jsn / ServiceNow, simplified.
AustraliaREFERENCE GUIDE

F5 BIG-IP load balancer discovery

ServiceNow documentation·9 min readView source ↗
On this page

F5 BIG-IP load balancer discovery

Discovery and Service Mapping can find F5 BIG-IP load balancers via SNMP, SSH, and through the REST API.

Note: For information on Probe to Pattern migration see the knowledge article KB0694477.

Important: Discovery treats load balancers as licensable entities and attempts to discover them primarily using SNMP. If a load balancer in your system, running on a Linux host, has SNMP and SSH ports open, Discovery might classify it based on the SSH port. This classification has priority over SNMP. To ensure that Discovery properly classifies your hardware load balancers, create a Discovery behavior for load balancers that includes SNMP but not SSH. Software load balancers are treated as applications.

You can download VMware images of BIG-IP with a free 90-day trial from https://www.f5.com/trial.

For F5 Global Traffic Manager (GTM) BIG-IP load balancers, Discovery resolves DNS names for the F5 GTM hardware and all associated servers that receive distributed traffic. To view this data, navigate to All > Configuration > Load Balancers > LB Hardware, open the F5 load balancer record, and select the DNS Names for CIs related list. Service Mapping uses this information to map F5 relationships.

Note: If your F5 BIG-IP device is part of a failover cluster, it can be associated with two cluster nodes. In this case, one of the nodes appears as Operational in the Operational Status field, and the other appears as Non-Operational.

Prerequisites

  • Verify that the following applications are up to date:

    • Discovery and Service Mapping Patterns

    • Visibility Content

    • CMDB CI Class Models

    • Discovery and Service Mapping Patterns

    • Visibility Content

    • CMDB CI Class Models

  • To successfully discover the load balancer pool members, set the display service names option (bigpipe.displayservicenames) of the load balancer to false on the F5 load balancer.

  • For F5 Load Balancer pattern:

    • Configure SNMP credentials on the ServiceNow AI Platform.

    • (Optional) If there are iRules or SNMP community credentials aren't enough for discovering outgoing connections, configure SSH credentials.

    • Configure SNMP credentials on the ServiceNow AI Platform.

    • (Optional) If there are iRules or SNMP community credentials aren't enough for discovering outgoing connections, configure SSH credentials.

      Note: If you don’t want to use SSH credentials, you can use the REST API to create a connection to F5 BIG-IP devices.

      Service Mapping uses the SSH credentials to retrieve connections that aren't from CMDB. Discovering connections using the SSH protocol is a failover mechanism for the SNMP-based discovery.

  • For F5 Load Balancer SSH pattern:

    • Configure SSH credentials.

    • Verify permissions for the following SSH commands. In newer versions of F5 BIG-IP, only A-type GTM pools are supported.

      • list auth partition all

      • list sys global-settings

      • show sys hardware

      • list sys db failover.state

      • list net self one-line

      • show sys mac-address | grep interface

      • show net interface field-fmt

      • show net self | grep -e 'Mac Address' 'IP:'

      • list ltm pool | grep -e 'pool' 'mode'

      • list ltm pool /<partition_name>/* | grep -e 'pool' 'mode'

      • show ltm pool | grep -e 'Ltm::' 'Total Connections'

      • show ltm pool /<partition_name>/* |grep -e 'Ltm::' 'Total Connections'

      • list sys db bigpipe.displayservicenames | grep value

      • show /net vlan | grep -e 'Interface Name' 'Mac' 'Tag'

      • show ltm virtual detail | grep -e 'Server:' 'State' 'Pool:' 'Destination' 'Total Connections'

      • show ltm virtual detail /<partition_name>/* | grep -e 'Server:' 'State' 'Pool:' 'Destination' 'Total Connections'

      • show gtm wideip | grep -e 'WideIp' 'State'

      • list wideip a /<partition_name>/* | grep -e 'WideIp' 'State'

      • show gtm wideip all | grep -e 'WideIp' 'State'

      • list gtm wideip

      • list gtm wideip all

      • list gtm pool one-line

      • list gtm pool a one-line

      • list gtm pool /<partition_name>/* one-line

      • list gtm pool a /<partition_name>/* one-line

      • list gtm server one-line

  • For F5REST pattern:

    • For horizontal discovery using Discovery, provide read-only permissions to run the following APIs:

      • "https://" + $ipAddress + "/mgmt/tm/ltm/pool"

      • "https://" + $ipAddress + "/mgmt/tm/sys/global-settings"

      • "https://" + $ipAddress + "/mgmt/tm/sys/hardware"

      • "https://" + $ipAddress + "/mgmt/tm/sys/failover"

      • "https://" + $ipAddress + "/mgmt/tm/net/self"

      • "https://" + $ipAddress + "/mgmt/tm/ltm/virtual?$select=destination,mask,vlans"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface/stats"

