Module 5: Limit available devices for AS3 Application Services (new 7.1)

Note

Estimated time to complete: 10 minutes

In prior versions of BIG-IQ, there was no way to limit where application owners could deploy their applications.

In BIG-IQ 7.1, we can associate devices or device groups with a role.

Lab environment access

If you have not yet visited the page Getting Started, please do so.

Tasks

  1. Login to BIG-IQ as david .
  2. Navigate to System > User Management > Users
../../_images/lab-1-11.png
  1. Click on Add to create the user.
  • Auth Provider: local
  • User Name: user-device-limit-as3
  • Full Name: Class 1 Lab 5
  • Password: password
../../_images/lab-1-22.png

Save & Close

  1. Navigate to System > Role Management > Roles > Custom Roles > Application Roles
../../_images/lab-1-32.png
  1. Click on Add and fill out below details to create the custom application role.
  • Name: lab-device-rbac
  • Active Users and Groups: user-device-limit-as3
../../_images/lab-1-41.png
  • Devices: 10.1.1.11 SJC-vBIGIP01.termmarc.com
  • Device Groups: Empty

Warning

Do not forget to remove the cm-bigip-allBigIpDevices from the Device Groups list.

../../_images/lab-1-51.png
  • AS3 Templates: AS3-F5-HTTP-lb-template-big-iq-default-v1
../../_images/lab-1-6.png

Save & Close

  1. Logout as david and log back in as user-device-limit-as3 using the local Auth Provider and click Create application.
../../_images/lab-1-7.png
  1. Click Create to create an Application Service:
Application properties:
  • Grouping = New Application
  • Application Name = LAB_module5
Select an Application Service Template:
  • Template Type = Select AS3-F5-HTTP-lb-template-big-iq-default [AS3]
General Properties:
  • Application Service Name = https_app_service_2
  • Target = SJC-vBIGIP01.termmarc.com
  • Tenant = tenant2
HTTP_Profile. Keep default.
Pool
  • Members: 10.1.20.124, port 80
  • Members: 10.1.20.125, port 80
Service_HTTP
  • Virtual addresses: 10.1.10.120
Analytics_Profile. Keep default.
../../_images/lab-1-8.png

Note

Notice the user doesn’t have access to the other BIG-IPs available in the system.

  1. Click Create.
  2. Check the Application LAB_module5 has been created.
../../_images/lab-1-9.png

Note

If not visible, refresh the page. It can take few seconds for the application service to appear on the dashboard.

  1. Finally, remove the application service https_app_service_2 and the application LAB_module5.
../../_images/lab-1-10.png