--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # F5 BIG-IP # F5 BIG-IP load balancer discovery {#ariaid-title1} Release version: Australia Updated August 26, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of F5 BIG-IP Load Balancer Discovery ServiceNow Discovery and Service Mapping enable automated detection and mapping of F5 BIG-IP load balancers using SNMP, SSH, and REST API protocols. This capability helps you maintain accurate Configuration Management Database (CMDB) records and understand load balancer relationships within your infrastructure. Show full answer Show less Load balancers are treated as licensable hardware entities when discovered via SNMP, while software load balancers are classified as applications. F5 Global Traffic Manager (GTM) devices and associated servers are also discovered, with DNS names resolved and stored for relationship mapping. Failover clusters are supported, with cluster nodes classified according to their operational status. ## Prerequisites and Configuration * Ensure Discovery, Service Mapping, Patterns, Visibility Content, CMDB CI Class Models are current. * Configure SNMP credentials on the ServiceNow AI Platform for F5 Load Balancer discovery. * Optionally configure SSH credentials to enhance connection discovery, especially for iRules or if SNMP is insufficient. * For REST API discovery, provide read-only permissions for specific F5 BIG-IP management APIs and create appropriate basic or OAuth 2.0 authentication credentials. * For top-down Service Mapping discovery, configure applicative credentials and provide user permissions to execute required TMSH and bigpipe commands. * To avoid misclassification, customize Discovery behavior to prioritize SNMP over SSH if both ports are open on your load balancer. * Set the F5 load balancer display service names option (bigpipe.displayservicenames) to false to enable discovery of pool members. ## Discovery Methods and Patterns * **Horizontal Discovery:** Uses classifiers and probes with patterns such as F5 Load Balancer, F5 Load Balancer SSH, F5REST, and OAuth 2.0 authentication to identify and collect device data, including clusters. * **Top-Down Discovery (Service Mapping):** Maps application services by discovering GTM BIG-IP load balancers, their configured URLs, and relationships using REST API and SSH. * Clusters are discovered if credentials have read access to traffic groups; however, individual device IPs in clusters may not be uniquely identified due to shared virtual IPs. ## Data Population in CMDB Discovery populates key CI classes and attributes related to F5 BIG-IP load balancers, including: * **Load Balancer CI:** Name, serial number, operational status. * **Interfaces:** Name, MAC address, operational status. * **Pools and Pool Members:** Names, load balancing methods, IP addresses, ports. * **VLANs:** Names, tags, MAC addresses. * **Load Balancer Services:** Names, IPs, ports, operational status, hit counts. * **DNS Names:** Linked to load balancers and GTM WideIPs. * **Network Adapters:** IP addresses, netmasks, MAC addresses. * **Clusters and Cluster Nodes:** Names, statuses, identifiers, IP addresses. ## CI Relationships Discovery creates relationships to model the infrastructure accurately, including: * Clusters hosting F5 BIG-IP load balancers and vice versa. * Cluster nodes linked to clusters and load balancers. * DNS names owned by the F5 BIG-IP devices. ## Practical Benefits for ServiceNow Customers By leveraging this discovery capability, you can: * Automatically identify and maintain accurate records of F5 BIG-IP load balancers and their components in your CMDB. * Understand load balancer pool configurations, services, VLANs, and clustering for better operational insights. * Support failover and clustering scenarios in your infrastructure mapping. * Enable Service Mapping to associate load balancers with application services and traffic flows. * Reduce manual effort and errors in tracking load balancer configurations and relationships. Discovery and Service Mapping can find F5 BIG-IP load balancers via SNMP, SSH, and through the REST API. Note: For information on Probe to Pattern migration see the knowledge article [KB0694477](https://support.servicenow.com/kb_view.do?sysparm_article=KB0694477). Important: Discovery treats load balancers as licensable entities and attempts to discover them primarily using SNMP. If a load balancer in your system, running on a Linux host, has SNMP and SSH ports