      • "https://" + $ipAddress + "/mgmt/tm/net/trunk"

      • "https://" + $ipAddress + "/mgmt/tm/net/vlan"

      • "https://" + $ipAddress + "/mgmt/tm/net/vlan/"+<vlan id>+"/interfaces"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip"

      • "https://" + $ipAddress + "/mgmt/tm/cm/traffic-group/"

      • "https://" + $ipAddress + "/mgmt/tm/cm/device"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/server"

      • For BIG-IP starting with version 12:

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/a"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/aaaa"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/cname"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/mx"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/naptr"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/srv"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/a"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/aaaa"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/cname"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/mx"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/naptr"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/srv"

    • Create basic authentication credentials.

  • For F5 REST OAuth 2.0 authentication pattern:

    • Verify read-only permission for the following APIs:

      • "https://" + $ipAddress + "/mgmt/shared/authn/login"

      • "https://" + $ipAddress + "/mgmt/tm/ltm/pool"

      • "https://" + $ipAddress + "/mgmt/tm/sys/global-settings"

      • "https://" + $ipAddress + "/mgmt/tm/sys/hardware"

      • "https://" + $ipAddress + "/mgmt/tm/sys/failover"

      • "https://" + $ipAddress + "/mgmt/tm/net/self"

      • "https://" + $ipAddress + "/mgmt/tm/ltm/virtual?$select=destination,mask,vlans"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface/stats"

      • "https://" + $ipAddress + "/mgmt/tm/net/trunk"

      • "https://" + $ip_address + "/mgmt/tm/net/vlan"

      • "https://" + $ipAddress + "/mgmt/tm/net/vlan/"+<vlan id>+"/interfaces"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip"

      • "https://" + $ipAddress + "/mgmt/tm/cm/traffic-group/"

      • "https://" + $ipAddress + "/mgmt/tm/cm/device"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/server"

      • For BIG-IP starting with version 12:

      • "https://" + $ipAddress + "/mgmt/shared/authn/login"

      • "https://" + $ipAddress + "/mgmt/tm/ltm/pool"

      • "https://" + $ipAddress + "/mgmt/tm/sys/global-settings"

      • "https://" + $ipAddress + "/mgmt/tm/sys/hardware"

      • "https://" + $ipAddress + "/mgmt/tm/sys/failover"

      • "https://" + $ipAddress + "/mgmt/tm/net/self"

      • "https://" + $ipAddress + "/mgmt/tm/ltm/virtual?$select=destination,mask,vlans"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface"

      • "https://" + $ipAddress + "/mgmt/tm/net/interface/stats"

      • "https://" + $ipAddress + "/mgmt/tm/net/trunk"

      • "https://" + $ip_address + "/mgmt/tm/net/vlan"

      • "https://" + $ipAddress + "/mgmt/tm/net/vlan/"+<vlan id>+"/interfaces"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip"

      • "https://" + $ipAddress + "/mgmt/tm/cm/traffic-group/"

      • "https://" + $ipAddress + "/mgmt/tm/cm/device"

      • "https://" + $ipAddress + "/mgmt/tm/gtm/server"

      • For BIG-IP starting with version 12:

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/a"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/aaaa"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/cname"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/mx"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/naptr"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/pool/srv"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/a"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/aaaa"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/cname"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/mx"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/naptr"

        • "https://" + $ipAddress + "/mgmt/tm/gtm/wideip/srv"

    • Create basic authentication credentials.

    • Create a credential alias for the basic authentication credential.

    • Create a serverless discovery schedule.

  • For top-down discovery using Service Mapping, provide permissions to run the following APIs:

    • https://" get_attr {"managementIP"}"/mgmt/tm/ltm/"get_attr {"irule"}

    • https://" get_attr {"managementIP"}"/mgmt/tm/ltm/virtual/~Common~"get_attr {"vip_name"}

    • https://" get_attr {"computer_system.managementIP"}"/mgmt/tm/ltm/pool/"get_attr {"pool_name"}"/members?

  • (Optional) For top-down discovery with Service Mapping, configure applicative credentials.

  • (Optional) For top-down discovery with Service Mapping, provide a user with permissions to run the following commands:

    • bigpipe commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 9)

    • bigpipe and Traffic Management Shell (TMSH) commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 10)

    • Traffic Management Shell (TMSH) commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 11)

    • Traffic Management Shell (TMSH) advanced commands (for BIG-IP LTM F5 or BIG-IP GTM F5 version 10, 11, and 12)

    • The show cm traffic-group – get command for discovering F5 BIG-IP Device Service Clustering

  • (Optional) For top-down discovery with Service Mapping, give the user elevated rights to be able to run Service Mapping commands requiring a privileged user.

