salt.modules.bigip#

An execution module which can manipulate an f5 bigip via iControl REST

maturity:: develop
platform:: f5_bigip_11.6

salt.modules.bigip.add_pool_member(hostname, username, password, name, member)#

A function to connect to a bigip device and add a new member to an existing pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to modify
member: The name of the member to add i.e. 10.1.1.2:80

CLI Example:

salt '*' bigip.add_pool_members bigip admin admin my-pool 10.2.2.1:80

salt.modules.bigip.commit_transaction(hostname, username, password, label)#

A function to connect to a bigip device and commit an existing transaction.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
label: the label of this transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.commit_transaction bigip admin admin my_transaction

salt.modules.bigip.create_monitor(hostname, username, password, monitor_type, name, **kwargs)#

A function to connect to a bigip device and create a monitor.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
monitor_type: The type of monitor to create
name: The name of the monitor to create
kwargs: Consult F5 BIGIP user guide for specific options for each monitor type. Typically, tmsh arg names are used.

CLI Example:

salt '*' bigip.create_monitor bigip admin admin http my-http-monitor timeout=10 interval=5

salt.modules.bigip.create_node(hostname, username, password, name, address, trans_label=None)#

A function to connect to a bigip device and create a node.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the node
address: The address of the node
trans_label: The label of the transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.create_node bigip admin admin 10.1.1.2

salt.modules.bigip.create_pool(hostname, username, password, name, members=None, allow_nat=None, allow_snat=None, description=None, gateway_failsafe_device=None, ignore_persisted_weight=None, ip_tos_to_client=None, ip_tos_to_server=None, link_qos_to_client=None, link_qos_to_server=None, load_balancing_mode=None, min_active_members=None, min_up_members=None, min_up_members_action=None, min_up_members_checking=None, monitor=None, profiles=None, queue_depth_limit=None, queue_on_connection_limit=None, queue_time_limit=None, reselect_tries=None, service_down_action=None, slow_ramp_time=None)#

A function to connect to a bigip device and create a pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to create.
members: List of comma delimited pool members to add to the pool. i.e. 10.1.1.1:80,10.1.1.2:80,10.1.1.3:80
allow_nat: [yes | no]
allow_snat: [yes | no]
description: [string]
gateway_failsafe_device: [string]
ignore_persisted_weight: [enabled | disabled]
ip_tos_to_client: [pass-through | [integer]]
ip_tos_to_server: [pass-through | [integer]]
link_qos_to_client: [pass-through | [integer]]
link_qos_to_server: [pass-through | [integer]]
load_balancing_mode: [dynamic-ratio-member | dynamic-ratio-node | fastest-app-response | fastest-node | least-connections-members | least-connections-node | least-sessions | observed-member | observed-node | predictive-member | predictive-node | ratio-least-connections-member | ratio-least-connections-node | ratio-member | ratio-node | ratio-session | round-robin | weighted-least-connections-member | weighted-least-connections-node]
min_active_members: [integer]
min_up_members: [integer]
min_up_members_action: [failover | reboot | restart-all]
min_up_members_checking: [enabled | disabled]
monitor: [name]
profiles: [none | profile_name]
queue_depth_limit: [integer]
queue_on_connection_limit: [enabled | disabled]
queue_time_limit: [integer]
reselect_tries: [integer]
service_down_action: [drop | none | reselect | reset]
slow_ramp_time: [integer]

CLI Example:

salt '*' bigip.create_pool bigip admin admin my-pool 10.1.1.1:80,10.1.1.2:80,10.1.1.3:80 monitor=http

salt.modules.bigip.create_profile(hostname, username, password, profile_type, name, **kwargs)#

A function to connect to a bigip device and create a profile.

hostname

The host/address of the bigip device

username

The iControl REST username

password

The iControl REST password

profile_type

The type of profile to create

name

The name of the profile to create

kwargs

[ arg=val ] ... [arg=key1:val1,key2:val2] ...

Consult F5 BIGIP user guide for specific options for each monitor type. Typically, tmsh arg names are used.