open, Discovery might classify it based on the SSH port. This classification has priority over SNMP. To ensure that Discovery properly classifies your hardware load balancers, create a Discovery behavior for load balancers that includes SNMP but not SSH. Software load balancers are treated as applications. You can download VMware images of BIG-IP with a free 90-day trial from . For F5 Global Traffic Manager (GTM) BIG-IP load balancers, Discovery resolves DNS names for the F5 GTM hardware and all associated servers that receive distributed traffic. To view this data, navigate to AllConfigurationLoad BalancersLB Hardware, open the F5 load balancer record, and select the DNS Names for CIs related list. [Service Mapping](https://www.servicenow.com/docs/r17v~ek6oACai0yF6IEmdQ "The ServiceNow Service Mapping application discovers all application services in your organization and builds a comprehensive map of all devices, applications, and configuration profiles used in these application services.") uses this information to map F5 relationships. Note: If your F5 BIG-IP device is part of a failover cluster, it can be associated with two cluster nodes. In this case, one of the nodes appears as Operational in the Operational Status field, and the other appears as Non-Operational. ## Prerequisites {#c_LoadBalancerF5BIGIP__section_wsj_rtr_rz} * Verify that the following applications are up to date: * Discovery and Service Mapping Patterns * Visibility Content * CMDB CI Class Models {#c_LoadBalancerF5BIGIP__ul_dcb_5mh_jkc} * To successfully discover the load balancer pool members, set the display service names option (bigpipe.displayservicenames) of the load balancer to false on the F5 load balancer. * For F5 Load Balancer pattern: * Configure [SNMP credentials](https://www.servicenow.com/docs/access?context=c_SNMPCredentials&version=australia&pubname=australia-platform-security&ft:locale=en-US) on the ServiceNow AI Platform. * (Optional) If there are iRules or SNMP community credentials aren't enough for discovering outgoing connections, configure [SSH credentials](https://www.servicenow.com/docs/access?context=r_SSHCredentialsForm&version=australia&pubname=australia-platform-security&ft:locale=en-US). Note: If you don't want to use SSH credentials, you can use the REST API to create a connection to F5 BIG-IP devices. Service Mapping uses the SSH credentials to retrieve connections that aren't from CMDB. Discovering connections using the SSH protocol is a failover mechanism for the SNMP-based discovery. {#c_LoadBalancerF5BIGIP__ul_hr3_125_lgc} * For F5 Load Balancer SSH pattern: * Configure [SSH credentials](https://www.servicenow.com/docs/access?context=r_SSHCredentialsForm&version=australia&pubname=australia-platform-security&ft:locale=en-US). * Verify permissions for the following SSH commands. In newer versions of F5 BIG-IP, only A-type GTM pools are supported. * `list auth partition all` * `list sys global-settings` * `show sys hardware` * `list sys db failover.state` * `list net self one-line` * `show sys mac-address | grep interface` * `show net interface field-fmt` * `show net self | grep -e 'Mac Address' 'IP:'` * `list ltm pool | grep -e 'pool' 'mode'` * `list ltm pool //* | grep -e 'pool' 'mode'` * `show ltm pool | grep -e 'Ltm::' 'Total Connections'` * `show ltm pool //* |grep -e 'Ltm::' 'Total Connections'` * `list sys db bigpipe.displayservicenames | grep value` * `show /net vlan | grep -e 'Interface Name' 'Mac' 'Tag'` * `show ltm virtual detail | grep -e 'Server:' 'State' 'Pool:' 'Destination' 'Total Connections'` * `show ltm virtual detail //* | grep -e 'Server:' 'State' 'Pool:' 'Destination' 'Total Connections'` * `show gtm wideip | grep -e 'WideIp' 'State'` * `list wideip a //* | grep -e 'WideIp' 'State'` * `show gtm wideip all | grep -e 'WideIp' 'State'` * `list gtm wideip` * `list gtm wideip all` * `list gtm pool one-line` * `list gtm pool a one-line` * `list gtm pool //* one-line` * `list gtm pool a //* one-line` * `list gtm server one-line` {#c_LoadBalancerF5BIGIP__ul_ggx_pw5_lgc} {#c_LoadBalancerF5BIGIP__ul_kf1_d25_lgc} * For F5REST pattern: * For horizontal discovery using Discovery, provide read-only permissions to run the following APIs: * "https://" + $ipAddress + "/mgmt/tm/ltm/pool" * "https://" + $ipAddress + "/mgmt/tm/sys/global-settings" * "https://" + $ipAddress + "/mgmt/tm/sys/hardware" * "https://" + $ipAddress + "/mgmt/tm/sys/failover" * "https://" + $ipAddress + "/mgmt/tm/net/self" * "https://" + $ipAddress + "/mgmt/tm/ltm/virtual?