Forum Discussion

neptune_121018's avatar
neptune_121018
Icon for Nimbostratus rankNimbostratus
Feb 09, 2015

Sync ASM security policies between BIG-IPs that are in different datacenters.

In this scenario, the end user has ASM in the primary datacenter, and the application security policies have been configured. This time, they have acquired a new BIG-IP ASM for the secondary datacenter. It will be protectiong the same applications, but located in another datacenters.

 

What's the best way to synchronize the ASM policies between BIG-IPs that are located in different datacenters? I know I can Export and Import, but is there a way to keep them updated?

 

I've used Config Sync to synchronize the ASM security policies between BIG-IPs that are located next to each other (HA Pair). Can something similar be used?

 

ASM Advanced WAF
deployment
design
management
security

1 Reply

Sort By
  • shaggy's avatar
    shaggy
    Icon for Nimbostratus rankNimbostratus
    Feb 09, 2015

    Check out "Overview: Synchronizing ASM systems for disaster recovery"

     

    https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-1-0/4.html

     

    I had this configured in a lab a few years ago, so I don't recall the details/issues.

     

    Scenario:

     

    • Data-Center 1 - primary LTM/ASM pair (1) were in a sync-failover group named dc1_sync_failover
    • Data-Center 2 - secondary LTM/ASM pair (2) were in a sync-failover group named dc2_sync_failover

    High level:

     

    1. Each device must be a part of the trust group of the other three devices (all four devices will trust each other). They (obviously) must also be able to communicate with each other over the selected HA self-IP addresses.
    2. LTM/ASM pair 1 will be configured in dc1_sync_failover sync-failover device-group, and LTM/ASM pair 2 will be configured in dc2_sync_failover sync-failover device-group.
    3. LTM/ASM pair 1 devices should see the dc2_sync_failover device group in their device-group configuration, but will not be members in dc2_sync_failover. - NOTE - I do not remember if I had to manually create the dc2_sync_failover device-group on LTM/ASM pair 1 and add the LTM/ASM pair 2 devices or if it automatically appeared due to the trust-group.
    4. (reverse of 3) LTM/ASM pair 2 devices should see the dc1_sync_failover device group in their device-group configuration, but will not be members in dc1_sync_failover. - NOTE - I do not remember if I had to manually create the dc2_sync_failover device-group on LTM/ASM pair 1 and add the LTM/ASM pair 2 devices or if it automatically appeared due to the trust-group.
    5. Create a sync-only device group that will be used for all four LTM/ASM devices. Creating the group on one device should propagate to all other devices automatically. You should be able to add all four devices to that sync-only group. Afterwards, all devices should be a member of their local sync-failover group and the 'universal' sync-only group.
    6. Configure ASM to use the sync-only group for config-sync.
    7. ASM configs should synchronize among the sync-only device-group, and LTM configuration should sync using the local sync-failover device-group.

    I do not remember where ASM config-sync stops and LTM config-sync begins. ASM policies may be synchronized using the sync-only group, but the LTM configuration that assigns the ASM policy to a virtual server, LTM policy profiles or HTTP-classes, are probably only synced using the local sync-failover group. Because of this, you will need to ensure that the profiles are properly created in each location to assign the ASM policies to the local LTM virtual servers.

     

    I highly recommend running through this in a non-prod environment before doing so in production as you could very easily impact production if something goes awry when manipulating prod device-group configurations.