
  --query ImportTaskId --output text)

# Step 3: Poll until the import completes, then capture the snapshot ID
aws ec2 describe-import-snapshot-tasks --region "$REGION" --import-task-ids "$IMPORT_TASK_ID"
SNAPSHOT_ID="<SNAPSHOT_ID_FROM_ABOVE>"

# Step 4: Register the AMI (UEFI boot mode)
AMI_ID=$(aws ec2 register-image \
  --region "$REGION" \
  --name "f5-insight" \
  --root-device-name "/dev/sda1" \
  --block-device-mappings "[{\"DeviceName\":\"/dev/sda1\",\"Ebs\":{\"DeleteOnTermination\":true,\"SnapshotId\":\"$SNAPSHOT_ID\",\"VolumeType\":\"gp3\",\"Iops\":3000,\"Throughput\":125}}]" \
  --ena-support --sriov-net-support simple --virtualization-type hvm --imds-support v2.0 --boot-mode uefi \
  --query ImageId --output text)

# Step 5: Create a security group and open SSH/HTTPS
SECURITY_GROUP_ID=$(aws ec2 create-security-group \
  --region "$REGION" --group-name f5-insight-sg --description "F5 Insight security group" --vpc-id "$VPC_ID" \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --region "$REGION" --group-id "$SECURITY_GROUP_ID" --protocol tcp --port 22 --cidr "$MANAGEMENT_CIDR"
aws ec2 authorize-security-group-ingress --region "$REGION" --group-id "$SECURITY_GROUP_ID" --protocol tcp --port 443 --cidr "$MANAGEMENT_CIDR"

# Step 6: Launch the instance
INSTANCE_ID=$(aws ec2 run-instances \
  --region "$REGION" \
  --image-id "$AMI_ID" \
  --instance-type "$INSTANCE_TYPE" \
  --key-name "$KEY_PAIR_NAME" \
  --security-group-ids "$SECURITY_GROUP_ID" \
  --subnet-id "$SUBNET_ID" \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":650,"VolumeType":"gp3"}}]' \
  --user-data file://cloud-config.yml \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=f5-insight-01}]' \
  --query 'Instances[0].InstanceId' --output text)

# Step 7: Allocate and associate an Elastic IP
ALLOCATION_ID=$(aws ec2 allocate-address --region "$REGION" --query AllocationId --output text)
aws ec2 associate-address --region "$REGION" --instance-id "$INSTANCE_ID" --allocation-id "$ALLOCATION_ID"

Note

The create-ami.sh helper script automates steps 1-4 above.