Creating Complex Args

Profiles can get pretty complicated in terms of the amount of possible config options. Use the following shorthand to create complex arguments such as lists, dictionaries, and lists of dictionaries. An option is also provided to pass raw json as well.

lists [i,i,i]:: param='item1,item2,item3'
Dictionary [k:v,k:v,k,v]:: param='key-1:val-1,key-2:val2,key-3:va-3'
List of Dictionaries [k:v,k:v|k:v,k:v|k:v,k:v]:: param='key-1:val-1,key-2:val-2|key-1:val-1,key-2:val-2|key-1:val-1,key-2:val-2'
JSON: 'j{ ... }j':: cert-key-chain='j{ "default": { "cert": "default.crt", "chain": "default.crt", "key": "default.key" } }j'
Escaping Delimiters:: Use \, or \: or \| to escape characters which shouldn't be treated as delimiters i.e. ciphers='DEFAULT\:!SSLv3'

CLI Example:

salt '*' bigip.create_profile bigip admin admin http my-http-profile defaultsFrom='/Common/http'
salt '*' bigip.create_profile bigip admin admin http my-http-profile defaultsFrom='/Common/http' \
    enforcement=maxHeaderCount:3200,maxRequests:10

salt.modules.bigip.create_virtual(hostname, username, password, name, destination, pool=None, address_status=None, auto_lasthop=None, bwc_policy=None, cmp_enabled=None, connection_limit=None, dhcp_relay=None, description=None, fallback_persistence=None, flow_eviction_policy=None, gtm_score=None, ip_forward=None, ip_protocol=None, internal=None, twelve_forward=None, last_hop_pool=None, mask=None, mirror=None, nat64=None, persist=None, profiles=None, policies=None, rate_class=None, rate_limit=None, rate_limit_mode=None, rate_limit_dst=None, rate_limit_src=None, rules=None, related_rules=None, reject=None, source=None, source_address_translation=None, source_port=None, state=None, traffic_classes=None, translate_address=None, translate_port=None, vlans=None)#

A function to connect to a bigip device and create a virtual server.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the virtual to create
destination: [ [virtual_address_name:port] | [ipv4:port] | [ipv6.port] ]
pool: [ [pool_name] | none]
address_status: [yes | no]
auto_lasthop: [default | enabled | disabled ]
bwc_policy: [none] | string]
cmp_enabled: [yes | no]
dhcp_relay: [yes | no]
connection_limit: [integer]
description: [string]
state: [disabled | enabled]
fallback_persistence: [none | [profile name] ]
flow_eviction_policy: [none | [eviction policy name] ]
gtm_score: [integer]
ip_forward: [yes | no]
ip_protocol: [any | protocol]
internal: [yes | no]
twelve_forward: (12-forward) [yes | no]
last_hop-pool: [ [pool_name] | none]
mask: { [ipv4] | [ipv6] }
mirror: { [disabled | enabled | none] }
nat64: [enabled | disabled]
persist: [none | profile1,profile2,profile3 ... ]
profiles: [none | default | profile1,profile2,profile3 ... ]
policies: [none | default | policy1,policy2,policy3 ... ]
rate_class: [name]
rate_limit: [integer]
rate_limit_mode: [destination | object | object-destination | object-source | object-source-destination | source | source-destination]
rate_limit_dst: [integer]
rate_limitçsrc: [integer]
rules: [none | [rule_one,rule_two ...] ]
related_rules: [none | [rule_one,rule_two ...] ]
reject: [yes | no]
source: { [ipv4[/prefixlen]] | [ipv6[/prefixlen]] }
source_address_translation: [none | snat:pool_name | lsn | automap ]
source_port: [change | preserve | preserve-strict]
state: [enabled | disabled]
traffic_classes: [none | default | class_one,class_two ... ]
translate_address: [enabled | disabled]
translate_port: [enabled | disabled]
vlans: [none | default | [enabled|disabled]:vlan1,vlan2,vlan3 ... ]

CLI Example:

salt '*' bigip.create_virtual bigip admin admin my-virtual-3 26.2.2.5:80 \
    pool=my-http-pool-http profiles=http,tcp

salt '*' bigip.create_virtual bigip admin admin my-virtual-3 43.2.2.5:80 \
    pool=test-http-pool-http profiles=http,websecurity persist=cookie,hash \
    policies=asm_auto_l7_policy__http-virtual \
    rules=_sys_APM_ExchangeSupport_helper,_sys_https_redirect \
    related_rules=_sys_APM_activesync,_sys_APM_ExchangeSupport_helper \
    source_address_translation=snat:my-snat-pool \
    translate_address=enabled translate_port=enabled \
    traffic_classes=my-class,other-class \
    vlans=enabled:external,internal

salt.modules.bigip.delete_monitor(hostname, username, password, monitor_type, name)#

A function to connect to a bigip device and delete an existing monitor.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
monitor_type: The type of monitor to delete
name: The name of the monitor to delete

