Not too long ago, a question in one of my tech talks came up regarding how F5 sync's ASM policies between devices that may not be apart of the same HA Pair. The question derived from experience with another vendor in which policies would not or could not sync causing inconsistencies and most importantly affecting the end user experience. I personally do not know the specifics though I wanted to take a few minutes to provide a how-to based on my own recent experience deploying a pair of F5 BIG-IP's in AWS.

To provide some background on this specific use case, I was asked to assist in the deployment of two standalone BIG-IP's in separate availability zones. The application I was asked to protect actually resided in both availability zones so the policies needed to be in sync at all times. While my use case was specific to AWS and a single region, this use case is relevant to anyone with applications that may reside in separate data centers or regions in a cloud-based scenario. So with that, let's get started.

Prerequisites

ASM Policy Sync (18)

Define a ConfigSync Address on the Devices to Share ASM Configs

  • Navigate to Device Management >> Devices.
  • Click the device listed.
  • Select the ConfigSync tab.
  • From the drop-down menu, select a local address to be used.

Note: I am using the Internal Self IP for demonstration purposes.

ASM Policy Sync (5)

  • Repeat this step on the other device to be synced.

Configuring a Device Trust

  • Navigate to Device Management >> Device Trust : Device Trust Members.
  • Click Add.

ASM Policy Sync (2)

  • Device Type: Peer
  • Device IP Address: Management or Self IP address of peer
  • Administrator Username: admin
  • Administrator Password: the admin password
  • Click Retrieve Device Information.

ASM Policy Sync (3)

  • Click Device Certificate Matches.

ASM Policy Sync (4)

  • Click Add Device.

ASM Policy Sync (7)

ASM Policy Sync (8)

Create a Sync-Only Device Group

  • Navigate to Device Management >> Device Groups.
  • Click Create.

ASM Policy Sync (6)

  • Name: demo_sync_only
  • Group Type: Sync-Only
  • Members: Include the BIG-IP's to be synced
  • Sync Type: Automatic with Incremental Sync
  • Click Finished.

ASM Policy Sync (9)

ASM Policy Sync (10)

Perform Initial Sync of Device Groups if Prompted with Changes Pending

In the event you receive a notice of Changes Pending, perform a sync of Manual Sync Groups. Though the device group created in the previous steps is Automatic, there are global sync groups and trust groups created during the process of establishing trusts. Believe me, there is no need to worry. The device group that was created in this how-to will be synced automatically without manual intervention.

  • Click Changes Pending from the top left of the TMUI.

ASM Policy Sync (13)

  • Identify the Device Group that is not in sync.
  • Click Sync.

ASM Policy Sync (14)

Configure ASM Policy Syncing

Prior to configuring the sync operation for ASM, attached is a screenshot of the policies on the secondary box. Notice there is nothing device prior to completing the steps below.

ASM Policy Sync (11)

  • Navigate to Security >> Options >> Application Security >> Synchronization >> Application Security Synchronization.
  • From the Device Group drop-down menu, select the Device Group created in the previous step.

ASM Policy Sync (12)

Click Save.

Validate the ASM Policy has Synced

Navigate to Device Management >> Overview.

  • Locate demo_sync_group and ensure it shows In Sync.

ASM Policy Sync (15)

Note: If the device group is not in sync, use the following article to troubleshoot ConfigSync issues. https://support.f5.com/csp/article/K13946

  • On the Device that did not previously have the ASM policy, navigate to Security >> Application Security >> Security Policies.
  • Validate the ASM policies have been synced between devices by viewing the Version information as shown below.

ASM Policy Sync (16)

The Screenshot above is of BIG-IP 02 which received its initial sync from BIG-IP 01. However, this is a two sync process. You will see the screenshot below of BIG-IP 01 now after I modified the policy directly on BIG-IP 02. The version now reflects that change.

ASM Policy Sync (17)

You are now successfully syncing ASM policies between BIG-IP's in different regions or data centers. Until next time!