$select=destination,mask,vlans" * "https://" + $ipAddress + "/mgmt/tm/net/interface" * "https://" + $ipAddress + "/mgmt/tm/net/interface/stats" * "https://" + $ipAddress + "/mgmt/tm/net/trunk" * "https://" + $ipAddress + "/mgmt/tm/net/vlan" * "https://" + $ipAddress + "/mgmt/tm/net/vlan/"+\+"/interfaces" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip" * "https://" + $ipAddress + "/mgmt/tm/cm/traffic-group/" * "https://" + $ipAddress + "/mgmt/tm/cm/device" * "https://" + $ipAddress + "/mgmt/tm/gtm/server" * For BIG-IP starting with version 12: * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/a" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/aaaa" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/cname" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/mx" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/naptr" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/srv" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/a" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/aaaa" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/cname" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/mx" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/naptr" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/srv" {#c_LoadBalancerF5BIGIP__ul_f5rest_v12} {#c_LoadBalancerF5BIGIP__ul_jx1_3vp_43b} * Create [basic authentication](https://www.servicenow.com/docs/access?context=r_BasicAuthCredentialsForm&version=australia&pubname=australia-platform-security&ft:locale=en-US) credentials. {#c_LoadBalancerF5BIGIP__ul_o4s_325_lgc} * For F5 REST OAuth 2.0 authentication pattern: * Verify read-only permission for the following APIs: * "https://" + $ipAddress + "/mgmt/shared/authn/login" * "https://" + $ipAddress + "/mgmt/tm/ltm/pool" * "https://" + $ipAddress + "/mgmt/tm/sys/global-settings" * "https://" + $ipAddress + "/mgmt/tm/sys/hardware" * "https://" + $ipAddress + "/mgmt/tm/sys/failover" * "https://" + $ipAddress + "/mgmt/tm/net/self" * "https://" + $ipAddress + "/mgmt/tm/ltm/virtual?$select=destination,mask,vlans" * "https://" + $ipAddress + "/mgmt/tm/net/interface" * "https://" + $ipAddress + "/mgmt/tm/net/interface/stats" * "https://" + $ipAddress + "/mgmt/tm/net/trunk" * "https://" + $ip_address + "/mgmt/tm/net/vlan" * "https://" + $ipAddress + "/mgmt/tm/net/vlan/"+\+"/interfaces" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip" * "https://" + $ipAddress + "/mgmt/tm/cm/traffic-group/" * "https://" + $ipAddress + "/mgmt/tm/cm/device" * "https://" + $ipAddress + "/mgmt/tm/gtm/server" * For BIG-IP starting with version 12: * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/a" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/aaaa" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/cname" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/mx" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/naptr" * "https://" + $ipAddress + "/mgmt/tm/gtm/pool/srv" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/a" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/aaaa" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/cname" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/mx" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/naptr" * "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/srv" {#c_LoadBalancerF5BIGIP__ul_oauth_v12} {#c_LoadBalancerF5BIGIP__ul_xys_kv5_lgc} * Create [basic authentication](https://www.servicenow.com/docs/access?context=r_BasicAuthCredentialsForm&version=australia&pubname=australia-platform-security&ft:locale=en-US) credentials. * Create [a credential alias](https://www.servicenow.com/docs/access?context=discovery-credential-alias&version=australia&pubname=australia-platform-security&ft:locale=en-US) for the basic authentication credential. * Create a [serverless discovery schedule](https://www.servicenow.com/docs/u35D1K2Lqo4_2aboykL7og "Create a serverless discovery schedule to discover F5 BIG-IP load balancers through REST OAuth 2.0 authentication (tokens)."). {#c_LoadBalancerF5BIGIP__ul_hyj_y25_lgc} * For top-down discovery using Service Mapping, provide permissions to run the following APIs: * https://" get_attr {"managementIP"}"/mgmt/tm/ltm/"get_attr {"irule"} * https://" get_attr {"managementIP"}"/mgmt/tm/ltm/virtual/\~Common\~"get_attr {"vip_name"} * https://" get_attr {"computer_system.managementIP"}"/mgmt/tm/ltm/pool/"get_attr {"pool_name"}"/members? {#c_LoadBalancerF5BIGIP__ul_ojp_4vp_43b} * (Optional) For