F5 integration
General Overview
This guide explains the configuration of multi-factor authentication (MFA) for F5 BIG-IP APM utilizing Mirket as the identity provider. Prior configuration and deployment of F5 BIG-IP APM are required before setting up MFA with Mirket.
F5 BIG-IP APM offers various MFA configuration modes. In this integration, we've configured RADIUS authentication with Mirket.
This integration was tested using BIGIP-15.0.1-0.0.11.
Preparation Steps
Before proceeding with these procedures, ensure the following:
You've completed the installation and configuration of the Mirket (go to Mirket Installation Steps).
You've completed the installation of the BIG-IP APM and finished the initialization setup via the Setup Utility.
Make sure that Mirket has an internet connection. (Bence bu maddeye gerek yok.)
Configuring F5 BIG-IP APM
During the Resource Provisioning step in the F5 BIG-IP Setup Utility, make sure you modify the default Local Traffic (LTM) setting to Nominal for Access Policy (APM).
Radius Server Configuration
For RADIUS authentication in F5 BIG-IP, you must add a RADIUS server (the Mirket server IP address) in the AAA Server Groups. This allows F5 BIG-IP APM to authenticate users, granting them access to their resources via the RADIUS server.
Access the BIG-IP APM e web UI using https://<management port IP address>
Go to Access > Authentication > RADIUS.
Click on Create. Then, enter a RADIUS server name in the Name field. For this instance, we are using Mirket_Gateway.
Choose the "Authentication" option in the Mode field.
Input the IP address of the Mirket (RADIUS server) in the Server Address field.
Input the port number that Mirket (RADIUS server) will be used in the Authentication Service Port field. The default port is 1812.
Input a shared secret key to communicate with the RADIUS server (Mirket Radius) in the Secret and Confirm Secret fields,
Input 60 in the Timeout field. Then click on the Finished option to confirm settings.
Configuring Lease Pool
Configuring a lease pool links a set of IPv4 or IPv6 addresses to a network access resource. When a lease pool is allocated to a network access resource, unassigned IP addresses from the pool are automatically assigned to network access clients during their session.
To create a lease pool that offers internal network addresses to users accessing the network through a tunnel:
Go to Access > Connectivity/VPN > Network Access (VPN) > IPV4 lease Pools.
Click on Create. Then, enter a lease pool name in the Name field. Then choose the IP Address Range option in the Type field.
Input the IP addresses in the Start IP Address and End IP Address fields.
Click on Add.
Then click on the Finished option to confirm settings.
Configuring Network Access
With the BIG-IP APM Network Access feature, users have access similar to a traditional IPSec VPN client, allowing employees, partners, and customers to securely reach corporate resources using either a standard web browser or the BIG-IP Edge Client.
Go to Access > Connectivity/VPN > Network Access (VPN) > Network Access Lists.
Then, click on Create and enter a name in the Name field.
Check the Enable checkbox in the Auto launch field.
Click on Finished option to confirm settings. Then, select the Network Settings tab.
Choose the lease pool that you created from the IPV4 Lease Pool dropdown list.
Then click on Update.
Configuring Connectivity Profile Settings
In a virtual server definition, the selection of a connectivity profile defines connectivity and client configurations for a network access session.
Go to Access > Connectivity/VPN > Connectivity > Profiles.
Click on Add and enter a name in the Profile Name field.
Choose "/Common/connectivity" option from the Parent Profile dropdown list.
Then click on OK to confirm settings.
Configuring Webtop
A Webtop mirrors a local machine's functionality and serves as a remote desktop environment, accessible through a web browser.
In BIG-IP APM, you have the option to define three types of webtops:
A network access only Webtop
A portal access Webtop
A full Webtop
Here are the steps to configure a webtop:
Go to Access > Webtops > Webtop Lists.
Click on Create and enter a name in the Name field.
Choose "full" option from the Type dropdown list.
Then click on Finished option to confirm settings.
