Lab 3.1: SSLo configuration through declarative API

Note

Estimated time to complete: 20 minutes

In this lab, Larry will provide to David with a new JSON blob so that David can deploy a SSLo Outbound service with one Declarative API call.

Service creation with one Declarative API call

1. Connect to Visual Studio Code by clicking on the link under Access menu on Ubuntu machine (follow instructions).

1. VSC will open, and on the left menu, click on file postman_SSLo.rest in project directory

1. Now, on the right frame, you can see the different Postman calls. We will run them, one by one. It is important to understand each of them

   1. The first call is to authenticate against the BIG-IQ, and get a token. Use the first call (line #9). Click on Send Request

   

   1. You should see on the right frame, the response from BIG-IQ. Now, you have a token, and you can send REST calls to BIG-IQ.

   2. It is time to send our declarative API call that will configure our required configuration.

   3. The JSON blob (the declarative call) is below. You can notice the different sections (Topology, SSL_Settings, Security Policy, Service_Chain, Service)

      {
          "template": {
              "TOPOLOGY": {
                  "name": "sslo_NewTopology_Dec",
                  "ingressNetwork": {
                      "vlans": [
                          {
                              "name": "/Common/VLAN_TAP"
                          }
                      ]
                  },
                  "type": "topology_l3_outbound",
                  "sslSetting": "ssloT_NewSsl_Dec",
                  "securityPolicy": "ssloP_NewPolicy_Dec"
              },
              "SSL_SETTINGS": {
                  "name": "ssloT_NewSsl_Dec"
              },
              "SECURITY_POLICY": {
                  "name": "ssloP_NewPolicy_Dec",
                  "rules": [
                      {
                          "mode": "edit",
                          "name": "Pinners_Rule",
                          "action": "allow",
                          "operation": "AND",
                          "conditions": [
                              {
                                  "type": "SNI Category Lookup",
                                  "options": {
                                      "category": [
                                          "Pinners"
                                      ]
                                  }
                              },
                              {
                                  "type": "SSL Check",
                                  "options": {
                                      "ssl": true
                                  }
                              }
                          ],
                          "actionOptions": {
                              "ssl": "bypass",
                              "serviceChain": "ssloSC_NewServiceChain_Dec"
                          }
                      },
                      {
                          "mode": "edit",
                          "name": "All Traffic",
                          "action": "allow",
                          "isDefault": true,
                          "operation": "AND",
                          "actionOptions": {
                              "ssl": "intercept"
                          }
                      }
                  ]
              },
              "SERVICE_CHAIN": {
                  "ssloSC_NewServiceChain_Declarative": {
                      "name": "ssloSC_NewServiceChain_Dec",
                      "orderedServiceList": [
                          {
                              "name": "ssloS_ICAP_Dec"
                          }
                      ]
                  }
              },
              "SERVICE": {
                  "ssloS_ICAP_Declarative": {
                      "name": "ssloS_ICAP_Dec",
                      "customService": {
                          "name": "ssloS_ICAP_Dec",
                          "serviceType": "icap",
                          "loadBalancing": {
                              "devices": [
                                  {
                                      "ip": "3.3.3.3",
                                      "port": "1344"
                                  }
                              ]
                          }
                      }
                  }
              }
          },
          "targetList": [
              {
                  "type": "DEVICE",
                  "name": "SEA-vBIGIP01.termmarc.com"
              }
          ]
      }
      

   4. Click on Send Request and check the right frame of the screen.

   

   1. Now, let’s check the status. To do so, we will use another REST call.
   2. Scroll down on the right side and copy the access-workflow ID. This ID is the last string in selflink attribut. In this example the ID is a8d44084-0ace-4cd9-99d0-c9ba789ef128. You might need to click on the link and then copy it from the URL in the new tab to get it copied.

   

   1. On the left side scroll down to the section “Check status” and replace the ID by the one you just copied.

   2. For example:

      GET https://{{bigiq}}/mgmt/cm/sslo/tasks/api/a8d44084-0ace-4cd9-99d0-c9ba789ef128 HTTP/1.1

   3. Now click on Send Request

   4. You should see a 200 OK, and status : Finshed

   

   1. Connect to BIG-IQ GUI as david and double check under SSL Orchestrator that the Topologies: sslo_NewTopology_Dec got created.

   

Note

Congrats, with one call, you deployed a new SSLo Topology including SSL_Settings, Security Policy, Service_Chain and Service