CLI Example:

salt '*' bigip.delete_monitor bigip admin admin http my-http-monitor

salt.modules.bigip.delete_node(hostname, username, password, name, trans_label=None)#

A function to connect to a bigip device and delete a specific node.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the node which will be deleted.
trans_label: The label of the transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.delete_node bigip admin admin my-node

salt.modules.bigip.delete_pool(hostname, username, password, name)#

A function to connect to a bigip device and delete a specific pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool which will be deleted

CLI Example

salt '*' bigip.delete_node bigip admin admin my-pool

salt.modules.bigip.delete_pool_member(hostname, username, password, name, member)#

A function to connect to a bigip device and delete a specific pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to modify
member: The name of the pool member to delete

CLI Example:

salt '*' bigip.delete_pool_member bigip admin admin my-pool 10.2.2.2:80

salt.modules.bigip.delete_profile(hostname, username, password, profile_type, name)#

A function to connect to a bigip device and delete an existing profile.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
profile_type: The type of profile to delete
name: The name of the profile to delete

CLI Example:

salt '*' bigip.delete_profile bigip admin admin http my-http-profile

salt.modules.bigip.delete_transaction(hostname, username, password, label)#

A function to connect to a bigip device and delete an existing transaction.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
label: The label of this transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.delete_transaction bigip admin admin my_transaction

salt.modules.bigip.delete_virtual(hostname, username, password, name)#

A function to connect to a bigip device and delete a specific virtual.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the virtual to delete

CLI Example:

salt '*' bigip.delete_virtual bigip admin admin my-virtual

salt.modules.bigip.list_monitor(hostname, username, password, monitor_type, name=None)#

A function to connect to a bigip device and list an existing monitor. If no name is provided than all monitors of the specified type will be listed.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
monitor_type: The type of monitor(s) to list
name: The name of the monitor to list

CLI Example:

salt '*' bigip.list_monitor bigip admin admin http my-http-monitor

salt.modules.bigip.list_node(hostname, username, password, name=None, trans_label=None)#

A function to connect to a bigip device and list all nodes or a specific node.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the node to list. If no name is specified than all nodes will be listed.
trans_label: The label of the transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.list_node bigip admin admin my-node

salt.modules.bigip.list_pool(hostname, username, password, name=None)#

A function to connect to a bigip device and list all pools or a specific pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to list. If no name is specified then all pools will be listed.

CLI Example:

salt '*' bigip.list_pool bigip admin admin my-pool

salt.modules.bigip.list_profile(hostname, username, password, profile_type, name=None)#

A function to connect to a bigip device and list an existing profile. If no name is provided than all profiles of the specified type will be listed.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
profile_type: The type of profile(s) to list
name: The name of the profile to list

CLI Example:

salt '*' bigip.list_profile bigip admin admin http my-http-profile

salt.modules.bigip.list_transaction(hostname, username, password, label)#

A function to connect to a bigip device and list an existing transaction.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
label: the label of this transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.list_transaction bigip admin admin my_transaction

salt.modules.bigip.list_virtual(hostname, username, password, name=None)#

A function to connect to a bigip device and list all virtuals or a specific virtual.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the virtual to list. If no name is specified than all virtuals will be listed.

CLI Example:

salt '*' bigip.list_virtual bigip admin admin my-virtual

salt.modules.bigip.modify_monitor(hostname, username, password, monitor_type, name, **kwargs)#

A function to connect to a bigip device and modify an existing monitor.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
monitor_type: The type of monitor to modify
name: The name of the monitor to modify
kwargs: Consult F5 BIGIP user guide for specific options for each monitor type. Typically, tmsh arg names are used.

CLI Example:

salt '*' bigip.modify_monitor bigip admin admin http my-http-monitor  timout=16 interval=6

salt.modules.bigip.modify_node(hostname, username, password, name, connection_limit=None, description=None, dynamic_ratio=None, logging=None, monitor=None, rate_limit=None, ratio=None, session=None, state=None, trans_label=None)#