Configuring Webtop Links
Webtop links refer to the resources added to the Webtop. Once authenticated, users will see these resource links on their Webtop.
Go to Access > Webtop > Webtop Links.
Click on Create and enter a webtop link name in the Name field.
Choose the "Application URL" option from the Link Type dropdown list.
Then click on Finished option to confirm settings.
Access Profile Configuration
Access Profiles serve as the location where criteria are defined to either grant or restrict access to the network's servers, applications, and resources.
Go to Access > Profiles/Policies > Access Profiles (Per-Session Policies).
Click on Create and enter a name in the Name field.
Choose SSL-VPN option from the Profile Type dropdown list.
Click on Add option to add English option in the Accepted Languages field, under the Language Settings section.
Click on Finished option to confirm settings.
Modify the Access Profile
You have the option to utilize an Access Policy to establish a sequence of checks. These checks ensure the necessary level of security on a user's system before granting access to servers, applications, and other network resources.
Also, an access policy can incorporate authentication checks to authenticate users prior to granting access to network resources.
Click on Edit in the row of the Access Profile that you added previously.
Then click on "+" icon.
For a user, the initial page encountered will be a logon page. To incorporate a logon page into the local traffic virtual server:
Choose Logon Page option under the Logon tab.
Click on Add Item and enter a name in the Name field. For this instance, we input the name as Mirket Logon Page.
Choose "en" option from the Language dropdown list.
Then click on Save to confirm settings.
For server authentication, you'll need to first add a logon page action, followed by a AAA server action. The logon page action presents users with a customizable logon page containing fields and text. Once the user enters their logon credentials (such as a username and password), these credentials are transmitted to the specified AAA server via the AAA server action. If authentication is successful, the user proceeds to the Successful branch. However, if the user fails to authenticate, they are directed to the Fallback branch.
Click on the '+' icon to the right of your logon page name.
Select the Authentication tab and then choose the "RADIUS Auth" option.
Click on Add Item option. Then enter a name in the Name field.
Choose the AAA server that was configured previously from the AAA Server dropdown list.
Then click on Save to confirm settings.
Click on the Deny option next to Successful. Then choose Allow option.
Then, click on Save to confirm settings.
Following successful user authentication, a personalized Webtop displaying customized resources and Network Access is presented.
To include a Webtop and Network Access:
Click on the '+' icon next to Successful.
Select the Assignment tab and then choose the "Advanced Resource Assign" option.
Click on Add Item option.
Then click on Add new entry option. Then click on Add/Delete option under the Expression section.
Select the Webtop Links tab and check the Webtop link that you created checkbox.
Select the Webtop tab and choose the Webtop that you created.
Select the Network Access tab and choose the Network Access that you created.
Click on Update and then click on Save to confirm settings.
Then click on Close.
Virtual Server Configuration
In BIG-IP APM, virtual servers are set up with specific configurations for network access connections or accessing web applications. Typically, the IP address allocated to a host virtual server is the one exposed to the Internet.
You have the option to configure a remote access connection for one or multiple internal web applications. For web applications, you establish an Access Policy and local traffic virtual server, allowing end users to access internal web applications via a single external virtual server.
Go to Local Traffic > Virtual Servers > Virtual Server List.
Click on Create and enter a name in the Name field.
Choose the Standard option from the Type dropdown list.
Under the Source Address section, choose the Host option and enter 0.0.0.0/0 in the empty field.
Under the Destination Address/Mask section, choose the Host option and enter the virtual server host IP address in the empty field.
Under the Service Port section, choose the Port option and choose HTTPS option from the dropdown list.
Choose "http" option from the HTTP Profile (Client) dropdown list.
Choose "Use Client Profiles" option from the HTTP Profile (Server) dropdown list.
Choose the clientssl profile to use with this virtual server in the SSL Profile (Client).
Choose the serverssl profile to use with this virtual server in the SSL Profile (Server).
Choose the Access Profile that was previously created from the Access Profile dropdown list.