top-down discovery with Service Mapping, configure [applicative credentials](https://www.servicenow.com/docs/access?context=applicative-creds&version=australia&pubname=australia-platform-security&ft:locale=en-US). * (Optional) For top-down discovery with Service Mapping, provide a user with permissions to run the following commands: * bigpipe commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 9) * bigpipe and Traffic Management Shell (TMSH) commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 10) * Traffic Management Shell (TMSH) commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 11) * Traffic Management Shell (TMSH) advanced commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 10, 11, and 12) * The show cm traffic-group -- get command for discovering F5 BIG-IP Device Service Clustering {#c_LoadBalancerF5BIGIP__ul_a4y_ppd_cw} * (Optional) For top-down discovery with Service Mapping, give the user elevated rights to be able to run [Service Mapping commands requiring a privileged user](https://www.servicenow.com/docs/fMLKP9ztw9H4ZPck4RnumQ "Service Mapping uses commands requiring elevated rights to discover and map Unix-based hosts in your organization. In addition to configuring necessary credentials, configure servers in your organization to allow Service Mapping to run these commands with elevated rights."). {#c_LoadBalancerF5BIGIP__ul_ldm_byt_sdb} ## F5 cluster discovery {#c_LoadBalancerF5BIGIP__section_dd3_n5z_rdb} The horizontal discovery process can find F5 clusters. To discover clusters, the credentials must have read permission to traffic groups. For SNMP, this is the regular read permission. For SSH, you need to have Traffic Management Shell (TMSH shell) enabled and accessible. Note: Because F5 clusters share the same virtual IPs and addresses for all devices, the horizontal discovery process cannot find specific IP addresses for each device. ## Classifier, patterns, and probes {#c_LoadBalancerF5BIGIP__section_gwv_15r_rz} Discovery uses these classifiers, probes, and pattern for F5 discovery:{#c_LoadBalancerF5BIGIP__table_fzd_2yv_jz__entry__3} | Classifiers | Trigger probes | Patterns | |-|-|-| | F5 BIG-IP Load Balancer | Horizontal discovery probe: launches patterns | These patterns are used for standard horizontal discovery including identifying clusters: * F5 Load Balancer * F5 Load Balancer SSH * F5REST * F5 REST OAuth 2.0 authentication {#c_LoadBalancerF5BIGIP__ul_i2z_zs3_cdb} Note: The F5 Load Balancer and F5 Load Balancer SSH patterns include the extension section that discovers [F5 certificates.](https://www.servicenow.com/docs/jeibRCPdrm_wf~FKUnajIA "The ServiceNow Discovery application uses The F5-SSH-SSL Certification pattern extension to find all associated certificates on F5 load balancers that use IPv4 addresses, IPv6 addresses, or both.") | | F5 HTTP | The F5 HTTP classifier does not use a trigger probe. It triggers the F5 Load Balancer REST pattern to perform data collection via REST. | These patterns use iRules to get information via REST. Service Mapping uses these patterns for top-down discovery: * F5 Load Balancer REST * F5 BigIP GTM * F5 BigIP LTM {#c_LoadBalancerF5BIGIP__ul_ymg_dqg_ndb} | [ ] {#c_LoadBalancerF5BIGIP__table_fzd_2yv_jz} To use patterns, verify that the correct pattern is specified in the horizontal pattern probe on the classifier. See [Add the Horizontal Pattern probe to a classifier](https://www.servicenow.com/docs/WtfJx~H7mHHJKPMU3hBM9w#t_AddHorizontalPatternProbe "To use a pattern for the identification and exploration phases of horizontal discovery, add the Horizontal Pattern probe to the relevant classifiers. The classifiers must match the CI types you are trying to discover.") for instructions. ## Data collected by Discovery during horizontal discovery {#c_LoadBalancerF5BIGIP__section_dwd_j5r_rz} Discovery populates the data in the CMDB when running the F5 patterns. {#c_LoadBalancerF5BIGIP__table_lb_bigip__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the load balancer CI. | | Serial number \[serial_number\] | The serial number of the load balancer hardware. | | Operational status \[operational_status\] | The operational status of the load balancer. | [Table 1. F5 BIG-IP \[cmdb_ci_lb_bigip\]] {#c_LoadBalancerF5BIGIP__table_lb_bigip} {#c_LoadBalancerF5BIGIP__table_lb_interface__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the load balancer interface. | | MAC Address \[mac_address\] | The MAC address of