Accenture MDR Quick Start Guide for F5® BIG-IP Access Policy Manager (APM)

This quick start guide will help Accenture MDR customers configure F5® BIG-IP Access Policy Manager® (APM) to send logs to the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring F5 BIG-IP APM

To configure the F5 BIG-IP APM to send syslog events, follow the steps below.

1. Login the BIG-IP Configuration Utility portal with Administrator privileges.

2. Go to Main > System > Logs > Configuration > Remote Logging.

3. In the Properties section, provide the following details:

• Remote IP - LCP_IP_Address

• Remote Port - 514

4. Click Add.

5. Click Update to add the configuration.

Note: 

• For logs coming from APM, only the BSD syslog format is supported.

• For LTM along with APM deployment, remote syslog configuration is not required. Based on the signatures in the APM, the collector processes only APM logs.

• F5 BIG-IP APM Event Collector supports Multi-threading logs from LTM 11.6 to 12.1.1 device also.

• Please use below format of iRule if you are using iRule. This is the only format of iRule which we are supporting.

name log_header_requests
height 150

Configuring BIG-IP DNS to log dns queries and responses

I. Creating a pool of remote logging servers

1.On the Main tab, click DNS > Delivery > Load Balancing > Pools or Local Traffic > Pools. The Pool List screen opens.

2.Click Create. The New Pool screen opens.

3.In the Name field, type a unique name for the pool.

4.Using the New Members setting, add the IP address for each remote logging server that you want to include in the pool:

• Type the LCP_ip_address in the Address field, or select a node address from the Node List.

• In the Service Port field, type a service number or select a service name from the list.​​

Note :Ensure that you have configured the correct remote logging port.

5.Click Add and then click Finished.

II. Creating a remote high-speed log destination

1.On the Main tab, click System > Logs > Configuration > Log Destinations. The Log Destinations screen opens.

2.Click Create

3.In the Name field, type a unique, identifiable name for this destination.

4.From the Type list, select Remote High-Speed Log

5.From the Pool Name list, select the pool of remote log servers to which you want the BIG-IP system to send log messages.

6.From the Protocol list, select the protocol used by the high-speed logging pool members.

7.Click Finished.

III. Creating a formatted remote high-speed log destination

1.On the Main tab, click System > Logs > Configuration > Log Destinations. The Log Destinations screen opens.

2.Click Create

3.In the Name field, type a unique, identifiable name for this destination.

4.From the Type list, select a formatted logging destination as Remote Syslog.

5.The BIG-IP system is now configured to send a formatted string of text to the log servers.

6.If you selected Remote Syslog, from the Type list, select a format for the logs, and then from the Forward To select High-Speed Log Destination list, select the destination that points to a pool of remote Syslog servers to which you want the BIG-IP system to send log messages.

7.Click Finished.

IV. Creating a publisher

1.On the Main tab, click System > Logs > Configuration > Log Publishers. The Log Publishers screen opens.

2.Click Create

3.In the Name field, type a unique, identifiable name for this publisher.

4.For the Destinations setting, select the destination created above from the Available list, and click << to move the destination to the Selected list.

Note: If you are using a formatted destination, select the newly-created destination that matches your log servers, such as Remote Syslog, Splunk, or ArcSight.

5.Click Finished.

V. Creating a custom DNS logging profile for logging DNS queries and responses

1.On the Main tab, click DNS > Delivery > Profiles > Other > DNS Logging or Local Traffic > Profiles > Other > DNS Logging. The DNS Logging profile list screen opens.

2.Click Create. The New DNS Logging profile screen opens.

3.In the Name field, type a unique name for the profile.

4.From the Log Publisher list, select a destination to which the BIG-IP system sends DNS log entries.

5.For the Log Queries setting, ensure that the Enabled check box is selected, if you want the BIG-IP system to log all DNS queries.

5.For the Log Responses setting, select the Enabled check box, if you want the BIG-IP system to log all DNS responses.

6.For the Include Query ID setting, select the Enabled check box, if you want the BIG-IP system to include the query ID sent by the client in the log messages.

7.Click Finished.

VI. Adding the DNS logging profile to the listener

1.On the Main tab, click DNS > Delivery > Listeners > select DNS listener
2.From the DNS profile in the Service section, select the DNS profile that you just configured
3.Click update.

LCP Configuration Parameters

Table 1-2: The F5 Big IP(APM) event collector (Syslog -3781) properties to be configured by MSS are shown in the table.