Choose the Connectivity Profile that was previously created from the Connectivity Profile dropdown list.
Click on Finished option to confirm settings.
Configure Mirket
To enable Mirket to receive authentication requests from BIG-IP APM, follow these steps:
Define BIG-IP APM as a RADIUS client resource within Mirket.
Create an authentication policy for the BIG-IP APM RADIUS client resource or include it in an existing authentication policy.
Attach the BIG-IP APM resource to the Mirket Radius.
Add F5 BIG-IP APM as a Resource in Mirket with Radius Gateway
Before starting, ensure that you have installed Mirket Radius Gateway from the Configuration > Gateway. To add a Radius Gateway to the Mirket, follow these steps:
Go to Configuration > Gateway and click on the Add Radius Gateway button.
On the displayed screen, enter a name for your Radius Gateway in the Name field.
Enter the SAM value of the gateway in the Sam Value field. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls.
Enter the IP address of the server where the gateway is installed in the Host IP Address field.
Enter the authentication port value you set for the gateway in the Auth Port field. The default value is 1812.
Enter the accounting port value you specified for the gateway in the Acc Port field. The default value is 1813. Note: After completing these fields, you must create a RADIUS client for the newly created RADIUS Gateway.
Click on the Add Radius Client option at the bottom of the displayed screen.
Enter a name for your Radius Client in the Radius Client field.
Enter the IP address of the client(firewall) that will communicate with the gateway in the IP Address field.
Enter the secret key that the client will communicate with the gateway in the Secret Key field.
Click on the Save button to confirm the settings.
Configuring Radius Gateway
After creating the Radius Gateway, click on the Download > Config from the menu on the right side of the gateway.
This option will generate a script related to the gateway, which will be displayed from the RADIUS Setup config file. The config file will automatically begin downloading once this option is selected.
Replace the existing config file in the
"C:\MirketRadius"directory with the downloaded file. Alternatively, copy the displayed script and paste it into the config file in"C:\MirketRadius".
Then, restart the Mirket Radius Service.
You can check whether the Radius Gateway you created is active by navigating to Configuration > Gateway.
User and Group configuration on Mirket
To set up multifactor authentication, make sure you have at least one user or group in Mirket.
If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.
Add a Radius Rule to Mirket
Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP, etc.).
First, you should follow these steps:
Go to Configuration > Radius Rules.
Click on the Add Radius Rule button.
On the displayed screen, enter a name for the rule in the Name field.
Enter the rule description in the Description field.
Select the Radius Client to which the rule will apply from the Radius Client dropdown list.
Enter the source IP addresses to which the rule will apply in the Source Adress field.
Select the source countries where the rule will be applied from the Source Country dropdown list.
Click on the Next button.
Specify whether the rule will be applied to a user or a group.
After specifying, click on the Next button.
Select the users or groups to which the rule will apply. Transfer your selections to the Selected Users/Groups table by clicking the arrow icon next to the Available Users/Groups table.
Click on the Next button.
Select the time period when the rule will run.
All: The rule will run every day.
Recurring: The rule will run on the specified days and times.
One Time: The rule will run within the date range you specify.
After selecting, click on the Next button.
Specify whether the user or group will be granted access based on the rule in the Action field.
Select the authentication provider to which the rule will apply from the Auth Method dropdown list.
Click on Save to confirm the settings.
Test the Integration
To validate the integration between Mirket MFA and your F5 BIG-IP APM, perform authentication using a mobile token on your mobile device. For RADIUS resources, available authentication methods include Approve/Deny authentication.
In this example, we illustrate the use of the Approve/Deny authentication method.
Access https:// by opening a web browser.
Enter your Mirket username in the Username field.
Input your password in the Password field.
Click on Logon. Then, select the 'Approve' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.
Click on Logon. Then, select the 'Approve' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.
Click on the Network Access option.
After clicking the option, a pop-up will appear. Then click on "Open F5 Network Access."
Related Topics
Last updated