A function to connect to a bigip device and modify an existing node.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the node to modify
connection_limit: [integer]
description: [string]
dynamic_ratio: [integer]
logging: [enabled | disabled]
monitor: [[name] | none | default]
rate_limit: [integer]
ratio: [integer]
session: [user-enabled | user-disabled]
state: [user-down | user-up ]
trans_label: The label of the transaction stored within the grain: bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.modify_node bigip admin admin 10.1.1.2 ratio=2 logging=enabled

salt.modules.bigip.modify_pool(hostname, username, password, name, allow_nat=None, allow_snat=None, description=None, gateway_failsafe_device=None, ignore_persisted_weight=None, ip_tos_to_client=None, ip_tos_to_server=None, link_qos_to_client=None, link_qos_to_server=None, load_balancing_mode=None, min_active_members=None, min_up_members=None, min_up_members_action=None, min_up_members_checking=None, monitor=None, profiles=None, queue_depth_limit=None, queue_on_connection_limit=None, queue_time_limit=None, reselect_tries=None, service_down_action=None, slow_ramp_time=None)#

A function to connect to a bigip device and modify an existing pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to modify.
allow_nat: [yes | no]
allow_snat: [yes | no]
description: [string]
gateway_failsafe_device: [string]
ignore_persisted_weight: [yes | no]
ip_tos_to_client: [pass-through | [integer]]
ip_tos_to_server: [pass-through | [integer]]
link_qos_to_client: [pass-through | [integer]]
link_qos_to_server: [pass-through | [integer]]
load_balancing_mode: [dynamic-ratio-member | dynamic-ratio-node | fastest-app-response | fastest-node | least-connections-members | least-connections-node | least-sessions | observed-member | observed-node | predictive-member | predictive-node | ratio-least-connections-member | ratio-least-connections-node | ratio-member | ratio-node | ratio-session | round-robin | weighted-least-connections-member | weighted-least-connections-node]
min_active_members: [integer]
min_up_members: [integer]
min_up_members_action: [failover | reboot | restart-all]
min_up_members_checking: [enabled | disabled]
monitor: [name]
profiles: [none | profile_name]
queue_on_connection_limit: [enabled | disabled]
queue_depth_limit: [integer]
queue_time_limit: [integer]
reselect_tries: [integer]
service_down_action: [drop | none | reselect | reset]
slow_ramp_time: [integer]

CLI Example:

salt '*' bigip.modify_pool bigip admin admin my-pool 10.1.1.1:80,10.1.1.2:80,10.1.1.3:80 min_active_members=1

salt.modules.bigip.modify_pool_member(hostname, username, password, name, member, connection_limit=None, description=None, dynamic_ratio=None, inherit_profile=None, logging=None, monitor=None, priority_group=None, profiles=None, rate_limit=None, ratio=None, session=None, state=None)#

A function to connect to a bigip device and modify an existing member of a pool.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to modify
member: The name of the member to modify i.e. 10.1.1.2:80
connection_limit: [integer]
description: [string]
dynamic_ratio: [integer]
inherit_profile: [enabled | disabled]
logging: [enabled | disabled]
monitor: [name]
priority_group: [integer]
profiles: [none | profile_name]
rate_limit: [integer]
ratio: [integer]
session: [user-enabled | user-disabled]
state: [ user-up | user-down ]

CLI Example:

salt '*' bigip.modify_pool_member bigip admin admin my-pool 10.2.2.1:80 state=use-down session=user-disabled

salt.modules.bigip.modify_profile(hostname, username, password, profile_type, name, **kwargs)#

A function to connect to a bigip device and create a profile.

hostname

The host/address of the bigip device

username

The iControl REST username

password

The iControl REST password

profile_type

The type of profile to create

name

The name of the profile to create

kwargs

[ arg=val ] ... [arg=key1:val1,key2:val2] ...

Consult F5 BIGIP user guide for specific options for each monitor type. Typically, tmsh arg names are used.

Creating Complex Args

Profiles can get pretty complicated in terms of the amount of possible config options. Use the following shorthand to create complex arguments such as lists, dictionaries, and lists of dictionaries. An option is also provided to pass raw json as well.

lists [i,i,i]:
param='item1,item2,item3'

Dictionary [k:v,k:v,k,v]:
param='key-1:val-1,key-2:val2,key-3:va-3'

List of Dictionaries [k:v,k:v|k:v,k:v|k:v,k:v]:
param='key-1:val-1,key-2:val-2|key-1:val-1,key-2:val-2|key-1:val-1,key-2:val-2'

JSON: 'j{ ... }j':
cert-key-chain='j{ "default": { "cert": "default.crt", "chain": "default.crt", "key": "default.key" } }j'

Escaping Delimiters:
Use \, or \: or \| to escape characters which shouldn't be treated as delimiters i.e. ciphers='DEFAULT\:!SSLv3'