F5 cluster discovery

The horizontal discovery process can find F5 clusters. To discover clusters, the credentials must have read permission to traffic groups. For SNMP, this is the regular read permission. For SSH, you need to have Traffic Management Shell (TMSH shell) enabled and accessible.

Note: Because F5 clusters share the same virtual IPs and addresses for all devices, the horizontal discovery process cannot find specific IP addresses for each device.

Classifier, patterns, and probes

Discovery uses these classifiers, probes, and pattern for F5 discovery:

<table id=“table_fzd_2yv_jz”><thead><tr><th>

Classifiers

</th><th>

Trigger probes

</th><th>

Patterns

</th></tr></thead><tbody><tr><td>

F5 BIG-IP Load Balancer

</td><td>

Horizontal discovery probe: launches patterns

</td><td>

These patterns are used for standard horizontal discovery including identifying clusters:

  • F5 Load Balancer

  • F5 Load Balancer SSH

  • F5REST

  • F5 REST OAuth 2.0 authentication

Note: The F5 Load Balancer and F5 Load Balancer SSH patterns include the extension section that discovers F5 certificates.

</td></tr><tr><td>

F5 HTTP

</td><td>

The F5 HTTP classifier does not use a trigger probe. It triggers the F5 Load Balancer REST pattern to perform data collection via REST.

</td><td>

These patterns use iRules to get information via REST. Service Mapping uses these patterns for top-down discovery:

  • F5 Load Balancer REST

  • F5 BigIP GTM

  • F5 BigIP LTM

</td></tr></tbody> </table>To use patterns, verify that the correct pattern is specified in the horizontal pattern probe on the classifier. See Add the Horizontal Pattern probe to a classifier for instructions.

Data collected by Discovery during horizontal discovery

Discovery populates the data in the CMDB when running the F5 patterns.

Field Description Name [name] The name of the load balancer CI. Serial number [serial_number] The serial number of the load balancer hardware. Operational status [operational_status] The operational status of the load balancer. Field Description Name [name] The name of the load balancer interface. MAC Address [mac_address] The MAC address of the interface. Operational status [operational_status] The operational status of the interface.

<table id=“table_lb_pool”><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name [name]

</td><td>

The name of the load balancer pool.

GTM pool names end with the suffix - GTM to differentiate them from LTM pools with the same name.

</td></tr><tr><td>

Load balancing method [load_balancing_method]

</td><td>

The method used to distribute traffic across pool members.

</td></tr></tbody> </table>|Field|Description| |—–|———–| |Name [name]|The name of the pool member.| |IP Address [ip_address]|The IP address of the pool member.| |Service port [service_port]|The port on which the pool member receives traffic.| |Pool [pool]|The load balancer pool that this member belongs to.|

Field Description Name [name] The name of the VLAN. Tag [tag] The tag that identifies the VLAN. MAC Address [mac_address] The MAC address associated with the VLAN. Field Description Name [name] The name of the load balancer service. IP Address [ip_address] The IP address of the load balancer service. Port [port] The port on which the load balancer service receives traffic. Operational status [operational_status] The operational status of the load balancer service. Hit count [hit_count] The number of connections the load balancer service has received. Field Description Name [name] The DNS name associated with the load balancer or its GTM WideIPs. IP Address [ip_address] The IP address associated with the DNS name. Field Description Name [name] The name of the network adapter. IP Address [ip_address] The IP address of the network adapter. Netmask [netmask] The netmask of the network adapter. MAC Address [mac_address] The MAC address of the network adapter. Field Description Name [name] The name of the cluster. Cluster status [cluster_status] The status of the cluster. Cluster ID [cluster_id] The unique identifier of the cluster. IP Address [ip_address] The IP address of the cluster. Field Description Name [name] The name of the cluster node. Cluster ID [cluster_id] The unique identifier of the cluster this node belongs to. Cluster status [cluster_status] The status of the cluster node.

CI relationships

The following relationships are created to support F5 BIG-IP load balancer discovery.

CI Relationship CI Cluster [cmdb_ci_cluster] Hosts::Hosted on F5 BIG-IP [cmdb_ci_lb_bigip] Cluster Node [cmdb_ci_cluster_node] Hosted on::Hosts F5 BIG-IP [cmdb_ci_lb_bigip] Cluster Node [cmdb_ci_cluster_node] Cluster of::Cluster Cluster [cmdb_ci_cluster] F5 BIG-IP [cmdb_ci_lb_bigip] Owns::Owned by DNS Name [cmdb_ci_dns_name]

Connections discovered by Service Mapping during the top-down discovery

Service Mapping performs the top-down discovery of the GTM BIG-IP load balancer in the context of application services. It discovers configured URLs of the GTM BIG-IP load balancers.

Parent Topic:Load balancer discovery

Keep exploring.

Find another answer, or bring this documentation into your own tools.

Search the library →Read via the REST API ↗