F5 BIG-IP load balancer discovery using API

Preston_83
Tera Contributor

‎07-27-2023 11:38 AM

We are just starting out with application service mapping and have a few questions.

 

We have a F5 load balancer pool as our entry point.  When the service mapping discovery runs, we get an SSH error, which can most of the time be ignored.


We have SNMP v3 configured as well as API access with a service account on the F5 clusters.  My service mapping logs are throwing errors in the check for http to https iRule connection section of the pattern. 

 

My question is, do the API access rules cover this error?  I am able to look at iRules using postman with my service account using 

  • https://" get_attr {"managementIP"}"/mgmt/tm/ltm/"get_attr {"irule"}

How can I verify I have what I need?  The reason I am questioning this is because the F5 discovery document states:
If there are iRules or SNMP community credentials are not enough for discovering outgoing connections, configure SSH credentials on Now Platform.

0 Helpfuls
  • 4,492 Views
6 REPLIES 6

Preston_83
Tera Contributor
In response to Nisha30

a month ago

To answer your technical questions first:

  • Web Services: No, you do not need to create any custom web services. ServiceNow utilizes the native F5 iControl REST API.

  • Credentials: You do not need a special API credential type. You just create a standard Basic Auth credential in the Discovery Credentials table using your F5 admin service account.

  • Triggering it: If you want to force the API, go to discovery_classy_http, look for F5 HTTP, and make sure the HTTP Classification Matches is using the F5REST pattern. You might also need to create a Serverless Discovery Schedule so it doesn't attempt SNMP or SSH, or you can set behaviours. 

Ultimately, the API patterns didn't accomplish everything we needed, especially regarding top-down Service Mapping, which was our main goal. The API just couldn't do both Discovery and Service Mapping perfectly for us.

Ultimately, the easiest and most successful method for our environment was skipping the API. For horizontal Discovery, we are using SNMP with the F5 Load Balancer pattern. For Top/Down Service Mapping, we found SSH was needed to successfully parse out the configurations. I highly recommend relying on SNMP and SSH over the API if you are trying to map services. 

Hope this helps.

0 Helpfuls

AJ_TechTrek
Giga Sage

‎01-18-2024 06:49 AM

Hi @Preston_83 

 

Refer the below, Might be helpful.

 

https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/concept...

 

https://docs.cloud.f5.com/docs/how-to/app-security/apiep-discovery-control

 

https://www.servicenow.com/community/itom-forum/how-to-discover-f5-bigip-ltm/m-p/960788

 

Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.

 

Thanks

AJ

Linkedin Profile:- https://www.linkedin.com/in/ajay-kumar-66a91385/

0 Helpfuls