the interface. | | Operational status \[operational_status\] | The operational status of the interface. | [Table 2. Load Balancer Interface \[cmdb_ci_lb_interface\]] {#c_LoadBalancerF5BIGIP__table_lb_interface} {#c_LoadBalancerF5BIGIP__table_lb_pool__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the load balancer pool. GTM pool names end with the suffix - GTM to differentiate them from LTM pools with the same name. | | Load balancing method \[load_balancing_method\] | The method used to distribute traffic across pool members. | [Table 3. Load Balancer Pool \[cmdb_ci_lb_pool\]] {#c_LoadBalancerF5BIGIP__table_lb_pool} {#c_LoadBalancerF5BIGIP__table_lb_pool_member__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the pool member. | | IP Address \[ip_address\] | The IP address of the pool member. | | Service port \[service_port\] | The port on which the pool member receives traffic. | | Pool \[pool\] | The load balancer pool that this member belongs to. | [Table 4. Load Balancer Pool Member \[cmdb_ci_lb_pool_member\]] {#c_LoadBalancerF5BIGIP__table_lb_pool_member} {#c_LoadBalancerF5BIGIP__table_lb_vlan__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the VLAN. | | Tag \[tag\] | The tag that identifies the VLAN. | | MAC Address \[mac_address\] | The MAC address associated with the VLAN. | [Table 5. Load Balancer VLAN \[cmdb_ci_lb_vlan\]] {#c_LoadBalancerF5BIGIP__table_lb_vlan} {#c_LoadBalancerF5BIGIP__table_lb_service__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the load balancer service. | | IP Address \[ip_address\] | The IP address of the load balancer service. | | Port \[port\] | The port on which the load balancer service receives traffic. | | Operational status \[operational_status\] | The operational status of the load balancer service. | | Hit count \[hit_count\] | The number of connections the load balancer service has received. | [Table 6. Load Balancer Service \[cmdb_ci_lb_service\]] {#c_LoadBalancerF5BIGIP__table_lb_service} {#c_LoadBalancerF5BIGIP__table_dns_name__entry__2} | Field | Description | |-|-| | Name \[name\] | The DNS name associated with the load balancer or its GTM WideIPs. | | IP Address \[ip_address\] | The IP address associated with the DNS name. | [Table 7. DNS Name \[cmdb_ci_dns_name\]] {#c_LoadBalancerF5BIGIP__table_dns_name} {#c_LoadBalancerF5BIGIP__table_network_adapter__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the network adapter. | | IP Address \[ip_address\] | The IP address of the network adapter. | | Netmask \[netmask\] | The netmask of the network adapter. | | MAC Address \[mac_address\] | The MAC address of the network adapter. | [Table 8. Network Adapter \[cmdb_ci_network_adapter\]] {#c_LoadBalancerF5BIGIP__table_network_adapter} {#c_LoadBalancerF5BIGIP__table_cluster__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the cluster. | | Cluster status \[cluster_status\] | The status of the cluster. | | Cluster ID \[cluster_id\] | The unique identifier of the cluster. | | IP Address \[ip_address\] | The IP address of the cluster. | [Table 9. Cluster \[cmdb_ci_cluster\]] {#c_LoadBalancerF5BIGIP__table_cluster} {#c_LoadBalancerF5BIGIP__table_cluster_node__entry__2} | Field | Description | |-|-| | Name \[name\] | The name of the cluster node. | | Cluster ID \[cluster_id\] | The unique identifier of the cluster this node belongs to. | | Cluster status \[cluster_status\] | The status of the cluster node. | [Table 10. Cluster Node \[cmdb_ci_cluster_node\]] {#c_LoadBalancerF5BIGIP__table_cluster_node} ## CI relationships {#c_LoadBalancerF5BIGIP__section_qtd_sb5_sdb} The following relationships are created to support F5 BIG-IP load balancer discovery.{#c_LoadBalancerF5BIGIP__table_xkh_stz_rdb__entry__3} | CI | Relationship | CI | |-|-|-| | Cluster \[cmdb_ci_cluster\] | Hosts::Hosted on | F5 BIG-IP \[cmdb_ci_lb_bigip\] | | Cluster Node \[cmdb_ci_cluster_node\] | Hosted on::Hosts | F5 BIG-IP \[cmdb_ci_lb_bigip\] | | Cluster Node \[cmdb_ci_cluster_node\] | Cluster of::Cluster | Cluster \[cmdb_ci_cluster\] | | F5 BIG-IP \[cmdb_ci_lb_bigip\] | Owns::Owned by | DNS Name \[cmdb_ci_dns_name\] | [ ] {#c_LoadBalancerF5BIGIP__table_xkh_stz_rdb} ## Connections discovered by Service Mapping during the top-down discovery {#c_LoadBalancerF5BIGIP__section_knp782sf_908} Service Mapping performs the top-down discovery of the GTM BIG-IP load balancer in the context of application services. It discovers configured URLs of the GTM BIG-IP load balancers. *[\>]: and then