CLI Example:

salt '*' bigip.modify_profile bigip admin admin http my-http-profile defaultsFrom='/Common/http'

salt '*' bigip.modify_profile bigip admin admin http my-http-profile defaultsFrom='/Common/http' \
    enforcement=maxHeaderCount:3200,maxRequests:10

salt '*' bigip.modify_profile bigip admin admin client-ssl my-client-ssl-1 retainCertificate=false \
    ciphers='DEFAULT\:!SSLv3'
    cert_key_chain='j{ "default": { "cert": "default.crt", "chain": "default.crt", "key": "default.key" } }j'

salt.modules.bigip.modify_virtual(hostname, username, password, name, destination=None, pool=None, address_status=None, auto_lasthop=None, bwc_policy=None, cmp_enabled=None, connection_limit=None, dhcp_relay=None, description=None, fallback_persistence=None, flow_eviction_policy=None, gtm_score=None, ip_forward=None, ip_protocol=None, internal=None, twelve_forward=None, last_hop_pool=None, mask=None, mirror=None, nat64=None, persist=None, profiles=None, policies=None, rate_class=None, rate_limit=None, rate_limit_mode=None, rate_limit_dst=None, rate_limit_src=None, rules=None, related_rules=None, reject=None, source=None, source_address_translation=None, source_port=None, state=None, traffic_classes=None, translate_address=None, translate_port=None, vlans=None)#

A function to connect to a bigip device and modify an existing virtual server.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the virtual to modify
destination: [ [virtual_address_name:port] | [ipv4:port] | [ipv6.port] ]
pool: [ [pool_name] | none]
address_status: [yes | no]
auto_lasthop: [default | enabled | disabled ]
bwc_policy: [none] | string]
cmp_enabled: [yes | no]
dhcp_relay: [yes | no}
connection_limit: [integer]
description: [string]
state: [disabled | enabled]
fallback_persistence: [none | [profile name] ]
flow_eviction_policy: [none | [eviction policy name] ]
gtm_score: [integer]
ip_forward: [yes | no]
ip_protocol: [any | protocol]
internal: [yes | no]
twelve_forward: (12-forward) [yes | no]
last_hop-pool: [ [pool_name] | none]
mask: { [ipv4] | [ipv6] }
mirror: { [disabled | enabled | none] }
nat64: [enabled | disabled]
persist: [none | profile1,profile2,profile3 ... ]
profiles: [none | default | profile1,profile2,profile3 ... ]
policies: [none | default | policy1,policy2,policy3 ... ]
rate_class: [name]
rate_limit: [integer]
rate_limitr_mode: [destination | object | object-destination | object-source | object-source-destination | source | source-destination]
rate_limit_dst: [integer]
rate_limit_src: [integer]
rules: [none | [rule_one,rule_two ...] ]
related_rules: [none | [rule_one,rule_two ...] ]
reject: [yes | no]
source: { [ipv4[/prefixlen]] | [ipv6[/prefixlen]] }
source_address_translation: [none | snat:pool_name | lsn | automap ]
source_port: [change | preserve | preserve-strict]
state: [enabled | disable]
traffic_classes: [none | default | class_one,class_two ... ]
translate_address: [enabled | disabled]
translate_port: [enabled | disabled]
vlans: [none | default | [enabled|disabled]:vlan1,vlan2,vlan3 ... ]

CLI Example:

salt '*' bigip.modify_virtual bigip admin admin my-virtual source_address_translation=none
salt '*' bigip.modify_virtual bigip admin admin my-virtual rules=my-rule,my-other-rule

salt.modules.bigip.replace_pool_members(hostname, username, password, name, members)#

A function to connect to a bigip device and replace members of an existing pool with new members.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
name: The name of the pool to modify
members: List of comma delimited pool members to replace existing members with. i.e. 10.1.1.1:80,10.1.1.2:80,10.1.1.3:80

CLI Example:

salt '*' bigip.replace_pool_members bigip admin admin my-pool 10.2.2.1:80,10.2.2.2:80,10.2.2.3:80

salt.modules.bigip.start_transaction(hostname, username, password, label)#

A function to connect to a bigip device and start a new transaction.

hostname: The host/address of the bigip device
username: The iControl REST username
password: The iControl REST password
label: The name / alias for this transaction. The actual transaction id will be stored within a grain called bigip_f5_trans:<label>

CLI Example:

salt '*' bigip.start_transaction bigip admin admin my_transaction

Table of Contents

salt.modules.bigip#